For OWGV Meeting #1, 2006 June, Washington, DC, USA 1D Conveners Remarks, Meeting #1 of ISO/IEC JTC 1/SC 22/OWG:V Jim Moore Convener, ISO/IEC JTC 1/SC 22/OWG Vulnerability

For OWGV Meeting #1, 2006 June, Washington, DC, USA 2D Cyber Security is a Growing Problem -- From Joe Jarzombek, PMP, Director for Software Assurance, NCSD, DHS

For OWGV Meeting #1, 2006 June, Washington, DC, USA 3D Threat -- From Joe Jarzombek, PMP, Director for Software Assurance, NCSD, DHS The problem has implications for: Safety Privacy Security Economy Even national security

For OWGV Meeting #1, 2006 June, Washington, DC, USA 4D Government Response -- From Joe Jarzombek, PMP, Director for Software Assurance, NCSD, DHS There are initiatives underway in the US, in both Defense and Homeland Security.

For OWGV Meeting #1, 2006 June, Washington, DC, USA 5D Relationship of Software Assurance to Other Disciplines

For OWGV Meeting #1, 2006 June, Washington, DC, USA 6D Relationship of Software Assurance to Other Disciplines Some avoidable mistakes are encouraged by poor usage (arguably, poor design) of programming languages.

For OWGV Meeting #1, 2006 June, Washington, DC, USA 7D Problem Any programming language has constructs that are imperfectly defined, implementation- dependent or difficult to use correctly. As a result, software programs sometimes execute differently than intended by the writer. In some cases, these vulnerabilities can be exploited by unfriendly parties. –Can compromise safety, security and privacy. –Can be used to make additional attacks.

For OWGV Meeting #1, 2006 June, Washington, DC, USA 8D Complicating Factors The choice of programming language for a project is not solely a technical decision and is not made solely by software engineers. Some vulnerabilities cannot be mitigated by better use of the language but require mitigation by other methods, e.g. review, static analysis.

For OWGV Meeting #1, 2006 June, Washington, DC, USA 9D JTC1TC176TC65 ISOIEC SC7SC27 Quality MgmtSafety IT SecuritySoftware and Systems Engineering SC22 Programming Languages Relevant International Standards Committees

For OWGV Meeting #1, 2006 June, Washington, DC, USA 10D Officers John Hill, Chair, ISO/IEC JTC 1/SC 22 Sally Seitz (ANSI), Secretariat, SC 22 Jim Moore, Convener, SC 22/OWGV John Benito, Co-Convener, SC 22/OWGV Secretary ? Project Editor ?

For OWGV Meeting #1, 2006 June, Washington, DC, USA 11D Participation ParticipantNB DelegateWG LiaisonOther Liaison John BenitoUSWG14 (C) Ben BrosgolRT/SC Java Rod ChapmanSPARK Franco GasperoniFrance (HOD) Cesar Gonzalez-PerezSC 7/WG 19 Barry HedquistUS Kiyoshi IshihataJapan (HOD) Rex JaeschkeUS (HOD) Derek JonesUK (HOD) Stephen MichellCanada (HOD) Ed de MoelUSMDC (MUMPS) Jim MooreUS Dan NagleUS?J3 (Fortran) Erhard PloederederGermany (HOD)WG9 (Ada) Tom PlumUS?ECMA TC39/TG2 (C#) Robert SeacordCERT Barry Tauber?J4 (Cobol)

For OWGV Meeting #1, 2006 June, Washington, DC, USA 12D Progress SC 22 approves NP for project SC 22 creates OWGV; Moore is appointed as convener Moore makes information briefing to WG Benito named as co-convener of OWGV Moore makes information briefing to WG14. Benito briefs WG Disposition of comments on NP filed Benito makes information briefing to WG OWGV Meeting #1, June, Washington, DC OWGV Meeting #2, September, London, UK