Using exploit patterns to develop secure software

Abstract

Building secure software becomes more and more challenging every day because of the increasing size, complexity of products and the increasing number and skills of the attackers. To develop secure software, the developer must ensure that every possible and potential vulnerability has been protected as it takes only a small unprotected vulnerability for the attacker to bring a system to its knees. To be effective, the developers must have a firm grasp of the attacker’s perspective and his methodologies and resources. Repositories like CERT, MITRE, BSI etc which record and analyze the exploit incidents and provide services like vulnerability databases are an excellent aid for the developers. This paper introduces exploit patterns and discusses their use as an important method of empowering developers to develop secure software. The exploit patterns can bring considerable value for software security considerations through all phases of SDLC.