434

I am an IT student and I am now in the 3rd year in university. Until now we've been studing a lot of subjects related to computers in general (programming, algorithms, computer architecture, maths, etc).

I am very sure that nobody can learn every thing about security but sure there is a "minimum" knowledge every programmer or IT student should know about it and my question is what is this minimum knowledge?

Can you suggest some e-books or courses or anything can help to start with this road?

6
  • 6
    Quite similar to stackoverflow.com/questions/325862/…
    – Thomas
    Commented May 8, 2010 at 12:21
  • 120
    Rule #1: Never trust user's input. Not even if it's your Grandmother Commented May 8, 2010 at 12:24
  • 2
    ..and this thread also has the great information - stackoverflow.com/questions/72394/… Commented May 8, 2010 at 12:28
  • my question isn't only about programmers and their mistakes,also about IT and computer science students Commented May 8, 2010 at 12:28
  • 1
    Watch your error messages. While you want to be user friendly, the difference between "This account does not exist" and "The password is invalid" can be dangerous in some cases. Commented May 8, 2012 at 2:26

17 Answers 17

563

Principles to keep in mind if you want your applications to be secure:

  • Never trust any input!
  • Validate input from all untrusted sources - use whitelists not blacklists
  • Plan for security from the start - it's not something you can bolt on at the end
  • Keep it simple - complexity increases the likelihood of security holes
  • Keep your attack surface to a minimum
  • Make sure you fail securely
  • Use defence in depth
  • Adhere to the principle of least privilege
  • Use threat modelling
  • Compartmentalize - so your system is not all or nothing
  • Hiding secrets is hard - and secrets hidden in code won't stay secret for long
  • Don't write your own crypto
  • Using crypto doesn't mean you're secure (attackers will look for a weaker link)
  • Be aware of buffer overflows and how to protect against them

There are some excellent books and articles online about making your applications secure:

Train your developers on application security best pratices

Codebashing (paid)

Security Innovation(paid)

Security Compass (paid)

OWASP WebGoat (free)

5
  • +1 "exploiting software: how to break code" is a great book, however that slide show you linked to is horrible.
    – rook
    Commented May 8, 2010 at 17:46
  • 8
    However, unfortunately it's almost impossible to instantiate the principle of least privilege in any modern system. For example, the Linux kernel (source I'm currently using) contains over 9.4 million lines of C code and over 400K lines of assembly, all of which run in an unrestricted context. A simple miscalculation (perhaps intentional) in one of these millions of lines will compromise the entire system. Perhaps in the next century or two a solution will emerge, perhaps not, as nobody actually cares about creating secure OS/languages/frameworks. Commented Aug 29, 2010 at 18:13
  • 1
    I'd add "The Web Application Hacker's Handbook" to that list.
    – outcassed
    Commented May 7, 2012 at 17:07
  • 39
    Replace "Never trust user input!" to "Never trust any input!". Inputs coming from other software should be treated the same as user input - for example, in website logging most people wouldn't think of User-Agent / browser ID field as 'user input' but it can just as easily contain, say, a SQL injection.
    – Peteris
    Commented May 7, 2012 at 17:49
  • 3
    @L̲̳o̲̳̳n̲̳̳g̲̳̳p̲̳o̲̳̳k̲̳̳e̲̳̳ Well, there is that Microsoft Research experimental OS (Singularity) built on .NET, which targeted safety as a primary goal (no buffer overflows, yay!). No process memory sharing, no code self-modification, even the device drivers are just another software isolated process in .NET. Quite an interesting concept, but it would be very hard to push this to people (most importantly, it pretty much can't do backwards compatibility with existing software or even drivers; a bit like the first 10 years of Linux :D ).
    – Luaan
    Commented Apr 14, 2014 at 7:37
104

Rule #1 of security for programmers: Don't roll your own

Unless you are yourself a security expert and/or cryptographer, always use a well-designed, well-tested, and mature security platform, framework, or library to do the work for you. These things have spent years being thought out, patched, updated, and examined by experts and hackers alike. You want to gain those advantages, not dismiss them by trying to reinvent the wheel.

Now, that's not to say you don't need to learn anything about security. You certainly need to know enough to understand what you're doing and make sure you're using the tools correctly. However, if you ever find yourself about to start writing your own cryptography algorithm, authentication system, input sanitizer, etc, stop, take a step back, and remember rule #1.

5
  • 10
    This is a bad rule in my opinion. You can essentially be targeted just because of the platform you select, rather than any real interest in your assets. Think about all of the security holes that are found in 3rd party platforms, and all of the products that are instantly vulnerable just because they use it. I wouldn't be so quick to trust my security to a 3rd party.
    – Fosco
    Commented May 7, 2012 at 19:59
  • 9
    I think this is a good rule for Crypto - rolling your own encryption is a recipe for disaster. But rolling your own blog engine might be more secure as Fosco points out - if you roll your own you are less likely to be caught by automated attacks that wordpress installs have to deal with. Commented May 8, 2012 at 1:40
  • 5
    When it comes to crypto, this rule is absolutely correct. Don't write your own crypto, period. When it comes to using 3rd party platforms, it depends. Some platforms are inherently more secure, some platforms are inherently less secure, and most platforms probably provide some security features but also some known attack vectors. Take the recent Rails vulnerability that caused a security hole at github. Undoubtedly Rails provides many many security features, but it also has some powerful features with insecure defaults. Commented May 8, 2012 at 2:14
  • 7
    When it comes to crypto, don't roll your own – but do understand the thing you are using. If you don't understand why using the same encryption key for RC4 for two messages is a horrible idea, read up before using any stream cipher, for example. Commented May 8, 2012 at 11:34
  • 3
    Even after the HeartBleed bug it is apparent this is a good rule. Imagine how hard it would have been to a find a heatbleed-like bug in a custom or proprietary project. If you roll your own, you are just hiding behind obscurity and won't know what bugs could be being exploited.
    – Sqeaky
    Commented May 14, 2014 at 20:32
72

Every programmer should know how to write exploit code.

Without knowing how systems are exploited you are accidentally stopping vulnerabilities. Knowing how to patch code is absolutely meaningless unless you know how to test your patches. Security isn't just a bunch of thought experiments, you must be scientific and test your experiments.

7
  • 11
    I'd argue this is not necessary at all. Just adhere to the principle: if the attacker can cause a memory corruption of any kind, consider yourself owned. No need to get into the details of actually writing (working) exploits.
    – newgre
    Commented Mar 26, 2012 at 19:30
  • 6
    @newgre not every vulnerability is a buffer overflow. There are a few thousand vulnerabilities covered by the Common Weakness Enumeration system. A programmer needs to understand the mind of the attacker or he will unknowing make mistakes.
    – rook
    Commented Mar 26, 2012 at 19:41
  • 1
    I know that not every one of them is a buffer overflow, but anything that is usually referred to as an "exploit" is based on some kind of memory corruption: buffer overflows, double-frees, heap overflows, integer related overflows, format strings, etc. Of course there are other things such as logic bugs, but that wasn't the topic of this answer to begin with.
    – newgre
    Commented Mar 26, 2012 at 19:44
  • 5
    @newgre That is one type of exploit, but today more exploits are written to leverage web application flaws than memory corruption issues. Exploits are written leveraging SQL Injection, Local File include, CSRF, and XSS, these are the common problems. (Source: exploit-db.com)
    – rook
    Commented Mar 26, 2012 at 19:58
  • 1
    I agree to it, if you yourself can write exploits, you can understand as to what can go to a hackers mind at the max!
    – linuxeasy
    Commented Mar 29, 2012 at 7:42
43

Security is a process, not a product.

Many seem to forget about this obvious matter of fact.

23

I suggest reviewing CWE/SANS TOP 25 Most Dangerous Programming Errors. It was updated for 2010 with the promise of regular updates in the future. The 2009 revision is available as well.

From http://cwe.mitre.org/top25/index.html

The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors is a list of the most widespread and critical programming errors that can lead to serious software vulnerabilities. They are often easy to find, and easy to exploit. They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all.

The Top 25 list is a tool for education and awareness to help programmers to prevent the kinds of vulnerabilities that plague the software industry, by identifying and avoiding all-too-common mistakes that occur before software is even shipped. Software customers can use the same list to help them to ask for more secure software. Researchers in software security can use the Top 25 to focus on a narrow but important subset of all known security weaknesses. Finally, software managers and CIOs can use the Top 25 list as a measuring stick of progress in their efforts to secure their software.

1
  • 1
    Note that the top 4 errors on that list (and a bunch of the others as well) are all the same error -- trusting input.
    – Chris Dodd
    Commented Apr 29, 2013 at 21:28
14

A good starter course might be the MIT course in Computer Networks and Security. One thing that I would suggest is to not forget about privacy. Privacy, in some senses, is really foundational to security and isn't often covered in technical courses on security. You might find some material on privacy in this course on Ethics and the Law as it relates to the internet.

2
  • The MIT course link doesn't work
    – AntonioCS
    Commented Mar 26, 2012 at 12:26
  • 1
    Links fixed (for now). Thanks.
    – tvanfosson
    Commented Mar 26, 2012 at 12:31
10

The Web Security team at Mozilla put together a great guide, which we abide by in the development of our sites and services.

8

The importance of secure defaults in frameworks and APIs:

  • Lots of early web frameworks didn't escape html by default in templates and had XSS problems because of this
  • Lots of early web frameworks made it easier to concatenate SQL than to create parameterized queries leading to lots of SQL injection bugs.
  • Some versions of Erlang (R13B, maybe others) don't verify ssl peer certificates by default and there are probably lots of erlang code that is susceptible to SSL MITM attacks
  • Java's XSLT transformer by default allows execution of arbitrary java code. There has been many serious security bugs created by this.
  • Java's XML parsing APIs by default allow the parsed document to read arbitrary files on the filesystem. More fun :)
5

You should know about the three A's. Authentication, Authorization, Audit. Classical mistake is to authenticate a user, while not checking if user is authorized to perform some action, so a user may look at other users private photos, the mistake Diaspora did. Many, many more people forget about Audit, you need, in a secure system, to be able to tell who did what and when.

1
  • 1
    Not all authorization requires authentication. "From ABAC to ZBAC" contrasts NBAC (authentication based) access control with solutions that do not require authentication. "IBAC, RBAC, ABAC and even CBAC – Claims Based Access Control all rely on authentication ... For simplicity this paper treats them as single solution and ignores those versions that have implemented aspects of the ZBAC architecture. They are collectively referred to as autheNtication Based Access Control (NBAC)." Commented May 8, 2012 at 9:09
4
  • Remember that you (the programmer) has to secure all parts, but the attacker only has to succeed in finding one kink in your armour.
  • Security is an example of "unknown unknowns". Sometimes you won't know what the possible security flaws are (until afterwards).
  • The difference between a bug and a security hole depends on the intelligence of the attacker.
4

I would add the following:

  • How digital signatures and digital certificates work
  • What's sandboxing

Understand how different attack vectors work:

  • Buffer overflows/underflows/etc on native code
  • Social engineerring
  • DNS spoofing
  • Man-in-the middle
  • CSRF/XSS et al
  • SQL injection
  • Crypto attacks (ex: exploiting weak crypto algorithms such as DES)
  • Program/Framework errors (ex: github's latest security flaw)

You can easily google for all of this. This will give you a good foundation. If you want to see web app vulnerabilities, there's a project called google gruyere that shows you how to exploit a working web app.

4

when you are building any enterprise or any of your own software,you should just think like a hacker.as we know hackers are also not expert in all the things,but when they find any vulnerability they start digging into it by gathering information about all the things and finally attack on our software.so for preventing such attacks we should follow some well known rules like:

  • always try to break your codes(use cheatsheets & google the things for more informations).
  • be updated for security flaws in your programming field.
  • and as mentioned above never trust in any type of user or automated inputs.
  • use opensource applications(their most security flaws are known and solved).

you can find more security resource on the following links:

for more information google about your application vendor security flows.

3
  1. Why is is important.
  2. It is all about trade-offs.
  3. Cryptography is largely a distraction from security.
3

Salt and hash your users' passwords. Never save them in plaintext in your database.

3

For general information on security, I highly recommend reading Bruce Schneier. He's got a website, his crypto-gram newsletter, several books, and has done lots of interviews.

I would also get familiar with social engineering (and Kevin Mitnick).

For a good (and pretty entertaining) book on how security plays out in the real world, I would recommend the excellent (although a bit dated) 'The Cuckoo's Egg' by Cliff Stoll.

3

Also be sure to check out the OWASP Top 10 List for a categorization of all the main attack vectors/vulnerabilities.

These things are fascinating to read about. Learning to think like an attacker will train you of what to think about as you're writing your own code.

1

Just wanted to share this for web developers:

security-guide-for-developers
https://github.com/FallibleInc/security-guide-for-developers

Not the answer you're looking for? Browse other questions tagged or ask your own question.