Defensive programming is a form of
defensive design
Defensive design is the practice of planning for contingencies in the design stage of a project or undertaking. Essentially, it is the practice of anticipating all possible ways that an end-user could misuse a device, and designing the device so ...
intended to develop programs that are capable of detecting potential security abnormalities and make predetermined responses. It ensures the continuing function of a piece of
software
Software is a set of computer programs and associated documentation and data. This is in contrast to hardware, from which the system is built and which actually performs the work.
At the lowest programming level, executable code consists ...
under unforeseen circumstances. Defensive programming practices are often used where
high availability
High availability (HA) is a characteristic of a system which aims to ensure an agreed level of operational performance, usually uptime, for a higher than normal period.
Modernization has resulted in an increased reliance on these systems. Fo ...
,
safety
Safety is the state of being "safe", the condition of being protected from harm or other danger. Safety can also refer to risk management, the control of recognized hazards in order to achieve an acceptable level of risk.
Meanings
There are ...
, or
security
Security is protection from, or resilience against, potential harm (or other unwanted coercive change) caused by others, by restraining the freedom of others to act. Beneficiaries (technically referents) of security may be of persons and social ...
is needed.
Defensive programming is an approach to improve software and
source code
In computing, source code, or simply code, is any collection of code, with or without comments, written using a human-readable programming language, usually as plain text. The source code of a program is specially designed to facilitate the wo ...
, in terms of:
* General quality – reducing the number of
software bug
A software bug is an error, flaw or fault in the design, development, or operation of computer software that causes it to produce an incorrect or unexpected result, or to behave in unintended ways. The process of finding and correcting bugs i ...
s and problems.
* Making the source code comprehensible – the source code should be readable and understandable so it is approved in a
code audit
A software code audit is a comprehensive analysis of source code in a programming project with the intent of discovering bugs, security breaches or violations of programming conventions. It is an integral part of the defensive programming paradigm ...
.
* Making the software behave in a predictable manner despite unexpected inputs or user actions.
Overly defensive programming, however, may safeguard against errors that will never be encountered, thus incurring run-time and maintenance costs. There is also a risk that code traps prevent too many
exceptions, potentially resulting in unnoticed, incorrect results.
Secure programming
Secure programming is the subset of defensive programming concerned with
computer security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...
. Security is the concern, not necessarily safety or availability (the
software
Software is a set of computer programs and associated documentation and data. This is in contrast to hardware, from which the system is built and which actually performs the work.
At the lowest programming level, executable code consists ...
may be allowed to fail in certain ways). As with all kinds of defensive programming, avoiding bugs is a primary objective; however, the motivation is not as much to reduce the likelihood of failure in normal operation (as if safety were the concern), but to reduce the attack surface – the programmer must assume that the software might be misused actively to reveal bugs, and that bugs could be exploited maliciously.
int risky_programming(char *input)
The function will result in undefined behavior when the input is over 1000 characters. Some programmers may not feel that this is a problem, supposing that no user will enter such a long input. This particular bug demonstrates a vulnerability which enables
buffer overflow
In information security and programming, a buffer overflow, or buffer overrun, is an anomaly whereby a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.
Buffers are areas of memory ...
exploit
Exploit means to take advantage of something (a person, situation, etc.) for one's own end, especially unethically or unjustifiably.
Exploit can mean:
*Exploitation of natural resources
*Exploit (computer security)
* Video game exploit
*Exploitat ...
s. Here is a solution to this example:
int secure_programming(char *input)
Offensive programming
Offensive programming is a category of defensive programming, with the added emphasis that certain errors should ''not'' be
handled defensively. In this practice, only errors from outside the program's control are to be handled (such as user input); the software itself, as well as data from within the program's line of defense, are to be trusted in this
methodology
In its most common sense, methodology is the study of research methods. However, the term can also refer to the methods themselves or to the philosophical discussion of associated background assumptions. A method is a structured procedure for bri ...
.
Trusting internal data validity
;Overly defensive programming
const char* trafficlight_colorname(enum traffic_light_color c)
;Offensive programming
const char* trafficlight_colorname(enum traffic_light_color c)
Trusting software components
;Overly defensive programming
if (is_legacy_compatible(user_config)) else
;Offensive programming
// Expect that the new code has no new bugs
if (new_code(user_config) != OK)
Techniques
Here are some defensive programming techniques:
Intelligent source code reuse
If existing code is tested and known to work, reusing it may reduce the chance of bugs being introduced.
However, reusing code is not ''always'' good practice. Reuse of existing code, especially when widely distributed, can allow for exploits to be created that target a wider audience than would otherwise be possible and brings with it all the security and vulnerabilities of the reused code.
When considering using existing source code, a quick review of the modules(sub-sections such as classes or functions) will help eliminate or make the developer aware of any potential vulnerabilities and ensure it is suitable to use in the project.
Legacy problems
Before reusing old source code, libraries, APIs, configurations and so forth, it must be considered if the old work is valid for reuse, or if it is likely to be prone to
legacy
In law, a legacy is something held and transferred to someone as their inheritance, as by will and testament. Personal effects, family property, marriage property or collective property gained by will of real property.
Legacy or legacies may refer ...
problems.
Legacy problems are problems inherent when old designs are expected to work with today's requirements, especially when the old designs were not developed or tested with those requirements in mind.
Many software products have experienced problems with old legacy source code; for example:
*
Legacy code
In computing, a legacy system is an old method, technology, computer system, or application program, "of, relating to, or being a previous or outdated computer system", yet still in use. Often referencing a system as "legacy" means that it paved ...
may not have been designed under a defensive programming initiative, and might therefore be of much lower quality than newly designed source code.
* Legacy code may have been written and tested under conditions which no longer apply. The old quality assurance tests may have no validity any more.
** Example 1: legacy code may have been designed for ASCII input but now the input is UTF-8.
** Example 2: legacy code may have been compiled and tested on 32-bit architectures, but when compiled on 64-bit architectures, new arithmetic problems may occur (e.g., invalid signedness tests, invalid type casts, etc.).
** Example 3: legacy code may have been targeted for offline machines, but becomes vulnerable once network connectivity is added.
* Legacy code is not written with new problems in mind. For example, source code written in 1990 is likely to be prone to many
code injection
Code injection is the exploitation of a computer bug that is caused by processing invalid data. The injection is used by an attacker to introduce (or "inject") code into a vulnerable computer program and change the course of execution. The re ...
vulnerabilities, because most such problems were not widely understood at that time.
Notable examples of the legacy problem:
*
BIND 9, presented by Paul Vixie and David Conrad as "BINDv9 is a
complete rewrite", "Security was a key consideration in design", naming security, robustness, scalability and new protocols as key concerns for rewriting old legacy code.
*
Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
suffered from "the"
Windows Metafile vulnerability
The Windows Metafile vulnerability—also called the Metafile Image Code Execution and abbreviated MICE—is a security vulnerability in the way some versions of the Microsoft Windows operating system handled images in the Windows Metafile format. ...
and other exploits related to the WMF format. Microsoft Security Response Center describes the WMF-features as ''"Around 1990, WMF support was added... This was a different time in the security landscape... were all completely trusted"'', not being developed under the security initiatives at Microsoft.
*
Oracle
An oracle is a person or agency considered to provide wise and insightful counsel or prophetic predictions, most notably including precognition of the future, inspired by deities. As such, it is a form of divination.
Description
The word '' ...
is combating legacy problems, such as old source code written without addressing concerns of
SQL injection
In computing, SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL inj ...
and
privilege escalation
Privilege escalation is the act of exploiting a bug, a design flaw, or a configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The re ...
, resulting in many security vulnerabilities which have taken time to fix and also generated incomplete fixes. This has given rise to heavy criticism from security experts such as
David Litchfield
David Litchfield (born 1975) is a British security expert and The Director of Information Security Assurance for Apple. Anne Saita, writing for ''Information Security'' magazine, called him along with his brother Mark Litchfield, "World's Best Bu ...
,
Alexander Kornbrust
Alexander is a male given name. The most prominent bearer of the name is Alexander the Great, the king of the Ancient Greek kingdom of Macedonia who created one of the largest empires in ancient history.
Variants listed here are Aleksandar, Al ...
,
Cesar Cerrudo Cesar, César or Cèsar may refer to:
Arts, entertainment, and media
* ''César'' (film), a 1936 film directed by Marcel Pagnol
* ''César'' (play), a play by Marcel Pagnolt
* César Award, a French film award
Places
* Cesar, Portugal
* Ces ...
.
[{{Cite web, url=http://seclists.org/lists/bugtraq/2006/May/0083.html, title=Bugtraq: Re: ull-disclosureRE: Oracle, where are the patches???, last=Cerrudo, first=Cesar, website=seclists.org, access-date=2018-10-27] An additional criticism is that default installations (largely a legacy from old versions) are not aligned with their own security recommendations, such a
Oracle Database Security Checklist which is hard to amend as many applications require the less secure legacy settings to function correctly.
Canonicalization
Malicious users are likely to invent new kinds of representations of incorrect data. For example, if a program attempts to reject accessing the file "/etc/
passwd
passwd is a command on Unix, Plan 9, Inferno, and most Unix-like operating systems used to change a user's password. The password entered by the user is run through a key derivation function to create a hashed version of the new password, wh ...
", a cracker might pass another variant of this file name, like "/etc/./passwd".
Canonicalization
In computer science, canonicalization (sometimes standardization or normalization) is a process for converting data that has more than one possible representation into a "standard", "normal", or canonical form. This can be done to compare diff ...
libraries can be employed to avoid bugs due to non-
canonical
The adjective canonical is applied in many contexts to mean "according to the canon" the standard, rule or primary source that is accepted as authoritative for the body of knowledge or literature in that context. In mathematics, "canonical example ...
input.
Low tolerance against "potential" bugs
Assume that code constructs that appear to be problem prone (similar to known vulnerabilities, etc.) are bugs and potential security flaws. The basic rule of thumb is: "I'm not aware of all types of
security exploit
An exploit (from the English verb ''to exploit'', meaning "to use something to one’s own advantage") is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended or unanti ...
s. I must protect against those I ''do'' know of and then I must be proactive!".
Other Tips to Secure Your Code
* One of the most common problems is unchecked use of constant-size or pre-allocated structures for dynamic-size data such as inputs to the program (the
buffer overflow
In information security and programming, a buffer overflow, or buffer overrun, is an anomaly whereby a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.
Buffers are areas of memory ...
problem). This is especially common for
string data in
C. C library functions like
gets
should never be used since the maximum size of the input buffer is not passed as an argument. C library functions like
scanf
can be used safely, but require the programmer to take care with the selection of safe format strings, by sanitizing it before using it.
* Encrypt/authenticate all important data transmitted over networks. Do not attempt to implement your own encryption scheme, use a
proven one instead. Message checking with
CRC or similar technology will also help secure data sent over a network.
The 3 Rules of Data Security
* All
data
In the pursuit of knowledge, data (; ) is a collection of discrete values that convey information, describing quantity, quality, fact, statistics, other basic units of meaning, or simply sequences of symbols that may be further interpreted ...
is important until proven otherwise.
* All data is tainted until proven otherwise.
* All code is insecure until proven otherwise.
** You cannot prove the security of any code in
userland, or, more commonly known as: ''"never trust the client"''.
These three rules about data security describe how to handle any data, internally or externally sourced:
All data is important until proven otherwise - means that all data must be verified as garbage before being destroyed.
All data is tainted until proven otherwise - means that all data must be handled in a way that does not expose the rest of the runtime environment without verifying integrity.
All code is insecure until proven otherwise - while a slight misnomer, does a good job reminding us to never assume our code is secure as bugs or
undefined behavior
In computer programming, undefined behavior (UB) is the result of executing a program whose behavior is prescribed to be unpredictable, in the language specification to which the computer code adheres. This is different from unspecified behavior ...
may expose the project or system to attacks such as common
SQL injection
In computing, SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL inj ...
attacks.
More Information
* If data is to be checked for correctness, verify that it is correct, not that it is incorrect.
*
Design by contract
*
Assertions (also called assertive programming)
* Prefer
exceptions to return codes
** Generally speaking, it is preferable to throw exception messages that enforce part of your
API
An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software interface, offering a service to other pieces of software. A document or standard that describes how ...
contract
A contract is a legally enforceable agreement between two or more parties that creates, defines, and governs mutual rights and obligations between them. A contract typically involves the transfer of goods, services, money, or a promise to tran ...
and guide the developer instead of returning error code values that do not point to where the exception occurred or what the program stack looked liked, Better logging and exception handling will increase robustness and security of your software, while minimizing developer stress.
See also
*
Computer security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...
* Immunity-aware programming
References
External links
CERT Secure Coding Standards
Programming paradigms
Programming principles