Software Engineering Institute | Carnegie Mellon University
Software Engineering Institute | Carnegie Mellon University
SEI Podcast Series
02/19/2016

Is Java More Secure Than C?

David Svoboda

Summary

Whether Java is more secure than C is a simple question to ask, but a hard question to answer well. When researchers on the CERT Secure Coding Team began writing the SEI CERT Oracle Coding Standard for Java, they thought that Java would require fewer secure coding rules than the SEI CERT C Coding Standard because Java was designed with security in mind. They also assumed that a more secure language would need fewer rules than a less secure one. However, Java has 168 coding rules compared to just 116 for C. Why? Are there problems with our C or Java rules, or are Java programs, on average, just as susceptible to vulnerabilities as C programs? In this podcast, CERT researcher David Svoboda analyzes secure coding rules for both C and Java to determine if they indeed refute the conventional wisdom that Java is more secure than C.

Watch

Listen

Player Not Available. Download Podcast.

Downloads

MP3
Transcript

Share

Categories: Secure Coding

About the Speaker

David Svoboda

David Svoboda is a software security engineer in the SEI’s CERT Division. He co-authored and contributed to four books, including the CERT C Coding Standard and the CERT Oracle Secure Coding Standard for Java. David has over 25 years of job and development experience, starting with Java 2, and his Java projects include Tomcat Servlets and Eclipse plug-ins. He also maintains the SEI CERT coding standard wikis, and he has taught secure coding in C, C++, and Java all over the world to various groups in the military, government, and banking industries.

He is also involved in several ISO standards groups, including one for standardizing C and one for standardizing C++. He has been the primary developer on a diverse set of software development products at Carnegie Mellon University since 1991. His projects have ranged from hierarchical chip modeling and social organization simulation to automated machine translation (AMT). His KANTOO AMT software, developed in 1996, is still in production use at Caterpillar Industries.