NSA Releases Guidance on How to Protect Against Software Memory Safety Issues

The National Security Agency (NSA) has released a report of what programming languages people should use because of memory safety (leaks, exploits, etc.).

The “Software Memory Safety” Cybersecurity Information Sheet highlights how malicious cyber actors can exploit poor memory management issues to access sensitive information, promulgate unauthorized code execution, and cause other negative impacts.
https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/

The report goes into some detail pointing out that older languages may be exploited.

Memory issues in software comprise a large portion of the exploitable vulnerabilities in existence. NSA advises organizations to consider making a strategic shift from programming languages that provide little or no inherent memory protection, such as C/C++, to a memory safe language when possible. Some examples of memory safe languages are C#, Go, Java, Ruby™, and Swift®. Memory safe languages provide differing degrees of memory usage protections, so available code hardening defenses, such as compiler options, tool analysis, and operating system configurations, should be used for their protections as well. By using memory safe languages and available code hardening defenses, many memory vulnerabilities can be prevented, mitigated, or made very difficult for cyber actors to exploit.
https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI_SOFTWARE_MEMORY_SAFETY.PDF

The Memory Safety (Internet Security Research Group) has a list of languages that are memory safe.

Memory safe languages include Rust, Go, C#, Java, Swift, Python, and JavaScript.
https://www.memorysafety.org/docs/memory-safety/

This means that we should learn and use the following languages.

  1. C# (Microsoft)
  2. Go (Google)
  3. Java (Oracle)
  4. JavaScript (Oracle)
  5. Python (Python Software Foundation)
  6. Ruby (Yukihiro Matsumoto)
  7. Rust (Rust Foundation)
  8. Swift (Apple)

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.