Featured Research

from universities, journals, and other organizations

Cards On The Table: Low-cost Tool Spots Software Security Flaws During Development Process

Date:
February 24, 2009
Source:
North Carolina State University
Summary:
A new risk management tool can help software developers identify security vulnerabilities in their programs early in the planning process, effectively solving problems before they exist, simply by having the developers lay their cards on the table. The system, called "Protection Poker," is already being used in a pilot project to identify security problems.

A new risk management tool can help software developers identify security vulnerabilities in their programs early in the planning process, effectively solving problems before they exist, simply by having the developers lay their cards on the table. The system, called "Protection Poker," was developed by computer security experts at North Carolina State University and is already being used in a pilot project to identify security problems.

In Protection Poker, lead researcher Dr. Laurie Williams explains, software development managers are asked to present ideas for new software features or applications to their team of programmers. Members of the software development team are then asked to vote on two questions: how valuable is the data that the new feature will be using? And how easy will it be to attack the new feature?

The development team members use a special deck of cards to vote that allows them to rank the value and ease of attacking the new feature on a scale of 1 to 100. Everyone on the team flips over his or her cards simultaneously. Members who voted with the highest and lowest cards are asked to explain their votes. If one member of the team has ranked the vulnerability as a 40, while the rest of the team ranked it as a three, that member may know something the others don't, Williams says. This process takes advantage of the diversity of knowledge and perspective within the development team.

This process, while simple and inexpensive, is effective – particularly if it takes place during the planning stage, so that potential problems can be addressed before any coding has taken place. For example, Williams and her research team launched a Protection Poker pilot project with Red Hat IT in October 2008 – and have already identified vulnerabilities and prevented them from being included in software projects at that company.

Williams is currently in discussions with other private companies and government agencies about the possibility of launching additional pilot projects to test the Protection Poker system. Williams is an associate professor of computer science at NC State. The Protection Poker research team includes two NC State doctoral candidates in computer science: Michael Gegick and Andrew Meneely.

In addition to identifying security flaws, Protection Poker is also a valuable training tool. Having an individual explain his or her vote results in that person's security knowledge being shared with the entire software development team, Williams explains.

The Protection Poker research, "Protection Poker: Structuring Software Security Risk Assessment and Knowledge Transfer," was presented at the first-ever Engineering Secure Software and Systems (ESSoS) Conference in Leuven, Belgium, earlier this month.

Gegick and Williams have also co-authored research, with Pete Rotella of Cisco Systems, that effectively allows software developers to identify the elements of their software that are most likely to have security vulnerabilities. While the program does not identify the vulnerabilities, it does evaluate reports of non-security problems with a program (or "bugs") to determine which elements of the program should be prioritized as possibly having security flaws. This research, "Toward Non-security Failures as a Predictor of Security Faults and Failures," was also presented at the ESSoS conference.


Story Source:

The above story is based on materials provided by North Carolina State University. Note: Materials may be edited for content and length.


Cite This Page:

North Carolina State University. "Cards On The Table: Low-cost Tool Spots Software Security Flaws During Development Process." ScienceDaily. ScienceDaily, 24 February 2009. <www.sciencedaily.com/releases/2009/02/090224133010.htm>.
North Carolina State University. (2009, February 24). Cards On The Table: Low-cost Tool Spots Software Security Flaws During Development Process. ScienceDaily. Retrieved July 24, 2014 from www.sciencedaily.com/releases/2009/02/090224133010.htm
North Carolina State University. "Cards On The Table: Low-cost Tool Spots Software Security Flaws During Development Process." ScienceDaily. www.sciencedaily.com/releases/2009/02/090224133010.htm (accessed July 24, 2014).

Share This




More Computers & Math News

Thursday, July 24, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

Robot Parking Valet Creates Stress-Free Travel

Robot Parking Valet Creates Stress-Free Travel

AP (July 23, 2014) 'Ray' the robotic parking valet at Dusseldorf Airport in Germany lets travelers to avoid the hassle of finding a parking spot before heading to the check-in desk. (July 23) Video provided by AP
Powered by NewsLook.com
Six Indicted in StubHub Hacking Scheme

Six Indicted in StubHub Hacking Scheme

AP (July 23, 2014) Six people were indicted Wednesday in an international ring that took over more than 1,000 StubHub users' accounts and fraudulently bought tickets that were then resold. (July 23) Video provided by AP
Powered by NewsLook.com
The Reviews Are In For The Amazon Fire Phone

The Reviews Are In For The Amazon Fire Phone

Newsy (July 23, 2014) Amazon's first smartphone, the Fire Phone, is set to ship this week, and so far the reviews have been pretty mixed. Video provided by Newsy
Powered by NewsLook.com
Bigger Apple Phone, Bigger Orders

Bigger Apple Phone, Bigger Orders

Reuters - Business Video Online (July 22, 2014) Apple is asking suppliers to make 70 to 80 million units of its new larger screen iPhone, a lot more initially than its current model. Fred Katayama reports. Video provided by Reuters
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:
from the past week

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins