Dramatically reducing software vulnerabilities: Report to the White House Office of Science and Technology Policy

Abstract

The call for a dramatic reduction in software vulnerability is heard from multiple sources, recently from the February 2016 Federal Cybersecurity Research and Development Strategic Plan. This plan starts by describing well known risks: current systems perform increasingly vital tasks and are widely known to possess vulnerabilities. These vulnerabilities are often not easy to discover and difficult to correct. Cybersecurity has not kept pace, and the pace that is needed is rapidly accelerating. The goal of this report is to present a list of specific technical approaches that have the potential to make a dramatic difference in reducing vulnerabilities-by stopping them before they occur, by finding them before they are exploited or by reducing their impact.

Formal methods for statistical software

“…For an overview of formal methods, including suggested techniques and further reading, we refer the reader to Section 2.1 of [23].…”

Vetting the security of mobile applications

“…This document defines an app vetting process and provides guidance on (1) planning and implementing an app vetting process, (2) developing security requirements for mobile apps, (3) identifying appropriate tools for testing mobile apps and (4) determining if a mobile app is acceptable for deployment on an organization's mobile devices. An overview of techniques commonly used by software assurance professionals is provided, including methods of testing for discrete software vulnerabilities and misconfigurations related to mobile app software.…”

“…Software assurance activities for a mobile application may occur in one or more phases of the mobile application lifecycle: (1) during the development of the app by its developer (i.e., the app development phase), (2) after receiving a developed app but prior to its deployment by the enduser organization (i.e., the app acquisition phase) or (3) during deployment of the app by the enduser organization (i.e., the app deployment phase). These three phases of the mobile application lifecycle are shown in Figure 1.…”

“…Through everincreasing functionality, ubiquitous connectivity and faster access to mission-critical information, mobile apps continue to provide unprecedented support for facilitating organizational objectives. Despite their utility, these apps can pose serious security risks to an organization and its users due to vulnerabilities that may exist within their software 1 .Such vulnerabilities may be exploited to steal information, control a user's device, deplete hardware resources, or result in unexpected app or device behavior.…”

“…A vulnerability is defined as one or more weaknesses that can be accidentally triggered or intentionally exploited and result in a violation of desired system properties[1] …”