Secure applications without secure infrastructures

Authors:
Dieter Gollmann
Affiliations:
Hamburg University of Technology, Hamburg, Germany
Venue:
MMM-ACNS'10 Proceedings of the 5th international conference on Mathematical methods, models and architectures for computer network security
Year:
2010

Citing 5
Cited 0

Writing Secure Code

Writing Secure Code
Inside Java(TM) 2 Platform Security: Architecture, API Design, and Implementation

Inside Java(TM) 2 Platform Security: Architecture, API Design, and Implementation
Java Security: From HotJava to Netscape and Beyond

SP '96 Proceedings of the 1996 IEEE Symposium on Security and Privacy
Protecting browsers from dns rebinding attacks

Proceedings of the 14th ACM conference on Computer and communications security
SSL/TLS Session-Aware User Authentication

Computer

Quantified Score

Hi-index	0.00

Visualization

Abstract

The Internet (together with other communications systems) has become a critical infrastructure in industrialized societies. We will examine to which extent this infrastructure needs to be secured for applications to be deployed securely. We will give examples for application layer attacks that cannot be defended against at the infrastructure layer. Hence, deploying a secure infrastructure is not sufficient to protect critical applications. Conversely, we will give examples where an application can be protected without relying on security services provided by the infrastructure. Hence, deploying a secure infrastructure is not necessary to protect critical applications. We will argue that it is only essential for the computing infrastructure to protect its own execution integrity and for the communications infrastructure to offer availability.