Security in Computing

3. Programs and Programming

In this chapter:

• Programming oversights: buffer overflows, off-by-one errors, incomplete mediation, time-of-check to time-of-use errors

• Malicious code: viruses, worms, Trojan horses

• Developer countermeasures: program development techniques, security principles

• Ineffective countermeasures

Programs are simple things but they can wield mighty power. Think about them for a minute: Programs are just strings of 0s and 1s, representing elementary machine commands such as move one data item, compare two data items, or branch to a different command. Those primitive machine commands implement higher-level programming language constructs such as conditionals, repeat loops, case selection, and arithmetic and string operations. ...