4.4 Summary
Even though security flaws made at the design stage may be more
costly and difficult to fix after the software is written, it is at
the implementation stage that the "last chance for
safety" occurs. Clearly, there are a great many
things that you must keep in mind when implementing your design.
Coding a software design is a process that requires a great deal of
caution and care, and there is no substitute for experience. And even
the experts often get it wrong!
We all can learn from how things are done in other industries. In the
aviation industry, practitioners make extensive use of checklists, in
addition to training pilots on an ongoing basis on how to properly
operate their aircraft. They also intensely analyze the mistakes of
others; whenever an accident takes place, the Federal Aviation
Administration (here in the U.S.—no doubt other countries have
similar practices) distributes a causal analysis memo to all pilots,
for mandatory reading. We all are well advised to learn from that
model. Study all the information that you can find; pedantically use
checklists at each step of the development process; test and retest
every aspect of your software.
Never assume that you have stopped learning how to implement secure
code. Oh, and if you must make mistakes in your software, at least be
original!
What "do's and
"don't's"
can you add to our list? That is, what did we miss? Which of our pointers do you think fall under the rubric of
"common sense"? Perhaps more
interestingly, which don't? This chapter lists a couple of dozen concrete technical
implementation tips that can strengthen program security. Consider
now: if you have had formal training in software engineering, how
many of these points were covered in your coursework? If you are
self-trained, how many of them occurred to you as you were writing
code? How many did you learn the hard way? |
|
