The objective of the survey is to assess an opportunity to raise international security level in the cyber space through enhancement of confidence in security of software systems activity. The basic investigation method comprises analysis of information security statistics from certified laboratories. The paper shows importance of software systems security within the international security system in the cyber space. We reached the conclusion that reduction of software systems vulnerability dramatically reduces a possibility to attempt cyberattacks, cause damage to infrastructural resources and, consequently, develop a cyber conflict. It is stressed that exclusive bans on the use of foreign software have limits due to design development of international integration and security in the cyber space. We offered two approaches to raise the level of software security: to raise maturity level of international development companies and to enhance efficiency of international technical regulation of software security. We demonstrated that introduction of the international management system in development of secure software may appreciably raise the level of software security due to a lower number of vulnerabilities and higher operability in correction thereof. We approached the conclusion that confidence in software is possible if access to the source code is provided. We offered recommendations as to enhancement of confidence in the international technical regulation process.
As known, in connection of bias of national assets and communications to the cyber space1, a number of countries adopted the cyber space concept as the fifth theatre of military 1 The authors use clear definitions accepted by international standardization societies which Russia joined such as ISO, IEC, ITU (including ISO/IEC 27032).
It is to be stressed that in general a cyber conflict has a few phases including:
- Identification of vulnerabilities and assessment of an opportunity to exploit them in order to undertake cyberattacks for various purposes;
- Detection of and response to incidents relating, as usual, to cyberattacks to be undertaken; - Response to successful cyberattacks.
The last two phases mostly pertain to situation and crisis
management, on which attention has been mostly focused in
recent international talks and moves concerning international
security of the cyber space [
The paper contains an overview of international aspects of software security enhancement within the framework of the problem relating the international cyber space security.
In discussions of security software people usually mean that
such software has been developed with measures taken to reduce
the number of vulnerabilities and promptly remove them should
they occur [
We would like to stress two international security factors
pertaining to software security [
1. Critical structural sophistication of software gives rise to
the man-induced risk (e.g. [
2. Application of information and communication technologies has widened the range of intentional threats, in particular, to the extent of remote (including hidden and nonprovable) attacks and threats to very-large-scale data compromise.
Now we would like to draw special attention to the critical structural sophistication of software when the length of the original text using a high-level language, for instance the operating system with applications, may reach 5-20 GB. Hence, the number of logical operators (application software graph nodes) may amount to some ten millions, which goes far beyond human programmer’s cognitive abilities or a tester. This being the case, there are a lot of examples when an error in coding or design (i.e. vulnerability is not identified as intentional) caused disasters and critical damage2.
As to the second factor, it is enough to emphasize that the overwhelming majority of present-day attacks are based on the use of vulnerabilities, in which case an attacker needs to find only one vulnerability in software to realize the threat that corresponds to such vulnerability.
Stressing the origin of factors in the information security theory (defect, vulnerability, threat, risk) we may assert that detection and repair of vulnerabilities prevent the corresponding incident (damage, attack) (Fig. 1).
Methods for enhancement of system security oriented to
software vulnerabilities and defects are a priori by nature and,
hence, have a number of advantages over the reactive methods
[
As known, present-day formal methods for software analysis and testing, except the expert methods, fall into the “curse of dimensionality” zone. Hence, though programmers take active actions, the number of vulnerability does not drop (Fig. 3) and it is easy to prove that the number of computer attacks, including purpose-oriented (using zero-day vulnerabilities) attacks, so does the total damage caused by them. By the way, to date the volume of the open international vulnerability base Mitre CVE exceeds 100,000 vulnerabilities while the volume of the Russian base (Vulnerability Database of the Federal Service for Technical and Export Control) oriented to the domestic market is above 20,000 vulnerabilities.
In view of growth in attacks based on vulnerabilities, we may
stress two phenomena: on the one hand, the black market of
zero-day vulnerabilities is flourishing [
In view of the above, instead of closing the ranks to raise confidence in software security the world community tends to abandon the problem and imposes various bans. This can be illustrated by the following: – Europe is facing a contradiction between requirements for collaborative certification (based on cPP) and requirements set by the European Union or individual countries;
– The USA introduced restriction on the use of the software certified in China and Russia while China and Russia take asymmetric measures;
– A number of countries clearly pursue the import substitution policy, maintain blacklists of vendors of foreign products or impose restrictions on the use of foreign products etc.
Unfortunately, this policy is not constructive in terms of
enhancement of international integration and security. For
instance, it is in conflict with consolidation of countries to
counteract illegitimate activity of third parties, first of all,
criminal hacker community (e.g. [
As a result, we evidence the compromise of the international technical and legal regulation system of information and cyber security.
III. SOFTWARE SECURITY ENHANCEMENT APPROACHES As mentioned above, one of the ways to raise the international security level and ensure strategic stability is to enhance confidence in security of software systems, in particular, by closing the ranks of the international community to reduce degree of software vulnerability.
Nowadays, the approaches to enhancement of confidence in security of software systems seem to be as follows: 1. To increase maturity of international software developing companies;
2. To raise the level of the international technical regulation and evaluation of compliance in the form of mandatory software certification providing access to the source code (at the test stage).
COMPANIES
It is recognized that the main cause of software vulnerability is
low-level maturity of developing companies which neglect
security practices relating to software design, engineering,
manufacture, introduction, supply, and maintenance. For
instance, we acquired statistics proving that the management (or
maturity3) level in a company produces an appreciable effect on
the security level of developed, manufactured and supplied
software, in particular, the degree of absence of vulnerabilities
and opportunity to promptly repair them if they are discovered.
For example, studies undertaken by the NPO Echelon
Moscow-based test laboratory proved strict inverse
proportionality of the total amount of vulnerabilities to maturity
levels in the software developing company (Fig. 4) [
Besides the point, according to Microsoft, the amount of
software vulnerabilities dropped by more than 80% due to the
3 According to COBIT. URL: https://cobitonline.isaca.org/
introduction of the respective management sub-system
(Microsoft Secure Software Development Life Cycle) [
Though today a number of international and national
organizations are concerned over the problem to raise efficiency
of security development management, studies are fragmentary
in nature or are reduced to good practices of the software
developing companies. For instance, bibliographical sources
describe in detail the supply chain threats [
It is noteworthy that one of the first international companies of which information security management sub-system has been certified according to GOST R 56939 is Kaspersky Lab international company which in an unreciprocated manner offered its source code to the USA secret services4.
At present, the certification procedure in accordance with information security requirements implies the use of various testing methods and techniques, because errors and vulnerabilities are of different nature and have characteristic symptoms.
At the same time, we may assert that conceptual and
methodical framework for software testing in accordance with
information security requirements is developed and is at the
respective level of iterative development [
Though software is tested using a great many methods and
techniques, we think that it is impossible to attain an acceptable
level of confidence in software if the access to source code is not
provided. It may be clearly illustrated using floating errors and
software bugs which are initiated by rather rare combinations of
input data, i.e. they may not be found by means of a “black box”
test method, for instance fuzz testing. In other words, only access
to source code provides a probability to detect any vulnerability
using expert knowledge. Fig. 6 gives statistics of efficiency of
basic software security analysis methods [
Such clean room in the client’s premises (under control of the client’s security guards) serves for the access (in isolated safe environment) to the source software code, namely, for the period of tests. Software set-up and necessary checks are undertaken within the framework of the said access. Certainly, any information medium may not be taken away or a communication session may not be initiated etc. without approval by the client’s security service. Documented evidence of checks and conclusions are to be discussed and approved by the client. The above approach has a number of advantages and warranties (Fig. 7), in particular:
– Enhances software security due to cooperation between developers and technicians of the certified test laboratory; – Allows revealed vulnerabilities to be mandatorily repaired within the certification framework while the relevant information will remain unknown to any third party; – Make inspections transparent with all actions (provision of access, work monitoring and control, discussion of performance, compiling the reports etc.) being technically and legally ensured by the client’s security service;
– Gives rise to confidence in the software product, since there is always probability to reveal a potentially dangerous code (or demonstrate the absence of), what both certification parties are interested in.
Unfortunately, at present an access to the source code is the most disputable aspect. Often, officials or journalists, who are far from understanding programming, easily speculate on this topic. In business the major threat recognized by developing 4 https://www.reuters.com/article/us-usa-security-kaspersky-russia/kasperskylab-to-open-software-to-review-says-nothing-to-hide-idUSKBN1CS0Y1
The above approach was approved in many countries and to date no one compromise case is known. It should be noted that aspects pertaining to the provision of access to source codes that need to undertake tests are understandable by many software developing companies. It is clearly illustrated by the provision of access to Microsoft product codes in more than 30 countries5. 5 https://blogs.microsoft.com/eupolicy/transparency-center/
This survey makes it possible to reach the conclusion concerning importance of software security on the global scale.
We believe that there are two most promising trends in enhancement of software security on the global scale, namely: 1. Convergence investigations of the best practices in technical regulation on the condition that access is given to the source codes at the test stage;
2. Investigations in management of information and cyber security undertaken by software developing companies and vendors of software systems.