The Office of the National Cyber Director (ONCD) within the United States White House has recommended that developers shift away from using the C and C++ programming languages in their critical software development work. This advice stems from concerns about memory safety – a critical aspect in preventing vulnerabilities such as buffer overflow and dangling pointers.
Various serious vulnerabilities can result from improper memory management in program code. Programs written in languages such as Java, which have execution-time error detection, are considered safe in terms of memory management. Contrastingly, C and C++ allow developers to perform pointer operations and directly access system memory addresses. Such operations can allow access to any location that they can reach via a pointer but lack automatic bounds-checking. This lack means that data can be unintentionally or purposely written beyond assigned memory spaces, leading to data overwrites, data corruption, or vulnerabilities exploitable by malicious actors.
The ONCD report highlights that approximately 70% of all vulnerabilities discovered by Microsoft in 2019 and Google in 2020 were linked to breaches in memory safety. This statistic underlines the need to rethink software development practices in light of the current U.S. cybersecurity strategy.
The report not only highlights issues with C and C++, but also suggests alternatives – programming languages deemed ‘memory safe’. Safe languages recommended by the National Security Agency (NSA) include Rust, Go, C#, Java, Swift, JavaScript, and Ruby. These languages incorporate mechanisms that inhibit common memory-based attacks to enhance overall system security.
Analysing the TIOBE Index of programming language popularity, among the NSA recommended languages, C# ranks fifth in popularity, Java ranks fourth, JavaScript ranks sixth, while Go ranks eighth. These rankings indicate that some of the advised languages already enjoy widespread usage and acceptance in the developer community.
The White House Initiative extends beyond simple recommendations, incorporating a strategic plan to bolster national level cybersecurity, as reflected in President Joe Biden’s executive order from March 2023. This document sets the direction for comprehensive collaboration between the public sector, technology companies, and the public to develop and adopt secure software and hardware solutions.
The ONCD report’s conclusion urges a conscious choice of programming languages based on their memory safety capabilities. It serves not only as technical guidance for developers, but also as a strategic direction for organizations developing critical software. Transitioning to memory-safe programming languages can significantly reduce the risk of vulnerabilities, thereby enhancing the reliability and security of digital infrastructure.
