UP | HOME
../../

Secure Programming

Table of Contents

Abstract: In this course, we are discussing Cyber Security narrowed down to software engineering.

1 Improving Cyber Security

  1. CPU Architecture
    1. Secure Boot
    2. Executable Address Space
  2. Network Protocols
    1. Redesign of nearly all protocols
    2. Client/Server Dis-Trust
    3. Encrypted Packets
  3. OS Design
    1. Privileges, Permissions, and Policies
    2. Process Lineage/ Provenance
    3. Address Space Layout Randomization
    4. Control-Flow Integrity
    5. Detection of Races
  4. Cryptography
  5. System Administration
  6. Software Engineering
  7. Only SE considered here, all others not

2 Security Architecture Design Flaws

  1. Cryptography misuse
  2. Lack of compartmentalization
  3. More privilege used than necessary
  4. Relying on secret algorithms
  5. Sharing resources
  6. Usability problems

3 Software Without Security Holes

3.1 Bugs v Vulnerabilities v Exploit

  1. A bug is a behavioral deviation from the functional spec. Read more on this topic: ../Debugging
  2. A vulnerability is a bug that has "security implications".
    1. Can you deduce this??
    2. Know it after the fact.
  3. An exploit takes a vulnerabilty and builds software with an unexpected behavior.
  4. 2016 Fact about the State of the Art: No contests to the following claim: No single example exists that is 1000+ SLOC and is bug-free.

3.2 Past Exploits and Their Causes

  1. Unauthorized Access
  2. Denial of Service
  3. Confidential Information leakage
  4. Hijacking the Flow of Control
  5. Smashing the stack / Arbitrary Code injection
  6. Cross-site scripting on wikipedia. Recommended Reading.
  7. SQL Injection on wikipedia. Recommended Reading.

3.3 Software Security Principles

  1. (Overview of) Security Principles, 2012, https://www.cs.ucsb.edu/~kemm/courses/cs177/principles.pdf 25 slides, ./principles-ucsb-2012.pdf Required Reading.
  2. NASA Addressing SW Security, 20+ slides, 2015. Required Reading.
  3. IEEE Avoiding the Top 10 Software Security Design Flaws, https://cybersecurity.ieee.org/blog/2015/11/13/avoiding-the-top-10-security-flaws with my scribbled-in comments ./10-Flaws-2014-IEEE-pmMarked.pdf
    1. Required Reading.

4 CERT and Other Secure Coding Guidelines

  1. http://cs.stanford.edu/people/eroberts/cs181/projects/viruses/cert.html The Role of CERT
  2. https://www.securecoding.cert.org/confluence/display/seccode/SEI+CERT+Coding+Standards CMU SEI CERT Coding Standards. Required Reading – Top Level.
  3. https://www.securecoding.cert.org/confluence/display/java/SEI+CERT+Oracle+Coding+Standard+for+Java SEI CERT Oracle Coding Standard for Java
  4. Prabhaker Mateti, Audit of Android Src Code, work-in-progress (not ready for public), {pm-aosp-audit-min.pdf} located on thumb drive. Discuss a couple of CERT rules for Android.
  5. Secure Java Programming basics by PM. About 2pp. Required Reading.
  6. Secure Programming in C/ C++ basics by PM. About 1 page. Required Reading.

5 Static Analysis of Source Code

  1. Static Analysis of Source Code
    1. Data Flow Analysis
    2. Control Flow Graph
    3. Taint Analysis
    4. Lexical Analysis
    5. False Positives
    6. False Negatives
  2. Well-known "simple" Tools
    1. splint
    2. CheckStyle
    3. FindBugs
    4. PMD
    5. Ubuntu/ Debian: apt install ...
  3. Commercial Tools
  4. Advanced Tools
    1. AutoRefactor Examples
    2. Security Improvement;
    3. Misc Open Source Projects;
  5. Formal Verification Tools
    1. Spoon
    2. JTransformer
    3. Frama-C

6 References

  1. Several references embedded in the above.
  2. [Book] Chess, Brian, and Jacob West. Secure Programming with Static Analysis. Pearson Education, 2007. Reference
  3. [Book] Introduction to Computer Security, Michael Goodrich, University of California, Irvine Roberto Tamassia, Brown University, Addison Wesley, 2011. Reference
  4. McGraw, Gary, and Ming Chow. "Guest Editors' Introduction: Safeguarding the Future of Software Security." IEEE Security & Privacy, vol 7, no. 3 (2009): 11-12. PDF accessible via WSU Library proxy. Required Reading.
  5. Prabhaker Mateti, "Software without Security Holes", 2012. Required Reading.
  6. 2011 CWE/SANS Top 25 Most Dangerous Software Errors Recommended Reading.
  7. Dawson Engeler, et al., A Few Billion Lines of Code Later: Using Static Analysis to Find Bugs in the Real World, CACM, 10pp, 2010. http://courses.cs.washington.edu/courses/cse484/14au/reading/coverity.pdf. Required Reading.
  8. Cryptography misuse 95+ slides, Guevara Noubir, Northeastern University. Recommended Reading
  9. An Empirical Study of Cryptographic Misuse in Android Applications 2013 Recommended Reading.

7 End

Copyright © 2018 pmateti@wright.edu • www.wright.edu/~pmateti 2018-07-11