The purpose of software security is to ensure the confidentiality, integrity, and availability of information resources so that successful business activities may take place.
Examples of software security defects that can be introduced at any step of the software development lifecycle includes:
- Not identifying security requirements up front
- Creating conceptual designs with logic problems
- Using poor coding methods that introduce technical vulnerabilities
- Improperly deploying software
- Introducing weaknesses during maintenance or updating
Furthermore, it is critical to recognise that software vulnerabilities can affect more than just the software. A successful exploitation can result in compromises to any or all of the following, depending on the nature of the software, the vulnerability, and the supporting infrastructure:
- The software and the data that goes with it
- The computers’ operating systems
- The backend database
- Other shared-environment apps
- The user’s system
- Other software with which the user interacts
Checklist for Safe Coding
Validation of Data
Verification that all input and output data attributes match what the application expects, and that any potentially hazardous data is rendered safe using data removal, replacement, encoding, or escape. All data validation should be done on the server.
Authentication and Password Management
Many software systems include passwords as a weak point, which is why multi-factor authentication has become so popular. Despite this, passwords are the most widely used security credential, and adhering to secure coding techniques reduces risk.
Authorization and Access Management
Confirms that an authenticated entity has the privileges and permissions necessary for CRUD Operations (Create, Read, Update, Delete)
Session Management
Sessions allow state tracking and keep users from having to re-authenticate for each access.
- Each user activity will need to be uniquely tracked
- Sessions must be terminated when a user logs off or closes browser window
- Session ID and related information must be encrypted
Sensitive Information Storage or Transmission
The lack of effective data encryption negates the guarantees of secrecy, integrity, and accountability that encryption provides when correctly implemented.
System Configuration Management
System configuration management (SCM) is a set of controls that help ensure the infrastructure components supporting the software are deployed securely. It keeps the software in its current condition (called the “baseline”).
General Coding Practices
Coding standards are significant because they aid in the assurance of safety, security, and reliability. One should be used by every development team. Even the most seasoned programmer can make a coding error without realising it. And that one flaw could cause a little hiccup. Or, even worse, a significant security compromise.
Database Security
To store and retrieve information from a database, most modern web applications employ a Database Management System (DBMS). It is critical, however, to ensure that user-supplied data is not immediately inserted into database engine queries. Otherwise, the application will be subject to SQL Injection, and an attacker will be able to read, alter, or delete sensitive data belonging to other users, as well as gain unauthorised access to the entire system.
File Management
File Management consist of controls that cover the interaction between the code and other system files. The following measures and techniques:
- When uploading a file to the server, make sure you’re authenticated.
- The file headers should be checked before uploading any files to the server.
- In the directories where files are uploaded, execution privileges should be disabled.
- The client should never be given an absolute file path.
Memory Management
Because many threats are related to memory, memory management is a critical part of dealing with applications and software. To correctly manage memory, a set of controls must be implemented to address memory and buffer usage.
How Can ITM Help You?
IT Minister covers all aspects of Cyber Security including but not limited to Home cyber security managed solutions to automated manage Threat Intelligence, Forensic Investigations, Mobile Device Management, Cloud security best practice, Enterprise Network & Security Architecture, Application Security Testing and Cyber Security training. Our objective is to support organisations and consumers at every step of their cyber maturity journey. Contact Us for more information.