Engineering Secure Software Systems -
Detailed Notes
UNIT I: NEED OF SOFTWARE SECURITY AND LOW-LEVEL
ATTACKS
1. Software Assurance and Software Security
Software Assurance is the level of confidence that software is free from
vulnerabilities and functions as intended. It ensures the software’s reliability,
predictability, and resilience.
Software Security is the process of designing, developing, and testing
software to ensure it is resistant to security threats and continues to function
securely under malicious attack conditions.
Differences:
Feature Software Assurance Software Security
Focus Trustworthiness of the Protection from threats
software
Objective Reliability, quality Preventing misuse, ensuring
integrity
Techniques Process controls, defect Threat modeling, secure
prevention coding
2. Threats to Software Security
Software threats come from external and internal actors exploiting
vulnerabilities: - Malicious Code: Trojan horses, worms, viruses -
Backdoors: Hidden features for unauthorized access - Code Injection:
Malicious code executed within trusted processes - Tampering: Modification
of code, binaries, or memory - Privilege Escalation: Users gain
unauthorized access
3. Sources of Software Insecurity
Poor design or architecture
Insecure coding practices (e.g., hardcoded passwords, lack of input
validation)
Improper authentication and authorization mechanisms
Third-party components with known vulnerabilities
Incomplete or skipped security testing
Misconfigured environments
4. Benefits of Detecting Software Security Early
Reduces cost of fixing vulnerabilities
Prevents loss of data and reputation
Maintains compliance with regulatory frameworks (GDPR, HIPAA, PCI-
DSS)
Increases trust and customer satisfaction
Enhances software resilience and availability
5. Properties of Secure Software
Confidentiality: Prevent unauthorized disclosure of information
Integrity: Protect information from being altered
Availability: Ensure authorized access when needed
Authentication: Verify identity of users/processes
Authorization: Grant access based on identity and role
Accountability: Ensure actions are traceable to the originator
6. Memory-Based Attacks
Stack-Based Buffer Overflow
Occurs when more data is written to a buffer located on the stack than it can
hold, leading to control flow manipulation. - Example: gets() usage in C
without bounds checking
Heap-Based Buffer Overflow
Exploits dynamic memory allocation errors. - Example: Overwriting function
pointers stored in the heap
Integer Overflows
Arithmetic operations cause wrap-around, potentially leading to buffer
overflows or bypassing checks.
Format String Vulnerabilities
Improper use of format specifiers like %x, %s in functions like printf() leading
to memory disclosure or arbitrary code execution.
7. Defense Against Memory-Based Attacks
Stack Canaries: Special values placed between buffers and control
data
Address Space Layout Randomization (ASLR): Randomizes
memory addresses to make exploits harder
Data Execution Prevention (DEP): Marks certain memory areas as
non-executable
Control Flow Integrity (CFI): Ensures only legitimate control flow
transfers
Safe Coding Functions: strncpy() instead of strcpy(), bounds-
checked memory copies
Memory Safe Languages: Java, Rust, C#
UNIT II: SECURE SOFTWARE DESIGN
1. Requirements Engineering for Secure Software
Security must be integrated into the software requirements phase to prevent
vulnerabilities from becoming embedded in the architecture.
Key Activities:
Identify security goals and constraints
Involve stakeholders
Perform risk assessment
Specify security requirements early
2. SQUARE (Security Quality Requirements Engineering) Process
Model
A nine-step method for developing security requirements: 1. Agree on
definitions 2. Identify security goals 3. Develop artifacts 4. Perform risk
assessment 5. Select elicitation techniques 6. Elicit security requirements 7.
Categorize requirements 8. Prioritize requirements 9. Inspect requirements
3. Requirements Elicitation and Prioritization
Techniques: Interviews, brainstorming, misuse cases, threat modeling
Prioritization Methods: MoSCoW, Analytic Hierarchy Process (AHP)
Security-Specific Methods: Attack trees, STRIDE analysis
4. Isolating Untrusted Executable Content
Sandbox environments
Virtual machines or containers
Digital signatures for verification
Static and dynamic analysis of executables
5. Stack Inspection
Used in language environments (like Java) to determine whether code has
the privileges necessary to perform an operation. - Policy enforcement at
runtime - Combines call-stack traversal with permission checking
6. Policy Specification Languages
Used to define and enforce security policies. - XACML (eXtensible Access
Control Markup Language) - SPL (Security Policy Language) - Ponder:
Object-oriented language for access control
7. Vulnerability Trends
OWASP Top 10: Includes XSS, SQLi, Broken Authentication
SANS Top 25: Includes buffer overflows, use after free, hardcoded
credentials
Increased vulnerabilities in IoT, cloud, and AI/ML systems
8. Buffer Overflow, Code Injection, Session Hijacking
Buffer Overflow: Writing outside buffer boundaries, affecting
stack/heap
Code Injection: SQL, command, or script injection attacks
Session Hijacking: Attacker takes over a user’s session via stolen
cookies or tokens
9. Secure Design Principles
Least Privilege
Fail-Safe Defaults
Complete Mediation
Separation of Privileges
Open Design
Defense in Depth
Economy of Mechanism
10. Threat Modeling
STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure,
Denial of Service, Elevation of Privilege
DREAD: Damage, Reproducibility, Exploitability, Affected Users,
Discoverability
Use of Data Flow Diagrams (DFDs), Trust Boundaries, and Attack Trees
[To be continued with expanded Unit III, IV, and V…]
