请输入您要查询的百科知识:

 

词条 Anti-Subversion Software
释义

  1. References

Software subversion is the process of making software perform unintended actions either by tampering with program code or by altering behavior in another fashion. For example, code tampering could be used to change program code to load malicious rules or heuristics, SQL injection is a form of subversion for the purpose of data corruption or theft[1] and buffer overflows[2] are a form of subversion for the purpose of unauthorised access. These attacks are examples of computer hacking.

Anti-Subversion Software detects subversion and attempts to stop the effects of the hack. Software applications are vulnerable to the effects of subversion throughout their lifecycle from development to deployment, but particularly in operation and maintenance.[3]

Anti-subversion protection can be accomplished in both a static and dynamic manner:

  • Static anti-subversion is performed during the construction of the code. The code is statically tested and verified against various attack types by examining the program source code. Examples of static anti-subversion include security auditing, code verification, and fuzzing. Static anti-subversion is generally seen as a good coding practice, and is deemed necessary in some compliance regimes. However, static solutions cannot prevent all types of subversion attacks.
  • Dynamic anti-subversion is performed during code execution. The code is dynamically protected against subversion by continuously checking for unintended program behaviours. Examples of dynamic anti-subversion include application firewalls, security wrappers, and protection embedded in the software.[4]

Software applications running on desktops, corporate servers, mobile devices and embedded devices are all at risk from subversion.[5]

References

1. ^http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf
2. ^http://www.infosecisland.com/blogview/21004-On-Buffer-Overrun-Vulnerabilities-Exploits-and-Attacks.html
3. ^https://buildsecurityin.us-cert.gov/bsi/547-BSI.html
4. ^Metaforic
5. ^http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/reports/rpt_security_in_the_age_of_mobility.pdf

1 : Computer security software

随便看

 

开放百科全书收录14589846条英语、德语、日语等多语种百科知识,基本涵盖了大多数领域的百科知识,是一部内容自由、开放的电子版国际百科全书。

 

Copyright © 2023 OENC.NET All Rights Reserved
京ICP备2021023879号 更新时间:2024/11/12 23:45:04