This post is a quick overview of an Abto Software blog article.
In a new report released in February 2024 by the White House, the government is urging software developers to ditch programming languages that cause buffer overflows and other memory-related vulnerabilities.
The document is exploring the prevailing cybersecurity measures and the potential danger they place on users. It emphasizes the need for shifting toward proactive cybersecurity strategies to eliminate some vulnerabilities rather than just patching known ones.
The administration has introduced the Executive Order 14028 along with the National Cybersecurity Strategy. These highlight the importance of redistributing the responsibility and long-term cybersecurity investments.
Quick overview
The document advises taking proactive steps to eradicate broad categories of existing security vulnerabilities. More specifically, it recommends that manufacturers publicly discuss Common Vulnerabilities and Exposures – CVEs data – and concentrate on Common Weakness Enumeration to facilitate the understanding of common security issues.
The paper also proposes adopting memory-safe programming languages to mitigate security vulnerabilities. What’s more, it explores other strategies, including adopting secure hardware and applying formal methods.
Memory safe programming languages
Approaching cybersecurity starts with the choice of the programming language – by utilizing modern features, software solutions inherently become more secure and reliable.
For already existing products, adopting so-called memory safe programming languages through strategically approaching modernization – initially rewriting high-risk components – might mitigate security vulnerabilities. This approach involves moving away from the use of languages like C and C++.
The adoption of reliable, memory safe programming languages is practical and even highly recommended. Advised options include C#, Rust, Java, JavaScript, Swift, and Ruby.
Formal methods
Formal methods that employ mathematical techniques to verify software security, are deemed highly reliable. The report outlines various formal methods, including sound static analysis, model checking, and so-called assertion-based testing, each providing distinct advantages in identifying software vulnerabilities.
Formal methods can be easily integrated into workflows to enable entirely automated security verification. What’s more, the incorporation of those helps eradicate security vulnerabilities and expedites the integration of technology while enhancing its safety and reliability.
Proactive cybersecurity
The shift from reactive to proactive security strategies requires much broader involvement from stakeholders. This includes not only the CISO (Chief Information Security Officer) but also the CIOs and CTOs.
This strategy proposes establishing more modern quality metrics to promote shared accountability across roles, focused around three dimensions: software development, comprehensive analysis and testing, and execution. While all three dimensions are pertinent to all three roles, the first two dimensions that relate to inherent software quality hold significance for CIOs and CTOs.
Security vulnerabilities associated with С/С++ applications
Buffer overflow
The most common problem, buffer overflow, can occur when programs write data beyond set buffer bounds. This vulnerability can be easily exploited to execute arbitrary code, overwrite data, or crash the application.
Integer overflow and underflow
Integer overflow and underflow mostly occurs when the integer value:
- Either exceeds the maximum representable value
- Or fails to meet the minimum representable value
This vulnerability might cause unexpected behavior, which includes memory corruption and breaches.
Injection attacks
Such attacks involve inserting malicious code into programs to execute unintended commands or actions, thereby allowing unauthorized access.
Pointer initialization
Improper initialization can cause use-after-free and double-free access, as well as uninitialized memory access, thereby allowing security breaches and leakage.
Is this the moment to ditch С/С++ applications?
A secure, risk-based approach towards refactoring
Migrating legacy C/C++ applications is commonly quite sophisticated and oftentimes economically unfeasible. Converting already outdated code comes with platform adaptation, dependency management, and other significant challenges, including potential security vulnerabilities.
Abto Software sees one possible solution in refactoring high-risk components.
This strategy is recommended in scenarios with the following conditions:
- The codebase contains components being susceptible to common security vulnerabilities
- The codebase is well-structured and modular, so isolating and refactoring high-risk components without impacting overall functionality is easier
- Full-scale migration requires resources being prohibitive or impractical
- Risk mitigation is the topmost priority, so refactoring is favored as the secure approach to addressing security vulnerabilities if compared to migration
Large-scale adoption of memory-safe programming languages
Migrating existing C/C++ applications typically requires notable resources and presents numerous challenges. But still, relying on outdated code might cause even more serious problems, from new security vulnerabilities to non-compliance with industry-specific regulatory standards.
Abto Software has the required expertise to help you out if you’re thinking about approaching migration.
When entering into projects with similar technical complexities, we prioritize:
- Feasibility assessment
- Risk management and planning
- Code conversion
- Code finalization
- Acceptance testing and improvement
- Quality assurance and deployment
Summing up
Abto Software empowers leaders moving towards embracing transformation by leveraging proven expertise. From in-depth legacy evaluation to planning, execution, validation, post-deployment maintenance, and support, our teams can cover it all.
To examine your legacy C/C++ programs and choose a strategy that suits your goals – contact us!
Top comments (0)