Software Security Analysis: Execution Phase Audit
Blekinge Institute of Technology, School of Engineering, Department of Systems and Software Engineering2005 (English)Conference paper (Refereed) Published
Code revision of a leading telecom product was performed, combining manual audit and static analysis tools. On average, one exploitable vulnerability was found for every 4000 lines of code. Half of the located threats in the product were buffer overflows followed by race condition, misplaced trust, and poor random generators. Static analysis tools were used to speed up the revision process and to integrate security tests into the overall project process. The discussion analyses the effectiveness of automatic tools for auditing software. Furthermore, the incorporation of the software security analysis into the development process, and the results and costs of the security analysis is discussed. From the initial 42 workdays used for finding all vulnerabilities, approximately 16 days were needed for finding and correcting 91,5 % of the vulnerabilities. So, proportionally small investments improve the program code security by integrating an automatic auditing tool into the ordinary execution of source code revision.
Place, publisher, year, edition, pages
IdentifiersURN: urn:nbn:se:bth-8677ISI: 000232368700028Local ID: oai:bth.se:forskinfoDEDB7CA1433C14AAC12573C90050E7EBOAI: oai:DiVA.org:bth-8677DiVA: diva2:836427