Software Security; A Vulnerability Activity Revisit

Abstract

This paper attempts to introduce a method for developing secure software based on the vulnerabilities which are already known. In the proposed method, the most prevalent vulnerabilities are selected. For each vulnerability its location of appearance within the software development process, as well as methods of mitigation through design-level or implementationlevel activities is discussed. Mapping vulnerabilities to design and implementation within software development process not only results to a better understanding of vulnerability emergence, but also allows countermeasures to be applied during initial steps of vulnerability creation, and thus better software security. This mapping shows that choosing a suitable programming language and enforcing the least privileges are the most vital design time decisions. Also, security code review and server side input validation are implementation-level activities assumed to cover most of the vulnerabilities.

Significance of Security Metrics in Secure Software Development

“…Goal/Question/Metric (GQM) approach is one of the best known approaches to develop security metrics and to assess the security risks in the stages of software development process [9] [10]. …”

“…A number of security metrics have been specified and described in detail that portrays the security related issues in the development stages of the software also given in table 2 [9] [10].…”

Osdc

“…The use of prior development knowledge -such as, knowledge contained in defect data-can help the adoption of secure development process [14,11,16]. More specifically, defect data can be accumulated and analyzed systematically to reveal a concise view of the development process signature and software profile.…”

Metodología para la Detección de Vulnerabilidades en Redes de Datos

“…Además, otro trabajo (Shi et al, 2010) realizó la evaluación de diferentes herramientas de seguridad, a la vez que se compararon las habilidades de las mismas. Por otro lado, otros trabajos (Hadavi et al, 2008;Qualys, 2009;Mell et al, 2007;Huan et al, 2010;Yunhua y Pei, 2010;Harada et al, 2010;Jensen et al, 2008;Wren et al, 2010;Al-Fedaghi, 2010;Kuhn y Johnson, 2010;García y Vázquez, 2005) buscan aportar al avance de la investigación relacionada con las vulnerabilidades en seguridad informática.…”