CIS 225

Lecture 16 - Software Security

Software Evaluation

• You work for a healthcare company
• You receive a request to install unknown software on a system


• How do you ensure the software is safe to use?
• What are the risks?

Reputable Sources

• Verify the software comes from a well-known source
• Do they create other programs?
• Have they been reviewed?

Support Offerings

• What does the company offer for support?
• Is there an active user community?
• Are there common problems reports in forums
• Can you request in-person help if major issues arise?

Company History & Coding

• Does the company have a history of software issues?
• Do they have proper coding practices in place (code reviews, secure processes, etc.)?
• Are they frequently issuing security fixes? (Is that a good thing or a bad thing?)

Code Signing

• Similar to Web Security certificates
• Allows publishers to verify that the software came from them
• Can be subverted if the root certificate is compromised
• Ex: Windows WQHL Drivers

Checksum Verification

• Many sites provide checksums for software that can be downloaded
• Verifying the checksum ensures that it hasn't been changed or corrupted

Extra Software

• Many less-reputable programs install extra software (toolbars, adware, malware, etc.)
• Those programs may be MUCH worse than the actual program installed
• Read installers CAREFULLY!
• Use system monitoring tools to see what changes during installation

Data Storage & Access

• Where does the program store data?
• Is it encrypted or plain-text?
• What data does it request?
• How does it use the data?

Monitor Network

• Once software is installed, it usually has full network access
• Use tools such as TCPView and netstat to monitor network connections
• Look for connections to random servers or large data throughput

Network Usage

• What data does it send through the network?
• Is the data encrypted or plain-text?
• What protocols and ports does it use?

Read License Agreement

• Read the license agreement; it may surprise you
• Make sure you understand EVERYTHING that it covers
• Acknowledge the rights you are giving away

Use Testbeds

• Test the software on a variety of systems
• Spend time testing (don't just install and review)
• Test on a variety of systems and configurations
• Roll out in stages in large organizations

Install Updates

• Install updates provided by the manufacturer
• Test updates before installing
• Monitor the system and report bugs

Reading

• Windows 8 - Chapter 15
• Ubuntu Unleashed - Chapter 16

Assignments

• Lab 7 - Software Configuration & Security: Due 10/28 @ 11:59 PM
• Exam 2 - Thursday 11/6