Computer viruses

An organized record of actual flaws can be useful to computer system designers, programmers, analysts, administrators, and users. This survey provides a taxonomy for computer program security flaws, with an Appendix that documents 50 actual security flaws. These flaws have all been described previously in the open literature, but in widely separated places. For those new to the field of computer security, they provide a good introduction to the characteristics of security flaws and how they can arise. Because these flaws were not randomly selected from a valid statistical sample of such flaws, we make no strong claims concerning the likely distribution of actual security flaws within the taxonomy. However, this method of organizing security flaw data can help those who have custody of more representative samples to organize them and to focus their efforts to remove and, eventually, to prevent the introduction of security flaws.

/pdf/a-taxonomy-of-computer-program-security-flaws-3raehtso3t.pdf

A taxonomy of computer program security flaws

From the Publisher:
Classical and Object-Oriented Software Engineering is designed for an introductory software engineering course. This book provides an excellent introduction to software engineering fundamentals,covering both traditional and object-oriented techniques. 
Schach's unique organization and style makes it excellent for use in a classroom setting. It presents the underlying software engineering theory in Part I and follows it up with the more practical life-cycle material in Part II. Many software engineering books are more like reference books,which do not provide the appropriate fundamentals before inundating students with implementation details. 
In this edition,more practical material has been added to help students understand how to use what they are learning. This has been done through the use of "How To" boxes and greater implementation detail in the case study. Additionally,the new edition contains the references to the most current literature and includes an overview of extreme programmming. 
The website in this edition will be more extensive. It will include Solutions,PowerPoints that incorporate lecture notes,newly developed self-quiz questions,and source code for the term project and case study.

https://ndl.ethernet.edu.et/bitstream/123456789/27192/1/Stephen%20R.%20Schach.pdf

Object-oriented and classical software engineering

machines, 178, 179 Abstract model, 30, 31–32, 105–30. See also Security models Access class, 52, 112 dominates relationship between, 53, 122, 183-84 partial ordering of, 53, 122 SYSTEM HIGH/SYSTEM LOW, 123, 148 Access control, 22–23, 45–46. See also Multilevel security discretionary, 45, 47–50 input/output, 96–102 limiting Trojan horses with, 63–64 mandatory, 45, 50–51 with memory management, 83–86 network, 213–15 Access control list (ACL), 49–50 Access list, 48 Access matrix model, 109, 110 Bell and La Padula model, 123 ACF2 (software), 9 ACL. See Access control list (ACL) Address. See Virtual address space Adleman, L., 202 AFFIRM, 167, 168 Akers, R. L., 167 Algebraic specifications, 168 Algorithmic refinement, 178–81 Ames, S. R., Jr., 28, 131 Anderson, J. P., 131 Application mode, 27 Applications programs, 25, 26 Argument validation, 153 Arpanet Reference Model, 196 Ashland, R. E., 9, 51 Assertions, entry and exit, 190–92 Assurance, security control, 31 Asynchronous attack, 153–54 Atomic functions, 115 Authentication. See also Password(s) vs. identification, 18–19, 45–46 provided by encryption, 208 Authentication server, 221 Authorization, 22 Authorization server, 221

Building a Secure Computer System

An astronomer-turned-sleuth traces a German trespasser on our military networks, who slipped through operating system security holes and browsed through sensitive databases. Was it espionage?

Stalking the wily hacker

For more than a decade, government, industry, and academic centers have investigated techniques for developing computer systems that can be trusted to enforce military security rules. A good deal has been learned about the problem, and a number of approaches have been explored. But what useful advice can be given to those about to embark on a system development? If the application requires a trusted system, how should the developer proceed? The purpose of this article is to summarize past experience and to guide developers.

Landwehr

Papers

The Best Available Technologies for Computer Security