Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

When you're coding, do you actively think about your code might be exploited in ways it wasn't originally meant to do and thus gain access to protected information, run commands or something else you wouldn't want your users to do?

share|improve this question
    
When coding what? I do a lot of different things. –  David Thornley Oct 25 '10 at 21:27
9  
Yes, often. Usually in phrases similar to "dammit, I have no time, I hope no one will find out". –  liori Nov 27 '10 at 19:17

11 Answers 11

Kindof. Disclaimer: I'm a security guy ;)

So the way I work is that I have my threat model, which describes what kind of attacks by what kind of attackers are likely. That helps to work out the security requirements. When I'm actually coding, I do the usual "safe coding" practices like being careful that cursor variables are always within bounds, tainted input is sanitised, error conditions are handled. Then I go back to my threat model to see which modules are most likely to get targeted by attackers; those get some extra review.

share|improve this answer

I use industry-standard practices, like using SQL parameters. I use "safe" platforms, like the .NET Framework, and take advantage of security features like anti-forgery tokens in ASP.NET MVC. I don't write my own encryption algorithms, but I do understand what those encryptions provide in the way of security benefits, and when I need to use them to obtain those security benefits.

In short, I use best practices, but I don't develop my own security tools. I am not a security expert in that regard; I rely on other security experts, who have presumably already thought deeply about these issues, and have a clear understanding of the risks and benefits.

My fundamental approach to security, beyond simply using security tools, is to eliminate all possible input to the system except that which I am expecting. If I have a social security number field, the only characters that should actually show up are numeric digits and dashes, in a specific pattern.

I validate user input on both the client and the server.

share|improve this answer
    
I agree with the using the inbuilt security features, but surely you have to think about when and how it is appropriate to use them. I have to say I am concerned about the relying on others to think about security for your product. They have not done that. –  Ptolemy Nov 27 '10 at 12:33
    
@Ptolemy: When it is not appropriate to parameterize a SQL statement? When is it not appropriate to use an anti-forgery token? If the data is sensitive, when is it not appropriate to use encryption? –  Robert Harvey Nov 27 '10 at 18:13
    
Lets consider the encryption for a moment. First question, what encryption do you use? using poor encryption gives a false sense of security. At some point you have to decrypt the data. At what point do you do this, what are the risks for this compared to the complexity of the code. What actual protection does the encryption actually give you? Is your dll byte code encrypted or can the encryption key be read from your DLL? thats why, just using the features with little or no understanding is dangerous. –  Ptolemy Nov 27 '10 at 19:47
    
@Ptolemy: If that's what you mean by thinking about security, then I agree, you do have to actually know these things to use these tools properly. –  Robert Harvey Nov 27 '10 at 21:38

Absolutely.

Security is everything. And with numerical software, that goes twice.
Just the other day, a user managed to find and exploit the bug in one of my old programs. The damage was unreparable. See below:

alt text

It used to be round.

share|improve this answer
7  
This needs further explanation :) –  Toby Allen Oct 25 '10 at 21:39
1  
+1 for the snicker! –  Frank Shearar Oct 26 '10 at 5:53
    
Dun dun dun dun... –  muntoo May 12 '11 at 4:35

No, because I do not work in a problem domain where security is relevant (massive data visualization SW). I do have a bunch of asserts in my code (index checking, consistency checking, etc.), not because of security concerns, but because I like wrong code to crash early and crash visibly.

share|improve this answer

Absolutely. I think about injection vulnerabilities, and also how my business logic will work in a desktop environment versus a web environment, and how security is implemented in both types of environments.

share|improve this answer

I'm no security expert, but when I'm coding web applications I always assume that user input may contain all sorts of weirdness and should always be fully escaped and suchlike. Also, I'm careful in making Ajax calls back to the server to check that the user is logged in (if they should be for that particular event) and that they have the permissions to do whatever it is they're trying to do.

The codebase has a set of filters for inputs. I never check PHP's $_GET or $_POST arrays directly. Instead, I query them through a function Request::get('parameter', 'filter') with filters such as int, text, and a few others. (And Request::post() for POST inputs, of course.)

share|improve this answer

Yes. When I worked on a multiplayer game, all were paranoid of exploits and ways to cheat. Cheating can destroy a game totally, not to mention any business models connected to selling in-game stuff. So security concerns and anti-tampering measures were very high on the agenda. I liked it very much. I have worked on others projects before where you had to feel guilty for working longer on the code just to assure it was secure.

share|improve this answer

Yes. Security is important, and shouldn't be an afterthought; adding security after the fact is generally more difficult than designing it into the application in the first place, and if you add it in later you'll probably miss some things (or just not bother adding it in at all).

share|improve this answer

Understand the general principles of security, (integrity, authentication, authority) and then read a few books about how people have been subverting these pillars of security for millennia and you will be about half way there.

Then read a few good books on design and testing strategies and you will learn how to design testability into your architecture.

Now we get to the point when I do think about security. I am thinking about how can I validate the data source, does it matter if the data is tampered with, who is the data source, how sure of that am i? how could it have been altered etc...

This affects the design. Config files may have key sections encrypted, or particular fields could be in clear text with an associated signature field. Things get more complex with internet facing services as you should expect a greater level of hostility there.

Then at testing, how do you test all this. What are your maximum data entries, what happens if you push the software beyond those limits, how does it handle it? What does it trust? how can you fake that trust?

share|improve this answer

Yes.

I've dealt with enough hackers in the past to know that they're constantly trying to compromise any big site, and there are enough bots out there that even small sites aren't safe.

I try to think like a hacker all the time now, to the point where I sometimes worry my co-workers with casual comments on how systems we take for granted every day can be gamed.

share|improve this answer

It should be something any developer builds in to the process from the ground up to a greater or lesser degree, depending on application etc. Unfortunately, as devs don't tend to quote for security, buyers don't tend to think of it (I know, this is a bit catch-22, because if the buyers want the cheapest quote, it maybe won't include security)

As a developer you can gain a definite advantage if you are skilled in this area - I'm specifically thinking about banks and financial services, but other industries are also applicable. Currently they may budget 70 - 100k in training for a new graduate to be brought up to speed on processes, security and other specifics to that organisation. If you can save them 30k of that, that's a good CV plus!

In the UK, the Institute of Information Security Professionals, and in Scotland, the Centre of Excellence in Security and Cybercrime are working closely with Universities to help review course materials, provide guest lectures on real world implications of poor coding and facilitating summer placements (eg software developers placed into fraud divisions in law enforcement.) Most of the supporting organisations are doing this for free, as it has the potential to save them a large amount of money - sounds like value to me.

(disclaimer - I have been security guy for various global organisations)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.