1. For OWGV Meeting #1, 2006 June, Washington, DC, USA 1D2-060622 Conveners Remarks, Meeting #1 of ISO/IEC JTC 1/SC 22/OWG:V Jim Moore Convener, ISO/IEC JTC 1/SC 22/OWG Vulnerability James.W.Moore@ieee.org

2. For OWGV Meeting #1, 2006 June, Washington, DC, USA 2D2-060622 Cyber Security is a Growing Problem -- From Joe Jarzombek, PMP, Director for Software Assurance, NCSD, DHS

3. For OWGV Meeting #1, 2006 June, Washington, DC, USA 3D2-060622 Threat -- From Joe Jarzombek, PMP, Director for Software Assurance, NCSD, DHS The problem has implications for: Safety Privacy Security Economy Even national security

4. For OWGV Meeting #1, 2006 June, Washington, DC, USA 4D2-060622 Government Response -- From Joe Jarzombek, PMP, Director for Software Assurance, NCSD, DHS There are initiatives underway in the US, in both Defense and Homeland Security.

5. For OWGV Meeting #1, 2006 June, Washington, DC, USA 5D2-060622 Relationship of Software Assurance to Other Disciplines

6. For OWGV Meeting #1, 2006 June, Washington, DC, USA 6D2-060622 Relationship of Software Assurance to Other Disciplines Some avoidable mistakes are encouraged by poor usage (arguably, poor design) of programming languages.

7. For OWGV Meeting #1, 2006 June, Washington, DC, USA 7D2-060622 Problem Any programming language has constructs that are imperfectly defined, implementation- dependent or difficult to use correctly. As a result, software programs sometimes execute differently than intended by the writer. In some cases, these vulnerabilities can be exploited by unfriendly parties. –Can compromise safety, security and privacy. –Can be used to make additional attacks.

8. For OWGV Meeting #1, 2006 June, Washington, DC, USA 8D2-060622 Complicating Factors The choice of programming language for a project is not solely a technical decision and is not made solely by software engineers. Some vulnerabilities cannot be mitigated by better use of the language but require mitigation by other methods, e.g. review, static analysis.

9. For OWGV Meeting #1, 2006 June, Washington, DC, USA 9D2-060622 JTC1TC176TC65 ISOIEC SC7SC27 Quality MgmtSafety IT SecuritySoftware and Systems Engineering SC22 Programming Languages Relevant International Standards Committees

10. For OWGV Meeting #1, 2006 June, Washington, DC, USA 10D2-060622 Officers John Hill, Chair, ISO/IEC JTC 1/SC 22 Sally Seitz (ANSI), Secretariat, SC 22 Jim Moore, Convener, SC 22/OWGV John Benito, Co-Convener, SC 22/OWGV Secretary ? Project Editor ?

11. For OWGV Meeting #1, 2006 June, Washington, DC, USA 11D2-060622 Participation ParticipantNB DelegateWG LiaisonOther Liaison John BenitoUSWG14 (C) Ben BrosgolRT/SC Java Rod ChapmanSPARK Franco GasperoniFrance (HOD) Cesar Gonzalez-PerezSC 7/WG 19 Barry HedquistUS Kiyoshi IshihataJapan (HOD) Rex JaeschkeUS (HOD) Derek JonesUK (HOD) Stephen MichellCanada (HOD) Ed de MoelUSMDC (MUMPS) Jim MooreUS Dan NagleUS?J3 (Fortran) Erhard PloederederGermany (HOD)WG9 (Ada) Tom PlumUS?ECMA TC39/TG2 (C#) Robert SeacordCERT Barry Tauber?J4 (Cobol)

12. For OWGV Meeting #1, 2006 June, Washington, DC, USA 12D2-060622 Progress 2005-10SC 22 approves NP for project 24772. 2005-10SC 22 creates OWGV; Moore is appointed as convener. 2005-11Moore makes information briefing to WG9. 2005-03Benito named as co-convener of OWGV. 2005-03Moore makes information briefing to WG14. Benito briefs WG21. 2005-03Disposition of comments on NP filed. 2006-06Benito makes information briefing to WG9. 2006-06OWGV Meeting #1, 26-27 June, Washington, DC 2006-09OWGV Meeting #2, 14-15 September, London, UK