检索结果-内蒙古大学图书馆

May the Source Be with You: On ChatGPT, Cybersecurity, and secure coding

INFORMATION 2024年第9期15卷 572页

作者： Gasiba, Tiago Espinha Iosif, Andrei-Cristian Kessba, Ibrahim Amburi, Sathwik Lechner, Ulrike Pinto-Albuquerque, Maria Siemens AG D-81739 Munich Germany Univ Bundeswehr Munchen Inst Schutz & Zuverlassigkeit Wirtschaftsinformat D-85579 Munich Germany Tech Univ Munich TUM Sch Computat Informat & Technol D-85748 Munich Germany ISTAR Inst Univ Lisboa ISCTE IUL P-1600189 Lisbon Portugal

Software security is an important topic that is gaining more and more attention due to the rising number of publicly known cybersecurity incidents. Previous research has shown that one way to address software security is by means of a serious game, the CyberSecurity Challenges, which are designed to raise awareness of software developers of secure coding guidelines. This game, proven to be very successful in the industry, makes use of an artificial intelligence technique (laddering technique) to implement a chatbot for human-machine interaction. Recent advances in machine learning have led to a breakthrough, with the implementation and release of large language models, now freely available to the public. Such models are trained on a large amount of data and are capable of analyzing and interpreting not only natural language but also source code in different programming languages. With the advent of ChatGPT, and previous state-of-the-art research in secure software development, a natural question arises: to what extent can ChatGPT aid software developers in writing secure software? In this work, we draw on our experience in the industry, and also on extensive previous work to analyze and reflect on how to use ChatGPT to aid secure software development. Towards this, we conduct two experiments with large language models. Our engagements with ChatGPT and our experience in the field allow us to draw conclusions on the advantages, disadvantages, and limitations of the usage of this new technology.

关键词： education training secure coding industry cybersecurity capture the flag game analysis CyberSecurity Challenges

来源：评论

学校读者我要写书评

暂无评论

Using Real-world Bug Bounty Programs in secure coding Course: Experience Report 29

Using Real-world Bug Bounty Programs in Secure Coding Course...

引用

29th Annual Conference on Innovation and Technology in Computer Science Education (ITiCSE)

作者： Malinka, Kamil Firc, Anton Loutocky, Pavel Vostoupal, Jakub Kristofik, Andrej Kasl, Frantisek Brno Univ Technol Brno Czech Republic Masaryk Univ Brno Czech Republic

ISBN: (纸本)9798400706004

To keep up with the growing number of cyber-attacks and associated threats, there is an ever-increasing demand for cybersecurity professionals and new methods and technologies. Training new cybersecurity professionals is a challenging task due to the broad scope of the area. One particular field where there is a shortage of experts is Ethical Hacking. Due to its complexity, it often faces educational constraints. Recognizing these challenges, we propose a solution: integrating a real-world bug bounty programme into the cybersecurity curriculum. This innovative approach aims to fill the practical cybersecurity education gap and brings additional positive benefits. To evaluate our idea, we include the proposed solution to a secure coding course for IT-oriented faculty. We let students choose to participate in a bug bounty programme as an option for the semester assignment in a secure coding course. We then collected responses from the students to evaluate the outcomes (improved skills, reported vulnerabilities, a better relationship with security, etc.). Evaluation of the assignment showed that students enjoyed solving such real-world problems, could find real vulnerabilities, and that it helped raise their skills and cybersecurity awareness. Participation in real bug bounty programmes also positively affects the security level of the tested products. We also discuss the potential risks of this approach and how to mitigate them.

关键词： University Education Bug Bounty Cybersecurity Specialization secure coding Course Assignment Experience Report

来源：评论

学校读者我要写书评

暂无评论

Supporting secure coding for Erlang 24

Supporting Secure Coding for Erlang

引用

39th Annual ACM Symposium on Applied Computing (SAC)

作者： Toth, Melinda Bozo, Istvan Eotvos Lorand Univ Fac Informat Budapest Hungary

ISBN: (纸本)9798400702433

Software developer/operator companies have to face growing cyber threats. secure coding is a development process resulting in software products that resist cyber-attacks. Although several security standards and guidelines exist to help developers create secure software, tool-supported identification of vulnerability issues is also needed. Static analyser tools can help to find security issues in the code. However, those work usually in a language-dependent way. In this paper, we show secure coding issues for the programming language Erlang and demonstrate a tool, RefactorErl, that supports the identification of these vulnerabilities in Erlang systems.

关键词： secure coding security checkers Erlang security static analysis RefactorErl

来源：评论

学校读者我要写书评

暂无评论

Measuring secure coding Practice and Culture: A Finger Pointing at the Moon is not the Moon 23

Measuring Secure Coding Practice and Culture: A Finger Point...

引用

45th IEEE/ACM International Conference on Software Engineering (ICSE)

作者： Ryan, Ita Roedig, Utz Stol, Klaas-Jan Univ Coll Cork Sch Comp Sci & IT Adv Ctr Res Trainin Cork Ireland Univ Coll Cork Sch Comp Sci & IT Connect Res Ctr Cork Ireland Univ Coll Cork Sch Comp Sci & IT Lero SFI Res Ctr Software Cork Ireland

ISBN: (纸本)9781665457019

Software security research has a core problem: it is impossible to prove the security of complex software. A low number of known defects may simply indicate that the software has not been attacked yet, or that successful attacks have not been detected. A high defect count may be the result of white-hat hacker targeting, or of a successful bug bounty program which prevented insecurities from persisting in the wild. This makes it difficult to measure the security of non-trivial software. Researchers instead usually measure effort directed towards ensuring software security. However, different researchers use their own tailored measures, usually devised from industry secure coding guidelines. Not only is there no agreed way to measure effort, there is also no agreement on what effort entails. Qualitative studies emphasise the importance of security culture in an organisation. Where software security practices are introduced solely to ensure compliance with legislative or industry standards, a box-ticking attitude to security may result. The security culture may be weak or non-existent, making it likely that precautions not explicitly mentioned in the standards will be missed. Thus, researchers need both a way to assess software security practice and a way to measure software security culture. To assess security practice, we converted the empirically-established 12 most common software security activities into questions. To assess security culture, we devised a number of questions grounded in prior literature. We ran a secure development survey with both sets of questions, obtaining organic responses from 1,100 software coders in 59 countries. We used proven common activities to assess security practice, and made a first attempt to quantitatively assess aspects of security culture in the broad developer population. Our results show that some coders still work in environments where there is little to no attempt to ensure code security. Security practice and culture do no

关键词： Security secure coding security compliance

来源：评论

学校读者我要写书评

暂无评论

Towards Developer-Centered secure coding Training 38

Towards Developer-Centered Secure Coding Training

引用

38th IEEE/ACM International Conference on Automated Software Engineering (ASE)

作者： Pikulin, Vladislav Kubo, Daiki Nissanka, Kaveesha Bandara, Sadeeptha Shamsiemon, Muhammad A. Yasmin, Arissha Jayatilaka, Asangi Madugalla, Anuradha Kanij, Tanjila Monash Univ Depatment Engn Kuala Lumpur Malaysia Univ Adelaide CREST Adelaide SA Australia Monash Univ Dept Software Syst & Cybersecur Melbourne Vic Australia

ISBN: (纸本)9798350330328

Software security continues to be a matter of concern for both end-users and developers, with the cost of potential lapses expected to become larger as software plays a larger role in society. Despite investments in secure coding training programmes, organisations are not achieving the expected success rate. An often overlooked reason for this among many others is that current training programmes are not tailored to consider the diversity among software developers as it relates to human aspects. In this research, data was gathered from software developers of various backgrounds on their perceptions of secure coding training, their expectations from and challenges with such a training program. The findings suggest that developers with personality traits of agreeableness tend to ignore secure coding standards. Additionally, developers with higher work experience tend to demand storage management, responsible use of privileges, security and privacy laws and testing topics to be included in the secure coding training. Furthermore, in terms of training structure, developers with higher openness tend to demand hands-on training to be included. The study's findings seek to inform future researchers and organisations on factors to consider when designing adaptive secure coding programs that would address the needs of developers from different backgrounds.

关键词： secure coding Programming Cybersecurity Training Developers Diversity Human Aspects

来源：评论

学校读者我要写书评

暂无评论

Vulnerabilities and secure coding for Serverless Applications on Cloud Computing

Vulnerabilities and Secure Coding for Serverless Application...

引用

Human Computer Interaction Thematic Area Conference Held as Part of the 24th International Conference on Human-Computer Interaction (HCII)

作者： Kim, Yonghwan Koo, Jahwan Kim, Ung-Mo Sungkyunkwan Univ Grad Sch Informat & Commun 25-2 Sungkyunkwan Ro Seoul South Korea

ISBN: (纸本)9783031054129;9783031054112

Cloud computing has enabled remarkable progress by providing many advantages such as low initial cost, high scalability and flexibility, and low maintenance cost. The success of cloud computing allows developers who want to make various microservices to get interested in serverless applications. However, although many studies have been conducted on the development of serverless applications based on cloud computing over the past few years, the focus is mainly on the security of the cloud computing infrastructure, thus there are few studies on serverless application security itself. In this paper, we analyze security vulnerabilities for serverless applications on cloud computing and present their secure coding techniques. To be effective in practice, the architecture for AWS based serverless applications is designed, and five major security vulnerabilities are identified using the STRIDE threat methodology. Moreover, we provide secure codes for the identified five major security vulnerabilities that will help make more secure serverless applications.

关键词： Cloud computing Serverless application Security secure coding Vulnerabilities

来源：评论

学校读者我要写书评

暂无评论

Key Generation and secure coding in Communications and Private Learning

Key Generation and Secure Coding in Communications and Priva...

引用

作者： Aldaghri, Nasser University of Michigan

学位级别：Ph.D., Doctor of Philosophy

The increasingly distributed nature of many current and future technologies has introduced many challenges for devices designed for such settings. Devices operating in such environments, such as Internet-of-Things (IoT), medical devices, connected vehicles, etc., typically have limited computational power and rely on batteries to operate. Therefore, efficiency is a paramount requirement for any algorithm designed to be implemented on these devices. Furthermore, these devices typically generate and collect huge amounts of extremely sensitive and personal data, such as health-related data, behavior-related data, etc. As a result, there is a need for security and privacy protections to guard against various attacks. Additionally, since these devices are typically resource-constrained, any algorithm or protocol needs to be efficient to enable its implementation on such devices. Efficient security and privacy solutions are essential to cope with, as well as enable, high deployment rate of such devices for various sensitive applications. In this dissertation, efficient solutions for protecting the security and privacy of data generated by such devices are explored. Low-complexity protocols for generating secret keys in static environments, along with a formulation of threshold-secure coding with a shared key and corresponding coding schemes are presented. Additionally, algorithms for coded machine unlearning for regression problems are presented, as well as a new setup and algorithm for federated learning with opt-out differential privacy are presented and evaluated.

关键词： Security Privacy Internet-of-Things Key generation Threshold security Federated learning secure coding

来源：评论

学校读者我要写书评

暂无评论

Toward a readiness model for secure software coding

引用

SOFTWARE-PRACTICE & EXPERIENCE 2023年第4期53卷 1013-1035页

作者： Humayun, Mamoona Niazi, Mahmood Jhanjhi, Noor Zaman Mahmood, Sajjad Alshayeb, Mohammad Jouf Univ Coll Comp & Informat Sci Dept Informat Syst Al Jouf Saudi Arabia King Fahd Univ Petr & Minerals Dept Informat & Comp Sci Dhahran Saudi Arabia King Fahd Univ Petr & Minerals Interdisciplinary Res Ctr Intelligent Secure Syst Dhahran Saudi Arabia Taylors Univ Sch Comp Sci & Engn SCE Subang Jaya Selangor Malaysia

The heart of the application's secure operation is its software code. If the code contains flaws, the entire program might be hacked. The issue with software vulnerabilities is that they reveal coding flaws that hackers could exploit. The prevention of cybersecurity issues begins with the program code itself. When writing software code, a software developer must consider expressing the application's architecture and design requirements, keeping the code streamlined and efficient, and ensuring the code is safe. secure code helps save the system from various cyber-attacks by eliminating the weaknesses that many hacks rely on. To assist the software organization in secure Software coding (SSC), this article proposes a readiness model for SSC, namely SSCRM. The proposed model has five levels;SSC challenges and best practices (BP) are mapped at each level. The proposed model will help the organizations better understand SSC challenges and BPs and provide a roadmap for developing secure software code. The proposed model was evaluated using three case studies. The findings demonstrate that the proposed approach helps determine an organization's SSC level.

关键词： secure coding secure SDLC readiness model case study

来源：评论

学校读者我要写书评

暂无评论

Combining Design by Contract and Programming Logic to Enhance secure coding Assistant System

Combining Design by Contract and Programming Logic to Enhanc...

引用

作者： Liang, Wenhui California State University Sacramento

学位级别：M.Sc., Master of Science

Code security or robustness has been an important topic in the recent decades for the research and software production communities. Defects in code can cause vulnerabilities in the program or system because it can be exploited by attackers. This project has enhanced secure coding Assistant system with Design by Contract and Programming Logic. The enhanced system can help programmers detect, locate, and eliminate code errors while coding. Java programmers using this enhanced system are suggested to provide their design contracts to three program structures (i.e., methods, if-then-else statements, and while-loop statements). Programmer-defined design contracts can be automatically generated and checked at the dynamic time of their program execution. Based on the inference rules of if-then-else statements and while-loop statements in the programming logic, the system can automatically generate sub-design contracts using programmer-defined design contracts. The system-generated sub-design contracts can also be automatically checked during run time to further help programmers detect and locate code errors. Furthermore, the weakest pre-conditions of certain sequences of assignments can be automatically generated from the post-conditions of the sequences based on the inference rule of the sequence statements and the assignment axiom in the programming logic. This helps programmers statically analyze the correctness of the relevant programmer-defined design contracts. With the enhancement presented, secure coding Assistant can help programmers for early detection of violations of secure coding rules and defects in Java code at the same time.

关键词： Software security Design by contract Programming logic secure coding

来源：评论

学校读者我要写书评

暂无评论

Discussion on the Reform of secure coding

引用

计算机教育 2022年第12期 43-48页

作者： Yi Ma Dongming Chen Dongqi Wang software college Northeastern UniversityShenyang110006China

secure coding is an indispensable part of the undergraduate training program for Information Security *** a basic course for undergraduates to carry out project engineering,its importance is *** the actual teaching activities,the program design courses have to be solved in terms of content update,practical ability improvement and scientific research project,so the curriculum reform is *** paper analyses the main problems existing in the secure coding course,explores the solution,proposes teaching methods,and gives the evaluation *** practice shows that the reform exploration can obtain good teaching results.

关键词： secure coding Case-based teaching method Modern teaching methods Evaluation methods

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：