A taxonomy of computer program security flaws

ABSTRACT

An organized record of actual flaws can be useful to computer system designers, programmers, analysts, administrators, and users. This survey provides a taxonomy for computer program security flaws, with an Appendix that documents 50 actual security flaws. These flaws have all been described previously in the open literature, but in widely separated places. For those new to the field of computer security, they provide a good introduction to the characteristics of security flaws and how they can arise. Because these flaws were not randomly selected from a valid statistical sample of such flaws, we make no strong claims concerning the likely distribution of actual security flaws within the taxonomy. However, this method of organizing security flaw data can help those who have custody of more representative samples to organize them and to focus their efforts to remove and, eventually, to prevent the introduction of security flaws.

REFERENCES

• 1: ABBOT% R. P., CHIN, J. S., DONNELLEY, J. E., KONIGSFORD, W. L., TOKUBO, S., AND WEBB, D.A. 1976. Security analysis and enhancements of computer operating systems. NBSIR 76 1041, National Bureau of Standards, ICST, Washington, D.C.
• 2: ANDERSON, J.P. 1972. Computer security technology planning study. ESD-TR-73-51, vols. I and II. NTIS AD758206, Hanscom Field, Bedford, Mass.
• 3: BISBEY R., II AND HOLLINGWORTH, D. 1978. Protection analysis project final report. ISI/RR-78-13, DTIC AD A056816, USC/Information Sciences Inst., 1978.
• 4: BREHMER, C. L. AND CARL, J.R. 1993. Incorporating IEEE Standard 1044 into your anomaly tracking process. CrossTalk, J. Def. Softw. Eng. 6, I (Jan.), 9-16.
• 5: Ram Chillarege , Inderpal S. Bhandari , Jarir K. Chaar , Michael J. Halliday , Diane S. Moebus , Bonnie K. Ray , Man-Yuen Wong, Orthogonal Defect Classification-A Concept for In-Process Measurements, IEEE Transactions on Software Engineering, v.18 n.11, p.943-956, November 1992 [doi>10.1109/32.177364]
• 6: COHEN, F. 1984. Computer viruses: Theory and experiments. In the 7th DoD/NBS Computer Security Conference. 240-263.
• 7: DEPARTMENT OF DEFENSE. 1985. Trusted computer system evaluation criteria. DoD 5200.28- STD, U.S. Dept. of Defense, Washington, D.C.
• 8: Dorothy Elizabeth Rob Denning, Cryptography and Data Security, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1982
• 9: DENNING, P.J. 1988. Computer viruses. Am. Sci. 76 (May-June), 236-238.
• 10: ELMER-DEWITT, P. 1988. Invasion of the data snatchers. TIME Mag. (Sept. 26), 62-67.
• 11: David Ferbrache, A Pathology of Computer Viruses, Springer-Verlag New York, Inc., Secaucus, NJ, 1992
• 12: FLORAC, W. A. 1992. Software quality measurement: A framework for counting problems and defects. CMU/SEI-92-TR-22, Software Engineering Inst. Pittsburgh, Pa.
• 13: Morrie Gasser, Building a secure computer system, Van Nostrand Reinhold Co., New York, NY, 1988
• 14: IEEE COMPUTER SOCIETY 1990. Standard glossary of software engineering terminology, ANSI/IEEE Standard 610.12-1990 IEEE Press, New York.
• 15: Butler W. Lampson, A note on the confinement problem, Communications of the ACM, v.16 n.10, p.613-615, Oct. 1973 [doi>10.1145/362375.362389]
• 16: LANDWEHR, C. E. 1983. The best avafiable technologies for computer security. JEEE Comp~zt, 16, 7 (July), 86 100.
• 17: Carl E. Landwehr, Formal Models for Computer Security, ACM Computing Surveys (CSUR), v.13 n.3, p.247-278, Sept. 1981 [doi>10.1145/356850.356852]
• 18: J.C. C. Laprie , A. Avizienis , H. Kopetz, Dependability: Basic Concepts and Terminology, Springer-Verlag New York, Inc., Secaucus, NJ, 1992
• 19: LEVESON, N. AND TURNER, C. S 1992. An investigation of the Therac~25 accidents. UCI TR-92- 108, Information and Computer Science Dept., Univ. of California, Irvine, Ca.
• 20: LINDE, R.R. 1975. Operating system penetration. In the AFIPS National Computer Conference. AFIPS, Arlington, Va., 361 368.
• 21: McDERMOTT, J.P. 1988. A technique for removing an important class of Trojan horses from high order languages. In Proceedu~gs of the llth National Computer Security Conference. NBS/NCSC, Gaithersburg, Md., 114-117.
• 22: NEUMANN, P.G. 1978. Computer security evaluation. In the 1978 Natwnal Computer Conference, AFIPS Conference Proceedings 47. AFIPS, Arlington, Va., 1087-1095.
• 23: PETROSKI, H. 1992. To Engineer zs Human: The Role of Failure Ln Successful Design. Vintage Books, New York.
• 24: Charles P. Pfleeger, Security in computing, Prentice-Hall, Inc., Upper Saddle River, NJ, 1988
• 25: Jon A. Rochlis , Mark W. Eichin, With microscope and tweezers: the worm from MIT's perspective, Communications of the ACM, v.32 n.6, p.689-698, June 1989 [doi>10.1145/63526.63528]
• 26: SCHELL, R. R. 1979. Computer security: The Achfiles heel of the electronic Air Force? A~r Univ. Rev. 30, 2 (Jan. Feb.), 16-33.
• 27: John F. Shoch , Jon A. Hupp, The “worm” programs—early experience with a distributed computation, Communications of the ACM, v.25 n.3, p.172-180, March 1982 [doi>10.1145/358453.358455]
• 28: E. H. Spafford, Crisis and aftermath, Communications of the ACM, v.32 n.6, p.678-687, June 1989 [doi>10.1145/63526.63527]
• 29: SULLIVAN, M. R. AND CHILLAREGE, R. 1992. A comparison of software defects in database management systems and operating systems. In Proceedings of the 22nd International Symposium on Fault-Tolerant Computer Systems IEEE Computer Society, Boston, Mass., (FTCS-22 ) (July).
• 30: Ken Thompson, Reflections on trusting trust, Communications of the ACM, v.27 n.8, p.761-763, Aug 1984 [doi>10.1145/358198.358210]
• 31: WEiss, D. M. AND BASmI, V.R. 1985. Evaluating software development by analysis of changes: Some data from the Software Engineering Laboratory. IEEE Trans. Softw Eng. SE-11, 2 (Feb.), 157-168.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.0 General
          Subjects: Protection mechanisms
      D.2.9 Management
          Subjects: Life cycle; Software configuration management
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Authentication; Invasive software (e.g., viruses, worms, Trojan horses); Information flow controls

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.3 Software Management
          Subjects: Software development
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses); Authentication

General Terms:
Algorithms, Security

Keywords:
error/defect classification, security flaw, taxonomy