Understanding Software Threats and Vulnerabilities

The first step in developing secure software is risk analysis, which requires an understanding of threat analysis. While other attacks addressed earlier in this book describe attacks that definitely apply, this chapter addresses the threats and vulnerabilities specific to software. Some software attacks are introduced or are explained more fully, including buffer overflow, integer/floating point overflows, SQL injection and OS command injection, directory traversal, race conditions, abusing direct object references, network sniffing or otherwise causing a breach of confidential data via lack of secure software. The chapter also reviews defenses for these attacks.