if I have a developer who wants to install a new software and he ask me to check this software security before installing it what shall I do

  • 2
    You might be asking one (or more) of many different questions here. I'll try and briefly answer as many as I can below, but you will get better answers if you edit the question to clarify what you need. – Graham Hill Mar 28 '12 at 10:48

You could be asking one of many questions here.

  • If you are asking "How do I know that the software I have here is what the vendor made - could it have been altered before I got it?" then you will want to compare the hash of what you have to what the vendor has published, assuming they have. (Almost everyone does nowadays.)

  • If you are asking "How can I tell if the vendor has put malware or back doors into this software?" then the key thing to consider is how much you trust the vendor. (Although that's not a guarantee. Big companies have accidentally gotten a virus on their gold masters before now, and the bigger you are, the more likely a government is to lean on you to put a back door in.) Of course you've scanned it with a couple of AV scanners, like you do with anything you put on your network. Talk to other users and see if they have any issues. If it's open source, you can read the source before compiling, although that is a huge amount of work. Lastly, you can run it in a sandbox for a while, monitoring what it does, especially it's network activity to see if it phones home.

  • If you are asking "How can I tell if it has programming mistakes that make it vulnerable to attack?" then again there are various approaches. As before, consider the reputation of the vendor; talk to other users; and if it's open source and you have the resources, review the source. Check it's bug tracking system if this is public, and it's historical release notes, to see how well security issues are addressed. Think about what it does and what threats you face, and identify other security controls you can put around it.

| improve this answer | |
  • that is what I was looking for, after 3 years I have learnt most of things you mentioned here, Thank You sir – P3nT3ster Oct 15 '15 at 4:58

(Liked the Graham Hill approach to answer):

One more question/answer you could think about:

  • If you are asking "What I want to protect if the software isn't trustworthy?" then you might consider that you could install the software in a virtual machine that doesn't have connection with your network, so that a vulnerability wouldn't be able to get data from other computers, for example. And even if the user puts some "secret" data in the program, it won't be able to send it out.
| improve this answer | |
  • 1
    trustfull --> trustworthy? – Legolas Mar 28 '12 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.