With the Heartbleed vulnerability on people’s minds we thought it a good time to  revisit the CWE/SANS Institute’s advice for eliminating or reducing the severity of the leading mistakes developers make when creating software. Follow these tips and your code will be more secure. For more detail click here.  All images from Shutterstock

Maintain control over all inputs 

Improper input validation is the number one killer of healthy software, so ensure input conforms to expectations. For example, an identifier that you expect to be numeric shouldn’t ever contain letters. Incorrect input validation can lead to vulnerabilities when attackers can modify their inputs in unexpected ways.

INSIDE keyboard SHUTTERSTOCK

Maintain control over all outputs

Insufficient output encoding is the often-ignored sibling to improper input validation, but it is at the root of most injection-based attacks. When your program generates outputs to other components in the form of structured messages such as queries or requests, it needs to separate control information and metadata from the actual data. If available, use structured mechanisms that automatically enforce the separation between data and code.

INSIDE slide show two better software SHUTTERSTOCK

Lock down your environment

Run your software in a restricted environment, using available security features to limit the scope of what your software can do to its host systems and adjacent networks. Even if an attacker manages to find and exploit a vulnerability, an environmental lockdown can limit what the attacker can do, reducing the overall severity of the problem and making the attacker work harder. In some cases, the lockdown may prevent the problem from becoming a vulnerability in the first place.

INSIDE slide show three better software SHUTTERSTOCK

Assume your code can be read by anyone

When it comes to security, your code operates in a hostile environment. Attackers can analyze your software – even if it’s obfuscated – and figure out what’s going on. They can modify external components to ignore security controls. They can try any type of attack against every component in the system. If your code is distributed to your consumers, even better – they can run your software and attack it in their own environment, forever, without you ever knowing about it.

INSIDE slide show four better software SHUTTERSTOCK

Use industry-accepted security features

Tricky after Heartbleed, but investigate which of the security algorithms available is the strongest for cryptography, authentication, and authorization, and use it by default. Use well-vetted, industry-standard algorithms that are currently considered to be strong by experts in the field, and select well-tested implementations. Stay away from proprietary and secret algorithms.

INSIDE slide show five cryptography key better software SHUTTERSTOCK

 

Play it safe

Use libraries and frameworks that make it easier to avoid introducing weaknesses. Solid, security-relevant libraries may save development effort and establish a well-understood level of security. If a security problem is found, the fix might be local to the library, instead of requiring wholesale changes throughout the code. With experience, you may go custom.

INSIDE slide show six better software SHUTTERSTOCK

Security end to end

Integrate security into the entire software development lifecycle.

Weaknesses and vulnerabilities can only be avoided when secure development practices are integrated into all phases of the software life cycle, including (but not limited to) requirements and specification, design and architecture, implementation, build, testing, deployment, operation, and maintenance. Create a software security group.

INSIDE slide show Seven better software SHUTTERSTOCK

There are no shortcuts

There is no single tool, technique, or process that will guarantee that your software is secure. Each approach has its own strengths and limitations. Approaches include automated static code analysis, manual static code analysis, and automated dynamic code analysis.

INSIDE slide eight better software  SHUTTERSTOCK

Sometimes access works

Allow locked-down clients to interact with your software. If a user has a locked-down client that does not support all the features used by your application, consider allowing that user some access, instead of completely denying access, which may force the user to degrade the client’s security stance. This may help protect users and slow the propagation of malware.

INSIDE slide show nine better software SHUTTERSTOC


Previous article7 signs of Internet security trouble
Next article7 steps to a security responsible firm
Howard Solomon
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@] soloreporter.com

LEAVE A REPLY

Please enter your comment!
Please enter your name here