Improving secure coding rules for automotive software by using a vulnerability database

Kurachi, Ryo; Takada, Hiroaki; Tanabe, Masato; Anzai, Jun Ichi; Takei, Kentaro; Iinuma, Takaaki; Maeda, Manabu; Matsushima, Hideki

doi:10.1109/icves.2018.8519496

Cited by 4 publications

(4 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Given the lack of knowledge on secure coding, developers tend to search online resources for answers and solutions. However, Kurachi et al [33] and Zhang et al [17] show that these solutions are not always adequate and blind usage of these solutions can lead to additional problems.…”

Section: Related Workmentioning

confidence: 99%

Raising Security Awareness Using Cybersecurity Challenges in Embedded Programming Courses

Gasiba

Hodzic

Lechner

et al. 2021

2021 International Conference on Code Quality (ICCQ)

View full text Add to dashboard Cite

Security bugs are errors in code that, when exploited, can lead to serious software vulnerabilities. These bugs could allow an attacker to take over an application and steal information. One of the ways to address this issue is by means of awareness training. The Sifu platform was developed in the industry, for the industry, with the aim to raise software developers' awareness of secure coding. This paper extends the Sifu platform with three challenges that specifically address embedded programming courses, and describes how to implement these challenges, while also evaluating the usefulness of these challenges to raise security awareness in an academic setting. Our work presents technical details on the detection mechanisms for software vulnerabilities and gives practical advice on how to implement them. The evaluation of the challenges is performed through two trial runs with a total of 16 participants. Our preliminary results show that the challenges are suitable for academia, and can even potentially be included in official teaching curricula. One major finding is an indicator of the lack of awareness of secure coding by undergraduates. Finally, we compare our results with previous work done in the industry and extract advice for practitioners.

show abstract

Section: Related Workmentioning

confidence: 99%

Raising Security Awareness Using Cybersecurity Challenges in Embedded Programming Courses

Gasiba

Hodzic

Lechner

et al. 2021

2021 International Conference on Code Quality (ICCQ)

View full text Add to dashboard Cite

show abstract

“…This work classifies such programs into the entire product life cycle and outlines their potential for optimization in the various phases of the product development process (e.g., threat and risk analyses, testing, access management). Kurachi et al [32] also highlight the benefit of a vulnerability database to extend the coverage of existing automotive coding rules by the automated migration.…”

Section: Current Practice Within the Automotive Environmentmentioning

confidence: 99%

Automotive Vulnerability Disclosure: Stakeholders, Opportunities, Challenges

Bolz

Kriesten

2021

JCP

View full text Add to dashboard Cite

Since several years, the overall awareness for the necessity to consider a vehicle as a potentially vulnerable system is facing accelerated growth. In 2015, the safety relevant exploitability of vulnerabilities through cyber attacks was exposed to a broader public for the first time. Only a few months after this attack has reached public awareness, affected manufacturer implemented one of the first bug bounty programs within the automotive field. Since then, many others followed by adapting some of ITs good practices for handling and responsibly disclose found and reported vulnerabilities for the automotive field. Nevertheless, this work points out that much remains to be done concerning quantity and quality of these measures. In order to cope with this, this present paper deals with what can be learned from IT and which conclusions can be drawn from these findings in the light of special conditions in the automotive environment. Furthermore, current handling and challenges regarding the disclosure process of vulnerabilities in the automotive sector are presented. These challenges are addressed by discussing desirable conditions for a beneficial disclosure culture as well as requirements and responsibilities of all parties involved in the disclosure process.

show abstract

“…Security experts have determined that many vulnerabilities are caused by a limited number of common software development difficulties. [15][16][17] Some common vulnerabilities affecting the code include insufficient logging and monitoring, sensitive data exposure, injection flaws, using insecure components, cross-site scripting, broken authentication, and access control, security misconfiguration, and insecure deserialization. Various BPs of SSC has also been proposed by researchers and practitioners, such as authentication and password management, cryptography, error handling and logging, communication security, data protection, and use of security standards.…”

Section: Introductionmentioning

confidence: 99%

“…The frequently exploited software vulnerabilities include defects, errors, bugs, and logic flaws. Security experts have determined that many vulnerabilities are caused by a limited number of common software development difficulties 15‐17 . Some common vulnerabilities affecting the code include insufficient logging and monitoring, sensitive data exposure, injection flaws, using insecure components, cross‐site scripting, broken authentication, and access control, security misconfiguration, and insecure deserialization.…”

Section: Introductionmentioning

confidence: 99%

Toward a readiness model for secure software coding

et al. 2022

View full text Add to dashboard Cite

The heart of the application's secure operation is its software code. If the code contains flaws, the entire program might be hacked. The issue with software vulnerabilities is that they reveal coding flaws that hackers could exploit. The prevention of cybersecurity issues begins with the program code itself. When writing software code, a software developer must consider expressing the application's architecture and design requirements, keeping the code streamlined and efficient, and ensuring the code is safe. Secure code helps save the system from various cyber-attacks by eliminating the weaknesses that many hacks rely on. To assist the software organization in Secure Software Coding (SSC), this article proposes a readiness model for SSC, namely SSCRM. The proposed model has five levels; SSC challenges and best practices (BP) are mapped at each level. The proposed model will help the organizations better understand SSC challenges and BPs and provide a roadmap for developing secure software code. The proposed model was evaluated using three case studies. The findings demonstrate that the proposed approach helps determine an organization's SSC level.

show abstract

Improving secure coding rules for automotive software by using a vulnerability database

Cited by 4 publications

References 1 publication

Raising Security Awareness Using Cybersecurity Challenges in Embedded Programming Courses

Raising Security Awareness Using Cybersecurity Challenges in Embedded Programming Courses

Automotive Vulnerability Disclosure: Stakeholders, Opportunities, Challenges

Toward a readiness model for secure software coding

Contact Info

Product

Resources

About