Software Engineering security
Transcript: The security of software is threatened at various points throughout its life cycle, both by inadvertent and intentional choices and actions taken by “insiders”—individuals closely affiliated with the organization that is producing, deploying, operating, or maintaining the software, and thus trusted by that organization—and by “outsiders” who have no affiliation with the organization. The goal of software security engineering is to build better, defect-free software. Software-intensive systems that are constructed using more securely developed software are better able to continue operating correctly in the presence of most attacks by either resisting the exploitation of weaknesses in the software by attackers or tolerating the failures that result from such exploits The objective of secure software development is to design, implement, configure, and sustain software systems in which security is a necessary property from the beginning of the system’s life cycle to its end . Experience has taught that the most effective way to achieve secure software is for its development life cycle processes to rigorously conform to secure development, deployment, and sustainment principles and practices. Organizations that have adopted a secure software development life cycle (SDLC) process have found almost immediately upon doing so that they have begun finding many more and weaknesses in their software early enough in the SDLC that they are able to eradicate those problems at an acceptable cost. Moreover, as such secure practices become second nature over time, these same developers start to notice that they seldom introduce such vulnerabilities and weaknesses into their software in the first place. 1) Finding Vulnerabilities .. 6W4 .. REFERENCE that mean Resilient software is software that is resilient enough to: (1) either resist (i.e., protect itself against) or tolerate (i.e., continue operating dependably in spite of) most known attacks plus as many novel attacks as possible (2) recover as quickly as possible, and with as little damage as possible, from those attacks that it can neither resist nor tolerate. Trustworthiness it's when can I say the software is secure , secure software is software that is engineered “so that it continues to function correctly under malicious attack” and is able to recognize, resist, tolerate, and recover from events that intentionally threaten its dependability. Resilience Dependability The problem of non-secure software when we compared between the good goal and bad goal we find the goal is good if goals when are “SMART” that is Specific, Measurable, Attainable, Realistic, Traceable and Appropriate, and we find the goal is bad if the goals justify the means to obtain the goals Approaches To Application Security Software Engineering security (cc) photo by Franco Folini on Flickr 1)Software Security Engineering: A Guide for Project Manag Julia H. Allen,Sean Barnum,Robert J. Ellison 2)Introduction to Software Security. Karen Mercedes Goertzel, Updated 2009-01-09 https://buildsecurityin.us-cert.gov/bsi/547-BSI.html 3) http://www.slideshare.net/marco_morana/rochester-security-summit-presentation The software security threatened that mean Trustworthy software contains few if any weaknesses that can be intentionally exploited to subvert or sabotage the software’s dependability. In addition, to be considered trustworthy, the software must contain no malicious logic that causes it to behave in a malicious manner the development process by and large is not controlled to minimize the vulnerabilities that attackers exploit. vulnerable software can be invaded and modified to cause damage to previously healthy software, and infected software can replicate itself and be carried across networks to cause damage in other systems. these damaging processes may be invisible to the lay person even though experts recognize that their threat is growing. And as in cancer, both preventive actions and research are critical, the former to minimize damage today and the latter to establish a foundation of knowledge and capabilities that will assist the cyber security professionals of tomorrow reduce risk and minimize damage for the long term. 3 important properties to know software is secure or not 2) Manage Software Risks that mean Dependable software executes predictably and operates correctly under all conditions, including hostile conditions, including when the software comes under attack or runs on a malicious host The Goal of Software Security Engineering software security metrics goals (cc) photo by Metro Centric on Flickr The objective of secure software development Asma Alswayed Aljawharah alkhnini Bayan al rubaie Nora Alslamah defines secure software
Prezi Present
Prezi Video
Prezi Design
