Software Security

Development LyfeCycle Securily for Providing Secure Software

In order to provide secure software there are 2 main issues to address:

1. Software Quality (Security IINSIDE the software)
2. SDLC in itself (Security AROUND the software)

Security Inside Software

There are a lot of standard to use about that:

• CERN: Security Checklist for Software Developer
• SANS: SWAT
• Microsoft: DREAD
• OWASP: Application Security Verification Standard
• OWASP: Secure Coding Practice
• (ISC)2: Security Issues in SourceCode

Security Issues in Software

The most common issues are the followings:

1. Buffer OverFlow: when a (user through the) program fills up the assigned buffer of memory with more data than assigned buffer can hold
2. Covert Channel: information flow through a way that violates usual security policies
3. TOC/TOU: having to enable a functionality after checking for a condition, the Time Of Check is ugly previous to the Timoe Of Use
4. Malformed Input Attack: the data put in by user is not checked against malformation
5. Memory (Object) Reuse: reading residual information contained in a reallocated piece of memory/object
6. Trapdoor/Backdoor: hidden mechanism that bypasses access control measures (e.g. account defined in the source code)

Security Around Software

The main issue is about the SDLC model to apply:

• StackExchange: Secure SDLC to use
• Coverity: Building Security in SDLC

Usual SDLC for Software

The most common models for software development are the followings:

1. Waterfall: sequential (not iterative) design process
2. Spiral: risk-driven process focused on iterative enhancement
3. DevOps: agile methodology that rely on collaboration among developers and operatos, emphasizing responsibilization