Program Security

1. Program Security ITMS- 3153 Information Systems Security

2. Malicious Code • Malicious code or rogue program is the general name for unanticipated or undesired effects in programs or program parts, caused by an agent intent on damage. • Malicious code can do anything any other program can, such as writing a message on a computer screen, stopping a running program, generating a sound, or erasing a stored file. • Malicious code runs under the user's authority. Thus, malicious code can touch everything the user can touch, and in the same ways.

3. Kinds of Malicious Code

4. How Viruses Attach • E-Mail • Setup File

5. Appended Viruses • The user is unaware of the effect of the virus if the original program still does all that it used to. Most viruses attach in this manner.

6. Viruses That Surround a Program • Virus that runs the original program but has control before and after its execution.

7. Integrated Viruses and Replacements • Virus replaces some of its target, integrating itself into the original code of the target.

8. Virus Signatures • The virus executes in a particular way, using certain methods to spread. Each of these characteristics yields a telltale pattern, called a signature. • The virus's signature is important for creating a program, called a virus scanner, that can detect and, in some cases, remove viruses.

9. How Viruses Gain Control

10. Homes for Viruses • It is hard to detect. • It is not easily destroyed or deactivated. • It spreads infection widely. • It can reinfect its home program or other programs. • It is easy to create. • It is machine independent and operating system independent

11. Virus Effects and Causes

12. Virus Effects and Causes…

13. Prevention of Virus Infection • Use only commercial software acquired from reliable, well-established vendors. • Test all new software on an isolated computer. • Open attachments only when you know them to be safe. • Make a recoverable system image and store it safely. • Make and retain backup copies of executable system files. • Use virus detectors

14. Trapdoors • A trapdoor is an undocumented entry point to a module. Developers insert trapdoors during code development, perhaps to test the module.

15. Causes of Trapdoors • Forget to remove them • Intentionally leave them in the program for testing • Intentionally leave them in the program for maintenance of the finished program • Intentionally leave them in the program as a covert means of access to the component after it becomes an accepted part of a production system

16. Covert Channels • The communication travels unnoticed, accompanying other, perfectly proper, communications. The general name for these extraordinary paths of communication is covert channels.

17. Controls against Program Threats • It is of course better to focus on prevention than cure; how do we use controls during software development the specifying, designing, writing, and testing of the program to find and eliminate the sorts of exposures.