Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
178

Here's an idea for an analogy that I think is fairly accurate while generally understandable: A bank requires two forms of ID to get a loan: a driver's license and a birth certificate. Bank employees Alice and Bob are lazy in different ways: Alice always stamps "driver's license verified" without checking, while Bob always stamps "birth certificate ...


138

Of course you can start small and implement your own algorithms. But do not assume they provide any security beyond obfuscation. The difficult thing when it comes to cryptography is finding reasons why something actually is secure. You won't be able to decide that within months and if you feel like you are at that point, you are most probably wrong. It is ...


115

Here's one data point from a software company that has an interest in security. I know this is common in similar organisations. There is a number of networks. They are physically separated and airgapped, run different colour-coded network cables. Each employee has an 'administration' machine, which can connect to the Internet (via a proxy) for doing email ...


71

Yes that is a good idea to overwrite then delete/release the value. Do not assume that all you have to do is "overwrite the data" or let it fall out of scope for the GC to handle, because each language interacts with the hardware differently. When securing a variable you might need to think about: encryption (in case of memory dumps or page caching) ...


71

In my experience, it is common for developers to have admin access on their own machines. It is also common for them not to have admin access on their own machines. However, in the latter situation some accommodation is generally made so they can get their jobs done without too much friction. One very common accommodation is access to a Hypervisor on the ...


56

Actually most languages are "secure" with regard to buffer overflows. What it takes for a language to be "secure" in that respect is the conjunction of: strict types, systematic array bound checks, and automatic memory management (a "garbage collector"). See this answer for details. A few old languages are not "secure" in that sense, notably C (and C++), ...


55

The Ada language is designed to prevent common programming errors as much as possible and is used in critical systems where a system bug might have catastrophic consequences. A few examples where Ada goes beyond the typical built-in security provided by other modern languages: Integer range type allows specifying an allowed range for an integer. Any value ...


52

I would say a great way to learn is for her to break the applications she has already written. Assuming she is writing web applications, point her towards the OWASP Top 10. Have her see if she can find any of those flaws in her own code. There is no better way to learn about security concepts than actually seeing it happen on your own code. Once a flaw has ...


47

I work for a fairly large investment management firm (~6000 employees) and developers are one of the groups that we approve for local admin access. We tell them not to install any software, as that is handled by local desktop/software compliance. We also have a Developers AD Group that allows members to change the execution policy on their machines without ...


38

The situation is: people working independently without coordination, to design functionality meant to be useful locally, but when combined, created a disaster. The first historical references that come to mind: the chaos of the UK rail system where each train line owner ran their own tracks, track sizes, trains, and timetables (and sometimes, their own ...


38

Here's a perfect example: the loss of the Mars Climate Orbiter. https://www.wired.com/2010/11/1110mars-climate-observer-report/ To quote: A NASA review board found that the problem was in the software controlling the orbiter's thrusters. The software calculated the force the thrusters needed to exert in pounds of force. A separate piece of software took ...


37

Coursera Here's my 2 cents: Join the Coursera Cryptography online class: Coursera: Stanford University, Professor Dan Boneh, Cryptography I The class takes six weeks. Each week there are several lecture videos, a graded quiz and an optional programming assignment. (And these assignments involve implementing crypto parts.) At the end of the six weeks ...


36

The canonical resource for the concept of secure-by-design is "The Protection of Information in Computer Systems" by Saltzer and Schroeder. The essence is distilled into their 8 principles of secure design: Economy of mechanism Fail-safe defaults Complete mediation Open design Separation of privilege Least privilege Least common mechanism Psychological ...


34

Storing a value that isn't used again? Seems like something that would be optimized out, regardless of any benefit it might provide. Also, you may not actually overwrite the data in memory depending upon how the language itself works. For example, in a language using a garbage collector, it wouldn't be removed immediately (and this is assuming you didn't ...


31

In my career, with rather small companies (less than 100 people), we always had local admin rights. We either have real desktop machines which are maintained by IT, but got the rights, or we were allowed to have virtual machines of all sorts that we completely managed by our own. If we had not local admin access, we would try all sorts of bad "solutions" ...


30

Languages are useful for doing things. What type of things it's suitable for completely depends on the type of language, the frameworks available for it, what OSes have interpreters / compilers for it, etc. Let's look at the ones you've mentioned: Perl Scripting language General purpose Available on most *nix OSes since the '90s. Great for quick hacks and ...


29

This brings to mind the Hyatt Regency walkway collapse in 1981. TL;DR the architect stipulated one design, a manufacturer on contract substituted their own design, mechanical failure (and fatality) ensues. It is a common case study for engineering students. Source: https://en.wikipedia.org/wiki/Hyatt_Regency_walkway_collapse#Investigation EDIT to provide ...


29

In a rather small department of a larger organization (~100 in department, ~3500 in full organization) we chose an in the middle solution: sysadmins had 2 accounts, one (non administrator even for the local machine) that was used for non administative tasks (mail, document edition, etc.) and one with AD administrator priviledges that was supposed to be only ...


28

I think what op is describing best corresponds to Swiss Cheese security: https://en.wikipedia.org/wiki/Swiss_cheese_model The Swiss cheese model of accident causation illustrates that, although many layers of defense lie between hazards and accidents, there are flaws in each layer that, if aligned, can allow the accident to occur.


25

In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself: Which threat to your network is made worse by local admin rights? To which the answer shoud be: NONE - The access to resources in your network should be restricted on a per user basis, completely ...


21

Start by breaking, not building your own. There's a worrisomely large number of stackexchange posts by people who've written their own algorithms. Take a look around and figure out what's wrong with them. (Don't look at the posted answers.) [Good searches include "Is this secure" and "whats wrong with this algorithm".] Only when you've found issues in ...


20

Actually none of these languages would have prevented the bug, but they would have lessened the consequences. OpenSSL's code is doing something which, from the abstract machine point of view, is nonsensical: it reads more bytes from a buffer than there actually are in a buffer. With C, the read still "works" and returns whatever bytes lingered after the ...


20

It will be hard to teach design principles in 30 minutes. I agree with others who say that you have to get them excited in some fashion. I developed the "Elevation of Privilege" card game to get people excited about threat modeling, it might be helpful. (https://blogs.microsoft.com/cybertrust/2010/03/02/announcing-elevation-of-privilege-the-threat-...


17

If you consider the bug as reading out of bounds of the current structure, than this would probably have been prevented in other languages, because one does not have unbound access to memory and would need to implement these things differently. But I'd rather would classify this bug as missing validation of user input, e.g. it believes that the size sent in ...


17

You need a threat model You should not even begin to think about overwriting security variables until you have a threat model describing what sorts of hacks you are trying to prevent. Security always comes at a cost. In this case, the cost is the development cost of teaching developers to maintain all of this extra code to secure the data. This cost ...


16

Here is a great answer I found on a stack overflow question of similar context by @tqbf: (I copied this answer here, because I believe it gives valid reasons for which they may be prefered, so it might be useful to future readers) You probably want Ruby, because it's the native language for Metasploit, which is the de facto standard open source ...


16

I'm going to take the position that may get me flambéed... The problem I see, is that secure programming is taught as an add on. Best practices should be taught from the beginning (including security). The lie people are taught is that practice makes prefect. The truth is practice makes permanent. So if you are doing it wrong, you have to unlearn what ...


16

The problem here is that generic string comparison functions return as soon as they find a difference between the strings. If the first byte is different, they return after just looking at one byte of the two strings. If the only difference is in the last byte, they process both entire strings before returning. This speeds things up in general, which is ...


16

I will add a list with time constant functions for different languages: PHP: Discussion: https://wiki.php.net/rfc/timing_attack bool hash_equals ( string $known_string , string $user_string ) http://php.net/manual/en/function.hash-equals.php Java Discussion : http://codahale.com/a-lesson-in-timing-attacks/ public static boolean MessageDigest.isEqual(...


16

Don't. You show a lack of understanding of the topic. I don't really trust them since I can't know what their code is doing to my passwords (like maybe it's storing them on a central server?... NO!) Read the source. For instance Keepass is Open Source. You can verify how it works, and if it transmits anything. I'm not aiming for Bank-level security, ...


Only top voted, non community-wiki answers of a minimum length are eligible