The importance of software in the world today cannot be overstated. Unfortunately, software is riddled with security vulnerabilities that invite exploitation. Attackers are particularly attracted to software systems that hold sensitive data with the goal of compromising the data. This paper proposes a method to identify and remove sensitive data vulnerabilities in such systems at the time they are designed, based on the observation that different vulnerabilities arise due to the location of the sensitive data and the risks to the data at those locations. The method removes vulnerabilities by adding protection for the sensitive data at its locations or by changing the locations of the sensitive data. The method performs these modifications on an easy to use graphical model of the software system, and then translates the modifications back to the actual design of the system.

, , , , , , , ,
42nd IEEE Computer Software and Applications Conference, COMPSAC 2018
Department of Systems and Computer Engineering

Yee, G.O.M. (2018). Removing Software Vulnerabilities during Design. In Proceedings - International Computer Software and Applications Conference (pp. 504–509). doi:10.1109/COMPSAC.2018.10284