CSE241 Software Security Lecture Quiz

Defensive Programming

• A key aspect of a defensive programming approach is to anticipate and mitigate potential errors and vulnerabilities.

Top 25 Most Dangerous Software Errors

• CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') is ranked as one of the Top 25 Most Dangerous Software Errors.
• 10 of the CWE/SANS Top 25 Most Dangerous Software Errors are included in the OWASP Top 10.

Computer Security Vulnerabilities

• Inadequate input validation and sanitization significantly contribute to computer security vulnerabilities.

NIST Recommendations

• One of the key recommendations by NIST to reduce software vulnerabilities is to use secure coding practices.

Program Input Handling

• A common issue related to program input handling is assuming that input data is valid and correctly formatted.
• It is important to handle all error states in program development to prevent security vulnerabilities.

Input Validation

• Failure to validate input data can lead to buffer overflow vulnerabilities when maximum input size assumptions are not confirmed.
• Input fuzzing is used to test an application's robustness by providing it with invalid, unexpected, or random input data.

Input-Dependent Attacks

• An injection attack involves influencing the flow of execution of a program through input data.
• Programmers should not make assumptions about input types and environments to prevent injection attacks.

Canonicalization

• Canonicalization is used in software security to prevent different representations of the same input from being treated as distinct.

Race Conditions

• Using atomic operations helps in preventing race conditions with shared resources.

Data Assumptions

• It is crucial to ensure that data conform to assumptions to prevent security vulnerabilities.

Heartbleed Vulnerability

• The Heartbleed vulnerability allowed attackers to access sensitive information, such as encryption keys and passwords.

Log4j Vulnerability

• Updating the logging library was recommended for mitigating the Log4j vulnerability.