Security bug
From Wikipedia, the free encyclopedia
 |
This article does not cite any references or sources. (February 2008) Please help improve this article by adding citations to reliable sources. Unverifiable material may be challenged and removed. |
A security bug is a software bug that benefits someone other than intended beneficiaries in the intended ways.
Security bugs introduce security vulnerabilities by compromising one or more of:
- Authentication of users and other entities
- Authorization of access rights and privileges
- Data confidentiality
- Data integrity
Security bugs need not be identified, surfaced nor exploited to qualify as such. Some exploited ones, particularly viruses, have been known to wreak global damage at massive cost.
[edit] Causes
Security bugs, like all other software bugs, stem from root causes that can generally be traced to either absent or inadequate:
- Software developer training
- Use case analysis
- Software engineering methodology
- Quality assurance testing
- ...and other best practices
[edit] Taxonomy
Security bugs generally fall into a fairly small number of broad categories that include:
- Memory safety (e.g. buffer overflow and dangling pointer bugs)
- Race condition
- Secure input and output handling
- Faulty use of an API
- Improper use case handling
- Improper exception handling
