ICT 2217Y: Foundations of Software Security

Core Security Principles and ObjectivesPage 1

Software security is a lifecycle discipline focused on ensuring software behaves as expected under misuse. It distinguishes itself from general information security by addressing how software design, implementation, and operations enforce security. Key foundational objectives are Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized or incorrect changes), and Availability (ensuring access for authorized users).

Foundational Vocabulary and TrustPage 15

Precision in terminology is vital: assets have value; threats identify what could go wrong; vulnerabilities are weaknesses; attacks are the exploitation of those weaknesses; and risks are the combination of likelihood and impact. Trust is the foundation of security, requiring explicit, limited, and verifiable decisions, as no system can be entirely self-built.

Secure Design PatternsPage 43

To reduce risk, designs should follow principles such as Least Privilege (granting only necessary authority), Secure Defaults (protected initial states), Defense in Depth (layering controls), Attack Surface Reduction (removing unnecessary interfaces), and Failing Securely (preserving security when errors occur).

Security Requirements EngineeringPage 1

Effective security requirements are specific, testable, and traceable. They go beyond 'functional' requirements by defining constraints such as who may access data and what happens during failures. Requirements should be derived from assets, misuse cases, and identified threats, acting as a bridge between high-level goals and technical controls.

Threat Modeling and ArchitecturePage 1

Threat modeling uses methods like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to systematically identify failures in design. Security architecture ensures that boundaries are enforced, privilege is separated, and internal interfaces are treated with the same skepticism as external ones.