Quick Revision - Lecture 6

Software Engineer:


Computer Security vulnerabilities = poor programming practices


Errors:

  1. Insecure interaction between components

  • Improper neutralization of special elements in SQL/OS command injections AND input during Web Page generation(cross site scripting)

  • Cross site forgery

  • URL Redirection

  1. Risky resource management

  • Classic Buffer overflow

  • Path traversal

  • No integrity check for code downloads

  • Untrusted control sphere includes the functionality

  • Use of dangerous function

  • Incorrect calculation of buffer size.

  1. Defences that are porous.

  • Missing authentication

  • Missing authorization

  • Missing encryption of sensitive data

  • Incorrection authorization

  • Use of a broken or risky cryptographic algorithm.

  • Use of a one way hash

  • Improper restriction of excessive authentication attempts


Security Flaws:

  • Unvalidated input

  • Cross site scripting

  • Buffer overflow

  • Injection flaws


Reducing this would mean NIST report NISTIR 8151 which reduces the number of software vulnerabilities.