ABSTRACT
For computer software, our security models, policies, mechanisms, and means of assurance were primarily conceived and developed before the end of the 1970's. However, since that time, software has changed radically: it is thousands of times larger, comprises countless libraries, layers, and services, and is used for more purposes, in far more complex ways. As a consequence, it is necessary to revisit many of our core computer security concepts. For example, it is unclear how the Principle of Least Privilege can be applied to set security policy, when software is too complex for either its developers or its users to explain its intended behavior in detail.
One possibility is to take an empirical, data-driven approach to modern software, and determine its exact, concrete behavior via comprehensive, online monitoring. Such an approach can be a practical, effective basis for security--as demonstrated by its success in spam and abuse fighting--but its use to constrain software behavior raises many questions. In particular, two questions seem critical. First, is it possible to learn the details of how software *is* behaving, without intruding on the privacy of its users' Second, are those details a good foundation for deriving security policies that constrain how software *should* behave? This talk answers both these questions in the affirmative, as part of an overall approach to data-driven security. It also considers what hardware support is necessary to perform comprehensive software monitoring, with privacy, and without prohibitive overhead.
Index Terms
- Data-driven Software Security and its Hardware Support
Recommendations
Integrating security activities into the software development life cycle and the software quality assurance process
Security concerns should be an integral part of the entire planning, development, and operation of a computer application. Inadequacies in the design and operation of computer applications are very frequent source of security vulnerabilities associated ...
Building Security In: Preparing for a Software Security Career
Carnegie Mellon University's Software Engineering Institute (SEI) has developed a set of software assurance curriculum guidance documents, which provides a foundation for preparing a software security workforce. This article describes the SEI Software ...
Security Engineering Approach to Support Software Security
SERVICES '10: Proceedings of the 2010 6th World Congress on ServicesAs information security and privacy become increasingly important to organizations, the demand grows for software development processes that assure information integrity, availability, and confidentiality. Unfortunately, despite the investments made in ...
Comments