There are many types of vulnerabilities of modern day software engineering from improper usage of third party software to even environmental factors such as ineffective code reviews that allow unauthorised users and harmful software.
Keyword
Harmful software is also known as malware, as for malicious software. This refers to viruses and spyware, which are pieces of software that are harmful if allowed to run.
APIs
APIs, also known as application programming interfaces, provide literally an interface for your software to interact and request functionality and data which could potentially expose security threats unintended or intended:
- Unauthorized access - if you were to expose functionality/data for outside usage, you must ensure that only users with proper authorization has access to it.
- Injection attacks - if you were to expose a part of your software that requires upload, attackers can exploit and try to install malware onto your software.
- DDoS - APIs can be exploited by repeated requests, overwhelming the servers and subsequently shutting down your service.
Mitigation techniques
- Strong authentication and authorization techniques
- Using HTTPS
- Rate limiting prevents repeated calls over a short amount of time, reducing risks of DDoS attacks
- Ensuring that the data exposed is only the bare minimum
- Regular security assessments and checks
Malware
Malware refers to any malicious software that is designed to infiltrate and damage systems.
- Data theft
- Corruption
- Unauthorized control of systems
Mitigation
- Use anti-malware tools
- Scan thoroughly for malicious pieces of software, third party code.
- Restrict admin control, preventing dangerous code from executing
Unpatched software
Outdated software have security vulnerabilities that may not have been addressed. This could apply to all parts of software development, from even the tools themselves. Attackers may potentially:
- Unauthorized access
- Disrupt services
- Escalate privileges
Mitigation
- Maintain security updates
- Monitor critical security updates
- Automated patch management
Poor identity & access management
Identity and access management (IAM) refers to how software controls how users are identified and authorized. Poor IAM practices, such as no MFA or shared credentials, unauthorized access and other risks can give attackers access to more.
Mitigation
- Proper IAM practices
- MFA
- No shared accounts
- Monitoring logs
Man-in-the-middle (MitM) attacks
A man-in-the-middle attack refers to attacks where an attacker intercepts and alters communication between 2 parties. Privileged and private information can be intercepted, changed and sent around without the 2 parties knowledge of the attacker in the first person.
- Leaks
- Spying on conversations and data
- Redirecting money transfers
- Corrupting/manipulating transmitted data
Methods
- SSL stripping - the attacker in the middle uses HTTPS to be the intermediary, then bridges the connection between the client and intended party with HTTP to steal data.
- Evil twin attacks - the attacker sets up a fake but seemingly trustworthy network. All traffic data can be monitored and stolen once connnected.
- Email hijacking - the attacker gains access to an user’s email and monitors conversations.
- Session hijacking - the attacker steals session data (cookies, session ids, etc.) to ‘act’ as a user.
- DNS spoofing - the attacker changes DNS records to redirect users to seemingly real websites, but only serve to steal data.
- IP spoofing - similar to DNS, but disguises IP instead.
Mitigation
- Use security tools, such as VPNs
- Proper education to recognize suspicious networks or websites
- Keeping credentials secure
- Use secure networks and network protocols (HTTPS)
- Validate digital certificates (SSL)
Insider threats
Insider threats refer to individuals within the organization threatening to compromise data or implement malicious code.
Mitigation
- Version control and code review
- Restrict access
- Monitor activity
- Provide proper training on ethical development and security policies
Cyber security incidents
A broad term that refers to events that compromise the integrity, confidentiality or availability of data and systems. It can stem from:
- external attacks
- insider actions
- system failures and result in:
- disrupted work
- data breaches
- etc.
Mitigation
- Develop and regularly update an incident response plan
- Implement detection systems (IDS/IPS) and logging
- Proper training
- Backups are secure and tested
Other vulnerabilities
- Using 3rd party software (packages, APIs, etc.)
- Ineffective code reviews
- Combined environments