Software Security

Software security is the idea of engineering software so that it continues to function correctly under malicious attack. Plenty of progress has been made in the field of software security since its inception in 2001. A number of best practices including the Touchpoints have been identified and put into common use. In addition, the BSIMM1 project has devised a way to measure and compare large scale software security initiatives.     

浅谈保密技术手段在保密工作中的应用

二十世纪九十年代以来,以互联网为核心信息时代到来,信息社会出现,信息安全使传统保密工作条件、内容和方式发生变化,我们在新挑战下,必须重新定位保密与信息安全工作,应用新时代保密技术手段为中国大飞机事业保驾护航。     

What You Need to Know About Software Contracts

Because the software industry is undergoing an accelerated rate of development, contract standardization is difficult, and contracts are frequently inconsistent. The MIS manager can contend with these discrepancies by understanding the fundamental software contract provisions and by protecting the rights of the organization while respecting the legitimate concerns of the software vendor.     

基于软件总线技术的软件工程方法

该文提出了软件总线的框架结构,并对软件总线的模块设计方案进行了论述。文章最后描述了基于软件总线的软件开发方法及其过程。     

虚拟仪器的软件实现方法

在介绍自动测试系统发展历史的基础上，重点阐述了虚拟仪器的软硬件结构和关键技术，重点介绍了软件实现方法。     

Podcasting 101: What the Web's New Trend Means to You

First, the phenomenon of blogging changed the rules for online publishing. Now, podcasting has opened the world of online broadcasting to anyone with a PC, a microphone, and a net connection. Don't be mistaken, podcasting, which gets its name from a combination of broadcasting and the Apple iPod, isn't just for fun and games. You can find plenty of podcasts focused on music, talk-radio style banter, and humor, but podcasts also now serve key purposes for news organizations, businesses, and even politicians trying to connect with voters. Furthermore, they're making news in education, especially in universities with the resources and funding to support early applications     

What Computing with Words Means to Me [Discussion Forum]

Computing with words (CWW) means different things to different people. This article is the start of a position paper, written by some of the members of the CIS Fuzzy Systems Technical Committee Task Force on CWW, that answers the question What does CWW mean to me?     

利用J2EE架构高效构造商用软件

在现在的商业软件开发领域,越来越多的公司使用J2EE架构来开发商用软件。J2EE架构有很多自身的优势。在J2EE架构所包含的众多技术中,如何选择合适与应用的技术来使我们的软件开发达到最好的效果是一个很值得研究的问题。有些开发人员倾向于使用最新的技术,但是在很多情况下我们应该根据项目的具体情况选择技术。该文用一个真实的商用软件开发来展示如何根据项目需求在有限资源下帮助项目达到最大的效率。     

信息安全网关管理的可视化软件实现

主要阐述了利用Windows界面下的VC++6.0可视化应用软件实现IP-VPN网关管理,设计出了Windows界面下的应用软件,同时在Linux下利用GCC编辑器,以实现Linux对Windows管理软件作出响应的相应操作和IP-VPN管理中的部分内容。     

如何做好软件安全性测试

软件安全性测试是软件测试过程中一个长期重要的课题,什么是软件安全性测试,如何在测试中评测一个软件到底安全不安全.阐述了常用的软件测试方法,将软件测试中的正向测试和反向测试两种途径应用于软件安全性测试中.最后介绍了一些常见的软件安全性缺陷和漏洞.     

High-Speed Software Development Practices: What Works, What Doesn't

Increasingly short software development cycles have forced software companies and engineers to strike a balance between informal development--in Internet-time--and more traditional agile and plan-driven methods. The authors review six common practices and how they are blended to maximize time-sensitive development.     

Requirements for Security Enhancements to Legacy Software with RUP

ABSTRACT

This article describes how to adapt a specific part of the Rational Unified Process (RUP) framework for the purpose of conducting requirements gathering for software projects aimed at adding security features to legacy software. The RUP seems particularly fitting for this purpose because it aggregates numerous software engineering terms into a common body of knowledge and strives to give them clear and unambiguous semantics. Furthermore, the RUP allows project coordinators to pick and choose only the process elements best suited to meet the particular needs of a project.

The article should prove useful to project managers, process engineers, and software architects responsible for teaching old software new security functions. It should also prove useful to organizations that have already carried out basic software security projects such as those that fix buffer overflows, teach the software to perform better data validation, replace unsafe string handling functions, and recompile code with safe exception handling. This article covers only a small and very specific part of the RUP. It interprets the RUP in ways guided by the author's experience and specializes the Requirements discipline for use in projects tasked with adding new security features to legacy software.     

What Software are you Running?

With its recent name and shame policy the Business Software Alliance (BSA) has clearly signalled a change in the way software piracy by the business community is perceived. It must be acknowledged that in the vast majority of cases businesses are NOT purposely setting out to defraud the software producers!     

The Contemporary Software Security Landscape

Microsoft's release of Windows Vista marks the arrival of a new era for software security. Fundamental changes have gradually occurred, bringing us to a point now where the threat landscape no longer resembles what it was just a few years ago. Vista's release is ideal to consider as a culmination point; it's from here that software attack strategies will move into new directions. In this article, the author examines some of these new directions, as well as some of the changes related to Vista that most encapsulate the current threat landscape for software security. Eight characterirstics most strongly define the new software security threat landscape. Let's take a look at them: actualization of Web vulnerability threats; advances in code analysis; more advanced techniques; client-side vulnerabilities; remote exploitation; targeted attacks; sale of vulnerability information; and anti-exploitation technology.     

A Portal for Software Security

We describe a software security portal, created under the guidance of the US Department of Homeland Security by the Software Engineering Institute and Cigital.     

软件安全建模与检测

为有效表示和检测软件中存在的安全缺陷和隐患,提出了一种软件安全建模与检测技术--层次融合安全建模与检测技术.该技术采用多点建模技术,通过结合抽象建模、应用建模和数据建模等机制来实现对安全特征的描述.此外该技术利用表示层、应用层等不同抽象层次的建模信息,通过自动机与模型合成技术来构建安全特征模型.最后结合基于应用切片技术对软件中的安全缺陷与隐患进行检测.该技术克服了常规安全建模与检测中存在的缺点,可以有效表示和检测各种安全特征,提高了安全模型的表达力、复用性和适用性,降低了安全检测的复杂度.