Integrating types and specifications for secure software development

  • Authors:

  • Greg Morrisett

  • Affiliations:

  • Harvard University, Cambridge, Massachussetts

  • Venue:
  • MMM-ACNS'10 Proceedings of the 5th international conference on Mathematical methods, models and architectures for computer network security
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Today, the majority of security errors in software systems are due to implementation errors, as opposed to flaws in fundamental algorithms (e.g., cryptography). Type-safe languages, such as Java, help rule out a class of these errors, such as code-injection through buffer overruns. But attackers simply shift to implementation flaws above the level of the primitive operations of the language (e.g., SQL-injection attacks). Thus, next-generation languages need type systems that can express and enforce application-specific security policies.