Saltzer \& Schroeder's principles aim to bring security to the design of computer systems. We investigate SolarWinds Orion update and Log4j to unpack the intersections where observance of these principles could have mitigated the embedded vulnerabilities. The common principles that were not observed include \emph{fail safe defaults}, \emph{economy of mechanism}, \emph{complete mediation} and \emph{least privilege}. Then we explore the literature on secure software development interventions for developers to identify usable analysis tools and frameworks that can contribute towards improved observance of these principles. We focus on a system wide view of access of codes, checking access paths and aiding application developers with safe libraries along with an appropriate security task list for functionalities.
翻译：Saltzer ⁇ Schroeder 的原则旨在使计算机系统的设计具有安全性。 我们调查SollarWinds Orion 更新和 Log4j 以解开交叉路口,在这些交叉路口中,遵守这些原则可以减轻嵌入的脆弱性。 未遵守的共同原则包括 emph{fail fail 安全违约 },\ emph{ economy of cround},\ emph{ complete med} 和\ emph{ lode}。 然后,我们探索关于安全软件开发干预措施的文献,让开发者找到有助于更好地遵守这些原则的可用分析工具和框架。 我们侧重于从系统角度审视代码的存取,检查访问路径,协助应用程序开发者使用安全图书馆,并附上适当的功能安全任务清单。
相关内容
微信扫码咨询专知VIP会员