11.1: Introduction to Software Security

Last updated
Save as PDF

Page ID: 91536

\( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \) \( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)\(\newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\) \( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\) \( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\) \( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\) \( \newcommand{\Span}{\mathrm{span}}\) \(\newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\) \( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\) \( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\) \( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\) \( \newcommand{\Span}{\mathrm{span}}\)\(\newcommand{\AA}{\unicode[.8,0]{x212B}}\)

A cartoon of 2 stick figures. One says, "We need to make 500 holes in that wall, so I've built this automatic drill. It uses elegant precision gears to adjust its torque and speed as needed". The other person replies, "Great, it's the perfect weight. We'll load 500 of them into the canon we've made and shoot them at the wall." — Figure \(\PageIndex{1}\): A comic from XKCD, a popular techy-nerdy comic strip. (CC-BY-NC)

Imagine this common scenario: you are in the airport, about to board your plane when you decide to take a selfie of yourself getting on the plane - boarding pass in hand and posting it to social media.

It is not unreasonable to take and post photos of that nature; in fact you probably have seen many images similar to that in the past.

The reality is that you may have announced to the world some very personal details. This exact scenario happened to Tony Abbott, a former prime minister of Australia. In this case, multiple security flaws existed which allowed anyone to see the photo to get Tony Abbott's passport number and phone number.

The Reality

Writing software is easy. Writing good software is hard. Writing secure software is extremely hard. This chapter will examine security concerns as they relate to software design, implementation and deployment.

Fortunately, organizations exist to identify, define, classify and provide documentation around security "best practices". One such organization, Open Web Application Security Project (or OWASP) exists with a particular emphasis on web applications. Although the OWASP Top 10 has an emphasis on web applications, many core concepts remain outside of the web application world. However, organizations like OWASP are vitally important as more and more software is deployed through web applications.