Login | Register

Towards systematic software security hardening


Towards systematic software security hardening

Laverdière-Papineau, Marc-André (2007) Towards systematic software security hardening. Masters thesis, Concordia University.

[thumbnail of MR34444.pdf]
Text (application/pdf)
MR34444.pdf - Accepted Version


In this thesis, we report our research on systematic security hardening. We see how the software development industry is currently relying on highly-qualified security experts in order to manually improve existing software, which is a costly and error-prone approach. In response to this situation, we propose an approach that enables systematic security hardening by non-experts. We first study the existing methods used to remedy software vulnerabilities and use this information to determine a classification and definition for security hardening. We then see how the state of the art in secure coding, patterns and aspect-oriented programming (AOP) can be leveraged to enable systematic software security improvements, independently from the users' security expertise. We also present improvements on AOP that are necessary in order for this approach to be realizable. The first improvement, GAFlow and GDFlow, two new pointcut constructors, allow the injection of code that precedes or follows any of the points in the input set, facilitating the development of reusable patterns. The second, ExportParameter and ImportParameter, allow us to safely pass parameters between different parts of the program. Afterwards, we leverage our previous findings in the definition of SHL, the Security Hardening Language. SHL is designed in order to permit language-independent expression of security hardening plans and security hardening patterns in an aspect-oriented manner which enables refinement of patterns into concrete solutions. We then demonstrate the viability of this approach by applying it to add a security feature to the APT package acquisition and management system.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Item Type:Thesis (Masters)
Authors:Laverdière-Papineau, Marc-André
Pagination:xii, 117 leaves : ill. ; 29 cm.
Institution:Concordia University
Degree Name:M.A. Sc.
Program:Institute for Information Systems Engineering
Thesis Supervisor(s):Debbabi, Mourad
Identification Number:LE 3 C66I54M 2007 L38
ID Code:975561
Deposited By: Concordia University Library
Deposited On:22 Jan 2013 16:10
Last Modified:13 Jul 2020 20:08
Related URLs:
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Research related to the current document (at the CORE website)
- Research related to the current document (at the CORE website)
Back to top Back to top