Software Security Q: What does it mean to say that a program is secure? A: There is a sufficient amount of trust that the program maintains _____________, ____________ and _____________ A: There is a sufficient amount of trust that the program maintains _____________, ____________ and _____________ examples of software insecurity? Important Software Qualities (Software Engineering, Pfleeger) “Coding errors in commercial software account for 80% of systems penetration. This is clearly a national security issue.” 1 1 Air Force CIO John Gilligan, Information Week, March, 2002

Common Misconceptions  often the holes punched in firewalls are oversized Firewalls are sufficient  plenty of counter-evidence  what does “D” stand for? IDS will solve the problem  high false positive rates  some experts predict obsolence for IDS  this only protects the channel Just use SSL  what about replay attacks, public key cracks, etc.  typical flaws per 1000 LOC -- C: 3 Java: 1 New Programming languages are secure  many problems lie outside the control of a language

Penetrate and Patch  This approach corrects security flaws as they are discovered. Problems  Today’s state of the art  Tiger teams & penetration testing - Are the test cases sufficient? - Does a patch inject other defects? There is no technique that eliminates all security flaws. (1)functional requirements = security requirements = (2) Security depends upon dynamic external hardware/software. (3) Security exploits are a developing body of knowledge.

Typical Software Vulnerabilities Buffer Overflow - occurs whenever a data container overflows - most common source of security flaws char myArray[10]; for (i=0; i<=10; i++) myArray[i] = ‘Z’; char myArray[10]; for (i=0; i<=10; i++) myArray[i] = ‘Z’; Example Where does the overflow go?

Typical Software Vulnerabilities Incomplete Mediation - data not properly guarded against incorrect assignment - preconditions need to be enforced Example &sku=1001&qty=10&shipcost=5&total= exposure: user input, input file, packet, RPC parameters

Typical Software Vulnerabilities Race Conditions - multitasking can result in one process undesirably disturbing another - exposure: shared memory space shared file space shared network access

Design for Security  Secure the weakest link  Secure the weakest link  Practice defensive programming  Practice defensive programming  Fail securely  Fail securely  Follow the Principle of least privilege  Follow the Principle of least privilege  Modularize, encapsulate  Modularize, encapsulate  Make it simple  Make it simple  Remember privacy  Remember privacy  Attend to security at every step in the life cycle  Attend to security at every step in the life cycle

Implement for Security  Use languages with extensive error detection  Use runtime mechanisms that provide a “secure sandbox”  Don’t depend upon preconditions  Limit access to encapsulated data  Avoid language constructs with file vulnerabilities (package scope, inner classes, serializable, cloneable)  Avoid language constructs with file vulnerabilities (package scope, inner classes, serializable, cloneable)  Avoid signing your code  Don’t embed private information in code.