Creating secure software is very similar to creating safety-critical software, observes Jay Thomas at LDRA. If we treat security as an explicit requirement throughout the development life cycle, we can dynamically verify its implementations. Moreover, static analysis helps eliminate known risks and vulnerabilities.
Security is a growing concern for today’s Internet of Things. ‘Smart’ thermostats and point-of-sale devices have given hackers access to credit card databases, and we’ve seen multiple demonstrations of cars and personal medical devices being taken over by outsiders. All these examples represent vulnerabilities in the cryptographic software components used to secure internet communications. As a result, developers are facing increased demand for not only reliable and safe embedded software, but also software systems that are secure.
To be considered secure, software must exhibit three properties. First, it must be dependable, that is, it must execute predictably and operate correctly under all conditions. Second, it must be trustworthy: it must contain few, if any, exploitable vulnerabilities or weaknesses that can be used to subvert or sabotage the software’s dependability. And third, it must be resilient enough to withstand attack and to recover as quickly as possible, and with the least possible damage from those attacks that it can neither resist nor tolerate.
This article is exclusively available to premium members of Bits&Chips. Already a premium member? Please log in. Not yet a premium member? Become one for just €20 for the first year and enjoy all the benefits.
