Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
2

I'm looking for a theoretical definition of Software Security. And I need to quote some book in an article.
Most of the books starts already assuming that the user knows what that is, and they're probably right.

My question is the most accepted definition of software security.

share|improve this question
and if someone with more reputation could add more tags, it would be good :) – bluefoot Jul 23 '11 at 19:51
2  
McGraw's definition sounds like a good one to me. – D.W. Jul 23 '11 at 22:12
What is software? Software may be too broad. There are many types of software: application software, web application software, operating system software, network communication software, device driver software, compiler software, etc. Is firmware software? I would start by narrowing your scope of software. – this.josh Jul 24 '11 at 6:50
The quote you have in the question, really is the best answer. I suggest to add it as an answer, and we can vote that up. – AviD♦ Jul 24 '11 at 16:34
1  
It appears to me that the theory of security involving computers has been a systems based approach from very early on. In 1970 Security Controls for Computer Systems stated 'Providing satisfactory computer controls in a computer system is in itself a system design problem.' Generally secure implementation of software is defined within a larger system concept. The idea of secure software independent of a full context appears more modern aproximatly in the last 10-12 years – this.josh Jul 28 '11 at 6:33
show 2 more comments

7 Answers

up vote 10 down vote accepted

The definition by Gary McGraw:

Software security is the idea of engineering software so that it continues to function correctly under malicious attack

share|improve this answer
3  
I think that's too narrow. Security should protect against benign "attacks" such as incompetence and accidents, for example. – Graham Lee Jul 28 '11 at 8:56
For sure. That's commented in this book. – bluefoot Aug 1 '11 at 10:18
"Functions correctly" is way too narrow. Windows 95 could have all the bugs removed and still not be secure. – Hugh Allen Aug 2 '11 at 13:18
up vote 5 down vote

To my knowledge, there is no generally accepted definition. Some papers in trusted computing define "trustworthy software" as software that works according to the expectations of the user. Rather subjective and volatile.

Maybe you should try a different approach and use the generally more accepted term security engineering as a start. Ross Anderson's book Security Engineering should contain some kind of definition and is a good reference. Then say that you define software security as the software part of security engineering (or security engineering applied to software).

share|improve this answer
you mean this one? – bluefoot Jul 24 '11 at 14:26
@bluefoot: yes. Nobody knows this other book you mention. At least I never heard of it. But everybody in security knows Anderson and this book, and he's not the kind of guy to write such a book without giving a definition. – pepe Jul 24 '11 at 17:37
your approach is very good (+1). Get software security definition as a subset of Security Engineering, defined by a good author. I'll see if it will fit in my paper. – bluefoot Jul 24 '11 at 20:27
1  
software that works as expected by user is not secure. There are multiple post in the Internet of users that "changed to Firefox after Opera started to show https site as insecure", ignoring the fact that Opera has much more strict default security settings (no http and https mixing, available OCSP, etc.) – Hubert Kario Jul 26 '11 at 18:08
1  
Sure. But note that the definition is much more generic than that. Users want functionality, security is "only" implied here. They don't care how their goals are achieved. Put another way: The app can have as many bugs as it wants, as long as they are or cannot be exploited. For whatever reason. Nobody cares about the reason. Only the goal counts, which is that "the application behaves as expected". Security incidents are not "as expected", or else they are by definition no security incidents. – pepe Jul 28 '11 at 8:42
show 3 more comments
up vote 1 down vote

According to Jason Andress apud U.S. Law, in his book The Basics of Information Security, information security is defined as:

Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction

Since information systems (software) exists to persist and manipulate information, this can fit to be a good definition of software security.

share|improve this answer
This is too broad and doesn't focus on the software part of software security. – D.W. Jul 24 '11 at 20:31
my paper is exactly about it. information systems. protect information. I don't see why a downvote here. – bluefoot Jul 24 '11 at 21:07
I see your definition as a reasonable definition of information security, but "software security" is a specific subset of "information security". – D.W. Jul 24 '11 at 22:52
and "information systems" is a specific subset of "software". – AviD♦ Jul 25 '11 at 7:08
1  
@graham you mean "Protecting software and software systems from unauthorized access, use, disclosure, disruption, modification, or destruction?" But that implies that it is the software we're protecting, not the data / availabilility/ functionality, etc – nealmcb Aug 1 '11 at 2:20
show 4 more comments
up vote 1 down vote

I'm not sure there is a good definition that you can simply "quote".

For example, what does "TCP/IP" mean? Well, it stands for "transmission control protocol / internet protocol". That's completely correct, but at the same time, completely unhelpful. If you didn't know what TCP/IP was to begin with, expanding the acronym won't help you.

A helpful definition is this: Hackers exploit certain types of bugs in software to break into computer; software security is the science of getting rid of those bugs.

For example, a common bug hackers exploit is the "buffer-overflow". They happen because reserves a certain amount of memory to hold something, but hackers provide more than the programmer expected. For example, in a database holding the username, the programmer might assume that nobody would every have a name with more than 1000 letters. That's true, they won't -- but that won't stop hackers from attempting to enter false names that long, and when they do, buffers overflow, hackers overwrite other parts of memory and take control of the system.

We know why buffer-overflows are so common. Take the C/C++ language, for example. Back in the 1970s, frequently reused code like "strcpy()" and "sprint()" were developed that copy buffers in memory without double checking the length. Therefore, hackers simply search software for uses of these code snippets and find these bugs. Software security does this before the hacker, finding all uses of "strcpy()" and removing them.

share|improve this answer
3  
I wouldn't say software security is getting rid of those bugs, rather writing a software in a way that even with bugs it is resilient to attack. – Nasko Jul 27 '11 at 18:18
up vote 1 down vote

"Security in software is the non-functional property where the primary purpose is to provide reasonable assurance to the correct provisioning of said software's function(s)."

Without qualifying the purpose of said software (Is it designed for information processing or controlling a microwave?) a definition has to, by it's very formulation, be broad.

My arguments for the above definition are roughly these:

  • Security is a non-functional property, i.e. security will generally not exist on it's own
  • The ultimate purpose of security in software is to ensure "correctness" of software during operation, failure, attack, error etc.
  • A software has a purpose (hopefully) and fulfills this purpose through a number of functions and these functions require assurance.

Edit: Sorry, only now realized I've only provided half an answer to your question; missing the part about quoting a book. I have yet to come across a definition that sufficiently captures the essence of software security.

share|improve this answer
The purpose of the software is done by implementing the business rules. Security is highly linked to "correctness" during failure, error, etc. Your definition doesn't says when, yet your arguments do. – bluefoot Aug 1 '11 at 23:54
up vote 1 down vote

I think a broader definition of the security aspect is important. E.g. security is the process of maintaining an acceptable level of risk. The risk can pertain to each aspect of the famous CIA triad: confidentiality, integrity and availability, and threats include not just malicious attack, but also incompetence and accidents, as Graham notes.

So I'd prefer something more like

Software security is the process of engineering software to function robustly in the face of malicious attack, accidents, and necessary updates and maintenance over its life cycle.

share|improve this answer
up vote 0 down vote

A lecturer in the software engineering department at Oxford said (and I have no idea whether this was a paraphrase from somewhere else or an original statement):

Securing a process or activity means acting to ensure that the things that should happen as part of that process do, and the things that shouldn't don't.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.