Security plays a large role in software development;simply without its existence the software would be vulnerable to many different types of attacks. Software security prevents leaks of data, alternation of data, and ...Security plays a large role in software development;simply without its existence the software would be vulnerable to many different types of attacks. Software security prevents leaks of data, alternation of data, and unauthorized access to data. Building a secure software involves a number of different processes but security awareness and implementation are the most important ones among them. To produce high quality software security engineers need to meet today’s cybersecurity demands, security awareness and implementation must be integrated in undergraduate computer science programming courses. In this paper, we demonstrate the importance of adopting security guidelines in undergraduate software engineering education. Thus, this paper focuses on integrating secure guidelines into existing applications to eliminate common security vulnerabilities. An assessment table, derived from several existing Java security guidelines, is developed to provide in depth critiques of the selected capstone project. Potential security vulnerabilities in the capstone project are identified and presented in a form showing the degree of threats against the three security characteristics: confidentiality, integrity, and availability addressed in the McCumber Cube model. Meanwhile, vulnerability density of the capstone project is calculated to demonstrate the performance of this research.展开更多
This research aims to propose a practical framework designed for the automatic analysis of a product’s comprehensive functionality and security vulnerabilities,generating applicable guidelines based on real-world sof...This research aims to propose a practical framework designed for the automatic analysis of a product’s comprehensive functionality and security vulnerabilities,generating applicable guidelines based on real-world software.The existing analysis of software security vulnerabilities often focuses on specific features or modules.This partial and arbitrary analysis of the security vulnerabilities makes it challenging to comprehend the overall security vulnerabilities of the software.The key novelty lies in overcoming the constraints of partial approaches.The proposed framework utilizes data from various sources to create a comprehensive functionality profile,facilitating the derivation of real-world security guidelines.Security guidelines are dynamically generated by associating functional security vulnerabilities with the latest Common Vulnerabilities and Exposure(CVE)and Common Vulnerability Scoring System(CVSS)scores,resulting in automated guidelines tailored to each product.These guidelines are not only practical but also applicable in real-world software,allowing for prioritized security responses.The proposed framework is applied to virtual private network(VPN)software,wherein a validated Level 2 data flow diagram is generated using the Spoofing,Tampering,Repudiation,Information Disclosure,Denial of Service,and Elevation of privilege(STRIDE)technique with references to various papers and examples from related software.The analysis resulted in the identification of a total of 121 vulnerabilities.The successful implementation and validation demonstrate the framework’s efficacy in generating customized guidelines for entire systems,subsystems,and selected modules.展开更多
博物馆安全是博物馆工作的重中之重,博物馆的安全为保障博物馆正常运转发挥重要作用。自2019年新冠肺炎疫情暴发以来,博物馆面临的安全形势十分严峻,主要表现为应急措施匮乏、灾害防范不到位以及管理体制不完善等问题。这给全球博物馆...博物馆安全是博物馆工作的重中之重,博物馆的安全为保障博物馆正常运转发挥重要作用。自2019年新冠肺炎疫情暴发以来,博物馆面临的安全形势十分严峻,主要表现为应急措施匮乏、灾害防范不到位以及管理体制不完善等问题。这给全球博物馆的发展带来了新的安全挑战,为博物馆安全提出了更高的要求,如何预防与应对博物馆突发事件成为博物馆安全的重要任务。该文选取了一篇国际博物馆协会官方发布的国际通用手册Guidelines for Disaster Preparedness in Museums为研究对象,从词汇、句法及篇章三个方面分析博物馆手册类文本的特点,归纳三种翻译策略,以期促进我国博物馆健康发展,为博物馆手册文本的翻译研究贡献绵薄之力。展开更多
基于真实环境的MS Office计算机化考试提升了考试的友好性,但也带来基于文件复制或内容复制的考试作弊安全隐患,需要研究新方法对此类作弊进行检测。通过分析Office Open XML文档部件中的相关参数,提出复制类作弊的检测方法,并以全国计...基于真实环境的MS Office计算机化考试提升了考试的友好性,但也带来基于文件复制或内容复制的考试作弊安全隐患,需要研究新方法对此类作弊进行检测。通过分析Office Open XML文档部件中的相关参数,提出复制类作弊的检测方法,并以全国计算机等级考试的Word试题为例进行检验。研究结果表明,该方法能直接、有效地判断基于文件复制的作弊,对大部分基于内容复制的作弊也能进行有效判断,但也存在个别无法判断的情况,需要结合其他参数综合分析。展开更多
文摘Security plays a large role in software development;simply without its existence the software would be vulnerable to many different types of attacks. Software security prevents leaks of data, alternation of data, and unauthorized access to data. Building a secure software involves a number of different processes but security awareness and implementation are the most important ones among them. To produce high quality software security engineers need to meet today’s cybersecurity demands, security awareness and implementation must be integrated in undergraduate computer science programming courses. In this paper, we demonstrate the importance of adopting security guidelines in undergraduate software engineering education. Thus, this paper focuses on integrating secure guidelines into existing applications to eliminate common security vulnerabilities. An assessment table, derived from several existing Java security guidelines, is developed to provide in depth critiques of the selected capstone project. Potential security vulnerabilities in the capstone project are identified and presented in a form showing the degree of threats against the three security characteristics: confidentiality, integrity, and availability addressed in the McCumber Cube model. Meanwhile, vulnerability density of the capstone project is calculated to demonstrate the performance of this research.
基金This work is the result of commissioned research project supported by the Affiliated Institute of ETRI(2022-086)received by Junho AhnThis research was supported by the National Research Foundation of Korea(NRF)Basic Science Research Program funded by the Ministry of Education(No.2020R1A6A1A03040583)this work was supported by Korea Institute for Advancement of Technology(KIAT)Grant funded by the Korea government(MOTIE)(P0008691,HRD Program for Industrial Innovation).
文摘This research aims to propose a practical framework designed for the automatic analysis of a product’s comprehensive functionality and security vulnerabilities,generating applicable guidelines based on real-world software.The existing analysis of software security vulnerabilities often focuses on specific features or modules.This partial and arbitrary analysis of the security vulnerabilities makes it challenging to comprehend the overall security vulnerabilities of the software.The key novelty lies in overcoming the constraints of partial approaches.The proposed framework utilizes data from various sources to create a comprehensive functionality profile,facilitating the derivation of real-world security guidelines.Security guidelines are dynamically generated by associating functional security vulnerabilities with the latest Common Vulnerabilities and Exposure(CVE)and Common Vulnerability Scoring System(CVSS)scores,resulting in automated guidelines tailored to each product.These guidelines are not only practical but also applicable in real-world software,allowing for prioritized security responses.The proposed framework is applied to virtual private network(VPN)software,wherein a validated Level 2 data flow diagram is generated using the Spoofing,Tampering,Repudiation,Information Disclosure,Denial of Service,and Elevation of privilege(STRIDE)technique with references to various papers and examples from related software.The analysis resulted in the identification of a total of 121 vulnerabilities.The successful implementation and validation demonstrate the framework’s efficacy in generating customized guidelines for entire systems,subsystems,and selected modules.
文摘博物馆安全是博物馆工作的重中之重,博物馆的安全为保障博物馆正常运转发挥重要作用。自2019年新冠肺炎疫情暴发以来,博物馆面临的安全形势十分严峻,主要表现为应急措施匮乏、灾害防范不到位以及管理体制不完善等问题。这给全球博物馆的发展带来了新的安全挑战,为博物馆安全提出了更高的要求,如何预防与应对博物馆突发事件成为博物馆安全的重要任务。该文选取了一篇国际博物馆协会官方发布的国际通用手册Guidelines for Disaster Preparedness in Museums为研究对象,从词汇、句法及篇章三个方面分析博物馆手册类文本的特点,归纳三种翻译策略,以期促进我国博物馆健康发展,为博物馆手册文本的翻译研究贡献绵薄之力。
文摘基于真实环境的MS Office计算机化考试提升了考试的友好性,但也带来基于文件复制或内容复制的考试作弊安全隐患,需要研究新方法对此类作弊进行检测。通过分析Office Open XML文档部件中的相关参数,提出复制类作弊的检测方法,并以全国计算机等级考试的Word试题为例进行检验。研究结果表明,该方法能直接、有效地判断基于文件复制的作弊,对大部分基于内容复制的作弊也能进行有效判断,但也存在个别无法判断的情况,需要结合其他参数综合分析。
