Chapter 10: Software Development Security - Mobile Code

Mobile code is code that can be send to another location across a network and then be executed and used on the other side. In Java, Java applets are used to accomplish this. The programmer creates the applet, runs the program through a compiler and is turned into bytecode (this code is not platform specific; it can run on many platforms. This bytecode is then placed on a server available for users to download it. Once a user downloads it, the universal bytecode is then transformed into machine-level code that is specific to the type of system it was downloaded to. To accomplish this code conversion, a Java Virtual Machine is used. Usually this virtual machine is running within the users web browser. The applet is then able to be ran when it is called upson, but it is ran in what is known as a sandbox. A sandbox is an area in where potentially unsafe code from another area can be ran in a secure manner.

Chapter 10: Software Development Security - Programming Languages and Concepts

At the very lowest level, the language that a computer can read is known as binary. "Bi" meaning two, as binary is only a combination of 1's and 0's. This is also known as machine code. There were no "programming" languages in the early 1950's, so this is how programmers wrote instructions for computers. Later, assembly language came along. Assembly language is only one step above machine language. Instead of all 1's and 0's, it uses symbols to represent many 1's and 0's. Assemblers were used to convert these symbols into machine readable code. Later on in the early 60's, high level languages started to emerge. Syntax became closer to human language and introduced abstract statements. Many statements could now be reduced to single line and provide the same functionality. Later, even more abstraction became involved in fourth-generation languages. Things that used to be constructed with a ton of code could now be accomplished with one-tenth of that. Programmers do not have to know how a computer works, how memory is handled, etc. when using very high level languages. The 1990's saw the emergence of what is known as natural languages, where the main goal is that the software can solve problems by itself instead of having an algorithm based method to complete tasks. Object-Oriented programming is widely used in today's world. Objects can be instantiated, communicate with each other, and inherit behavior and attributes from parent classes. This leads to code reuse and a lot less coding for developers. Instead of code being executed in a sequential manner, execution can bounce around from class to class.

Chapter 10: Software Development Security - Capability Maturity Model Integration

CMMI is a set of guideline for developing software products. There are 5 levels and each level builds off of the ones prior to it. In other words, you cannot progress to a level if you have not met the requirements for a previous level. The idea behind this was to have a standard to make software development more organized.

http://en.wikipedia.org/wiki/Capability_Maturity_Model_Integration

Chapter 10: Software Development Security - Software Development Models

Break and Fix - Planning is not really used here. Produce working software and deal with issues as they arise.

Waterfall - Plan everything up front before a single line of code is written. Not very flexible and does not account for changes in requirements.

V-Model - Testing is used during each phase of the project, not at the very end.

Prototyping - Models of code or application are created up front before actual work takes place to develop the software.

Incremental -Many development cycles are used and each cycle produces working software. Improvements are made during each cycle.

Spiral - Iterative model that encourages client involvement. Customer feedback is important throughout these types of projects.

Rapid Application Development - A combination of prototyping and incremental. Goal is to make the process quicker.

Agile - Encourages teamwork. Anticipates that new requirements and modifications will arise throughout the project.

Chapter 10: Software Development Security - Secure Software Development Best Practices

There are many resources available to software developers that will help them make their software more secure. Most of these are available for free. Here are four that the book lists:

Web Application Security Consortium - Best practices and security standards for web application development on the world wide web
www.webappsec.org/

Open Web Application Security Project - An organization that operates from a non-profit standpoint that aides in security of software application
https://www.owasp.org/

Build Security In - Provides various resources to aid in building secure software in every phase of its development.
https://buildsecurityin.us-cert.gov/

ISO/IEC 27034 - International standard of security for all classes of applications.
http://www.iso27001security.com/html/27034.html

Chapter 10: Software Development Security - Software Development Life Cycle

Since I am already fairly familiar with the Software Development Life Cycle and it would be kind of pointless to simply explain what each phase is, I want to list things from the book that I had zero previous knowledge of in each phase of the SDLC.

Gather Requirements: A privacy Impact Rating is the classification of the data in which the software will use. There are three classifications - P1, P2, and P3 where P3 is the lowest privacy risk and P1 is the highest.

Design: During this phase, at least from a security standpoint, two things should occur. The first is that an attack surface analysis should be performed. This will show you how much code and software functionality is available to users that are untrustworthy. The second thing that should occur is to create a realistic threat model. A threat model is a visualization of how threats could affect your software and how this threat might occur.

Development: Computer aided software engineering is the use of computers to aid in development. From my understanding, an Integrated Development Environment (IDE) is a form of computer aided software engineering because you are using software to help you develop or enhance new software.

Testing/Validation: Unit Testing - A look at each piece of a program. Data structures, logic, methods,                                                         and boundaries.
                                Integration Testing - Make sure all parts work together as designed.
                                Acceptance Testing - Making sure requirements are met.
                                Regression Testing - When a change is made, make sure it nothing else is                                                                                affected.

Release/Maintenance: Verification - product meets the specs.
                                     Validation - real world solution is achieved.

Chapter 10: Software Development Security - Intro

I want to begin my blog on this chapter by saying that I am very excited about broadening my knowledge of this area of security. I find software development very interesting, and I hope to one day become a software developer. To begin this chapter, I want to talk about the main reasons why insecurities within actual software exists, why this is concerning, and why software needs to be built in a secure manner, especially in today's world. In the past, security was not really an issue when it came to software development. There were not as many malicious attacks, and the technology was no where near as advanced as it is now. This is a problem because a lot of this "old" software is still in use. Another reason why insecurities exist is because the people that are in charge of keeping things secure often do not have a development background. To add to this, many developers to not view security as the most important element in software. At the end of the day, they are more concerned about what the software's functionality. If a company is trying to get to get their product to market and make money, do you think they always take all the necessary steps in order to be sure the product is as secure as possible? The short answer is, absolutely not. It has become a sort of standard for software to have flaws when it comes to the user, with fixes coming at a later date. Last, customers cannot control the software they buy. This is why perimeter protection of software is so important. As an everyday user, you really never know how secure the software is that you are running...until something bad happens. While perimeter protection is great and highly necessary, in my opinion, security should be just as important as functionality for the modern day developer. We are so reliant on computers these days, it would be absurd to let security fall behind functionality. Think of it this way. Would you want to live in a house where it was not possible to lock your doors? Heck no! That would be a security threat. The same applies for software. You don't want to purchase or use something that was not made with security in mind.