Why is Commercial Software So Vulnerable

1
Why is Commercial Software So Vulnerable

• (and How Can We Fix It)?

2
State of Things Today

• Many vulnerabilities in commercial software
• Typical vendors release dozens of fixes annually
• No indication this is improving

3
Kinds of Vulnerabilities

• Design Flaws
• Implementation Flaws

4
Design Flaws

• Occur when software is planned and specified
  without proper consideration of security
  requirements and principles
• Examples
• Cleartext passwords
• Weak or proprietary cryptography

5
Design Flaws

• Why do Design Flaws happen?
• Rushed engineers
• Ignorance of security requirements or principles
• Fortunately, software designs are improving!

6
Design Flaws

• As Design Flaws are found, they are fixed in
  future releases
• But . . .
• These can be deeply ingrained, architectural
  issues
• Industry is moving in the right direction
• Design Flaws are a minority of the security bugs
  we see

7
Implementation Flaws

• Occur when software developers make a mistake
  when coding software
• (Just like other bugs, but some have serious
  security implications!)
• Implementation Flaws are independent of design

8
Implementation Flaws

• Examples
• Buffer overflows
• Integer over/underflows
• SQL Injection
• Format string

9
Implementation Flaws

• Why do Implementation Flaws happen?
• Human error
• We cannot eliminate human error, but we can do
  more to minimize it
• Most serious security bugs are due to these
  careless mistakes

10
How Can We Improve?

• Education
• Not every developer can be a security expert
• Every developer must understand security
  fundamentals
• At Oracle, we have had success with a web-based,
  on-demand secure coding training class

11
How Can We Improve?

• Individual accountability
• Education makes people accountable!
• Hold developers accountable for writing quality
  code.
• Automated tools
• Power of the consumer

12
The End

• Any questions?