| Wiki Markup |
|---|
Software vulnerability reports and reports of software exploitations continue to grow at an alarming rate, and a significant number of these reports result in technical security alerts. To address this growing threat to the government, corporations, educational institutions, and individuals, systems must be developed that are free of software vulnerabilities. |
Coding errors cause the majority of software vulnerabilities. For example, 64 percent of the nearly 2,500 vulnerabilities in the National Vulnerability Database in 2004 were caused by programming errors \[Heffley 2004 |
.The remainder of this chapter describes misuse cases under which Java programs might be exploited, and examples of guidelines which mitigate against these attacks. Not all of the rules apply to all Java language programs; frequently their applicability depend upon how the software is deployed and your assumptions concerning trustIntro and stuff on SCALe.
The Myth of Trust
| Wiki Markup |
|---|
Software programs often contain multiple components that act as subsystems, where each component operates in one or more trusted domains. For example, one component may have access to the file system but lack access to the network, while another component has access to the network but lacks access to the file system. _Distrustful decomposition_ and _privilege separation_ \[[Dougherty 2009|AA. Bibliography#Dougherty 2009]\] are examples of secure design patterns that recommend reducing the amount of code that runs with special privileges by designing the system using mutually untrusting components. |
...
| Wiki Markup |
|---|
\[Dennis 1966\] Jack B. Dennis and Earl C. Van Horn. 1966. Programming semantics for multiprogrammed computations. Commun. ACM 9, 3 (March 1966), 143-155. DOI=10.1145/365230.365252 http://doi.acm.org/10.1145/365230.365252 |
| Wiki Markup |
|---|
\[Heffley 2004\] Heffley, J. & Meunier, P. âCan Source Code Auditing Software Identify Common Vulnerabilities and Be Used to Evaluate Software Security?â Proceedings of the 37th Annual Hawaii International Conference on System Sciences (HICSSâ04) - Track 9 - Volume 9. Island of Hawaii, January 2004. IEEE Computer Society, 2004. |
