TrustInSoft has commended an initiative by the Cybersecurity and Infrastructure Security Agency (CISA) to identify and address key security practices for enhancing the quality and safety of software products, particularly for industry verticals such as automotive, aerospace, defense, consumer electronics, and IoT industries.
TrustInSoft referred to a document recently published by the U.S. Department of Homeland Security on product security bad practices (docket CISA-2024-0028), in particular areas relating to memory-unsafe languages like C and C++ and provided constructive comments to help inform ongoing cybersecurity developments.
“While memory-related vulnerabilities indeed remain a major security concern, we would like to highlight the continued relevance of C and C++,” wrote Benjamin Monate, Chief Technical Officer, TrustInSoft.
Monate elaborated: “C and C++ languages have a vast repository of well-established libraries that are extensively used across numerous industries. Many organisations rely on these libraries to deliver robust functionality, and transitioning to a new programming language would demand significant cost and effort, especially for regulated sectors requiring specific certifications and compliance.”
Modern, next-generation sound and exhaustive static analysers such as TrustInSoft Analyzer (TISA) support CISA’s software security efforts by offering tools that mathematically prove the absence of memory-related vulnerabilities in software written in C and C++.
These tools are capable of scaling large codebases and offer comprehensive detection of undefined behaviours, including memory safety vulnerabilities. Such analysers have matured to a level where they can be incorporated at various stages of the software development lifecycle (SDLC) and can be invaluable for the vast number of organisations that rely on C and C++.
TISA differs from other tools on the market due to its ability to provide mathematical guarantees of software safety, which goes beyond the heuristic-based detection offered by traditional static or dynamic analysers. Recognised by the U.S. National Institute of Standards and Technology (NIST) for leveraging advanced formal methods, including abstract interpretation, TrustInSoft can mathematically guarantee analysed software is free of critical runtime errors and vulnerabilities.
In his comments, Monate acknowledged that while memory-safe languages like Rust offer promising alternatives, their toolchains do not yet fully support the full range of embedded microcontrollers used across critical industries. For many organisations, C and C++ remain the most viable options, given the available and reliable toolchains compatible with diverse hardware platforms.
It was also suggested that the CISA provide further clarity around the definition of “product” scope, as outlined by the European Union in the Cyber Resilience Act, which would help organisations to ensure adherence with CISA guidelines.
In view of these considerations, Monate recommended additions to the CISA that could be included in the final CISA document: “When using memory-unsafe languages (e.g., C/C++) or unsafe features of a memory-safe language, it is advisable to employ sound and exhaustive static analysers that use formal verification techniques. These tools can ensure thorough coverage and identify memory-related bugs, enhancing the security of codebases.
“A dedicated security activity should be embedded within the SDLC, leveraging state-of-the-art tools (sound static analyser) and processes during development, testing, and maintenance phases. This aligns with the Shift Left paradigm, which advocates for early integration of security measures.
“Continuous Integration/Continuous Deployment (CI/CD) pipelines should incorporate security checks as part of automated workflows, ensuring regular and consistent assessments.
“And for high-criticality products or sensitive libraries – based on threat models – organisations should conduct third-party security assessments before product release. Depending on product criticality, such assessments could range from detailed bug reporting by sound and exhaustive static analysers to physical testing, e.g., penetration testing and security certifications by accredited security labs.”
There’s plenty of other editorial on our sister site, Electronic Specifier! Or you can always join in the conversation by commenting below or visiting our LinkedIn page.
