Authors:
Azzam Mourad
;
Marc-André Laverdière
and
Mourad Debbabi
Affiliation:
Computer Security Laboratory, Concordia Institute for Information Systems Engineering, Concordia University, Canada
Keyword(s):
Software Security Hardening, Aspect-Oriented Programming (AOP), Security Hardening Patterns, Security Hardening Plans, Trusted and Open Source Software (FOSS), Aspect-Oriented Language.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Secure Software Development Methodologies
;
Security Engineering
;
Security in Information Systems
;
Security Information Systems Architecture and Design and Security Patterns
Abstract:
In this paper, we propose an aspect-oriented language, called SHL (Security Hardening Language), for specifying systematically the security hardening solutions. This language constitutes our new achievement towards developing our security hardening framework. SHL allows the description and specification of security hardening plans and patterns that are used to harden systematically security into the code. It is a minimalist language built on top of the current aspect-oriented technologies that are based on advice-poincut model and can also be used in conjunction with them. The primary contribution of this approach is providing the security architects with the capabilities to perform security hardening of software by applying well-defined solution and without the need to have expertise in the security solution domain. At the same time, the security hardening is applied in an organized and systematic way in order not to alter the original functionalities of the software. We explore the
viability and relevance of our proposition by applying it into a case study and presenting the experimental results of securing the connections of open source software.
(More)