Anti-patterns for Local Data Protection in Highly Secure Software
摘要
Highly secure software is security-reliable software designed to continue functioning correctly according to its intended purpose and stakeholders’ needs, without compromising the security of the data entrusted to it. This remains true even in the event of an error, incident, accident, malicious behavior, and/or deliberate attacks. The local data protection security mechanisms form the security core upon which highly secure software is built. There are numerous widely accepted security recommendations and guidelines for building secure software in terms of local data protection. However, these are not always implemented correctly. The author’s previous work has provided a proof of concept showing how the security of specific highly secure software can be breached by a potential attacker through the identification and exploitation of certain design and implementation mistakes. Based on this, and the author’s experience, this work suggests a generic template for defining anti-patterns for local data protection that can be used to document significant mistakes in the design and implementation of highly secure software. Using the template, four anti-patterns for local data protection are defined, with some examples of successful exploitation of weaknesses in these anti-patterns solutions, resulting in broken data security, highlighted.