Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
10 Common Software Security Design Flaws
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
anon9106759839
anon9106759839,
 User Rank: Apprentice
8/27/2014 | 6:51:54 PM
Nah
Big names, but little value can come from this conversation.

Application security problems stem from attacks. MITRE CAPEC describes the underlying model for attacks, while PTES, OSSTMMv4, and OWASP guides such as the Testing Guide and ASVS 2.0 standards cover the open methods.

There are also models (CWE) and methods (OWASP Dev Guide, SAFEcode, Microsoft SDL, etc) for building secure software, but this is where security and appdev activities are split.

On Twitter, someone important today said, "a design flaw is a property of the design that allows an attacker to violate one of your security objectives".
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
8/28/2014 | 8:16:02 AM
Re: Nah> "little value can come from this conversation"
@anon9106759839 -- Are you saying that there is no significant relationship between security and appdev? Or that the conversation will not lead to a viable solution. 
Stratustician
Stratustician,
 User Rank: Moderator
8/28/2014 | 9:25:10 AM
Re: Nah> "little value can come from this conversation"
I think there is definitely some value with really reminding folks that security is closely tied to application development.  While yes, many flaws will come up as part of a security attack, if you have strong code at the onset, especially if groups like these industry folks are able to start to identify "here are where we are seeing code vulnerabilities", it will hopefully lead to better code overall for these applications and reduce the risks.  You can't eliminate every potential threat, but at least you've narrowed the attack field by closing known vulnerabilities.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
8/28/2014 | 9:34:21 AM
Re: Nah> "little value can come from this conversation"
Well said,  @Stratustician. Narrowing down the field of code vulnerabiliies is definitely a valuable endeavor. 
Robert McDougal
Robert McDougal,
 User Rank: Ninja
8/28/2014 | 11:18:44 AM
Re: Nah
I must disagree with your assessment wholeheartedly. I can tell you from direct experience that secure coding practices are not taught in our colleges currently. What that leads to is developers who don't understand the importance of using stored procedures and prepared statements. This in turn leads to applications which have easily preventable vulnerabilities.


Secure coding will not fix all vulnerabilities but if done correctly it will prevent known vulnerabilities such as SQL injection or XSS from making its way into future applications.
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
8/28/2014 | 11:35:27 AM
Re: Nah
Good point about the Mitre, OWASP and other models. What I thought was particularly interseting with the IEEE report was that the recommendations come from real-world design flaws the participants themselves experienced -- Twitter, Google, etc. 
GonzSTL
GonzSTL,
 User Rank: Ninja
8/28/2014 | 2:22:29 PM
Secure Software Design
I received my CompSci degree quite a while back, and even then, the practice of input validation and communication comparmentalization was stressed in all my programming classes. My involvement in IT throughout the years encompasses software development, network architecture, server infrastructure, storage architecture, desktop standardization, virtualization, etc., so I can pretty much see things from a broad picture as well as from individual areas. In all those IT domains, the vast majority of exploits come from software design security flaws, and secondly, improper configurations.

What I believe is that there is tremendous pressure to deliver applications and technology, and sometimes that leads to shortcuts or bypassing certain aspects of development. If security considerations are part of the whole development process, and rigidly enforced from inception to delivery, then perhaps we would see a dramatic drop in exploitable software flaws. The question is, why are the shortcuts and bypasses allowed, and who allows them? Improper oversight seems to be the culprit, either due to lacck of knowledge or understanding, or faulty risk management in the development process. Simply stated, security considerations should be enforced from beginning to end.
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
8/28/2014 | 3:51:35 PM
Re: Secure Software Design
Great perspective, @GonzSTL. The go-to-market/release pressures are the biggest issue with much of app development, for sure. But you raise another good point about a lack of oversight and enforcement of good secure coding practices.
macker490
macker490,
 User Rank: Ninja
8/29/2014 | 8:10:20 AM
cart and horse
remember: the O/S must protect the apps rather than the reverse.  you are always going to have a bad app someplace and if that can get an un-authorized update into the o/s you're toast.

you must start with a secure o/s and then proceed with the authentication of inputs particularly software but also data particularly anything financial or sensitive in nature.
DarkReadingTim
DarkReadingTim,
 User Rank: Strategist
8/29/2014 | 9:32:37 AM
Re: Secure Software Design
Great to see our old friend Neil Daswani in Dark Reading again! One of the things that strikes me each year when OWASP posts its Top 10 Vulnerabilities list is how many of the vulnerabilities are old. I mean, *really* old like SQL injection and buffer overflow. I wonder, why do these well-known vulns continue to occur with such great frequency, and isn't there something that could be done at the development level to prevent them?
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.