Building Secure Software (tutorial)

Exploiting Software:How to Break CodeGary McGraw, Ph.D.CTO, Cigitalhttp://www.cigital.com© 2004 Cigital„Pop quizWhat do wireless devices, cell phones, PDAs, browsers, operating systems, servers, personal computers, public key infrastructure systems, and firewalls have in common?Software© 2004 Cigital So what’s the problem?© 2004 Cigital„„„„„„„„„Commercial security is reactiveDefend the perimeter with a firewallTo keep stuff outOver-rely on crypto“We use SSL”“Review” products when they’re doneWhy your code is badPromulgate “penetrate and patch”The “ops guy with keys” does Disallow advanced not really understand software technologiesdevelopment.Extensible systems (Java and .NET) are dangerous© 2004 Cigital „„„„„„„„„„Builders versus operatorsMost security people are Most builders are not operations people security peopleNetwork administrators Software development remains a black artFirewall rules manipulators How well are we doing teaching students to COTS products engineer code?glommersEmergent properties like These people need security are hard for trainingbuilders to grokThese people need Security means different academic educationthings to different people© 2004 Cigital „„„„„„„Making software behave is hardCan you test in quality?How do you find (adaptive) bugs in code?What about bad guys doing evil on purpose?What’s the difference between security testing and functional testing?How ...