programming-for-dummies

642
Secure Computing
The idea behind designing security into a program from the start is to anticipate
possible flaws and then design the program so those types of flaws can
never even appear. This is like designing banks with only one entrance to
limit the number of escape routes, and designing the lobby so anyone in the
bank can be seen at all times.
Because operating systems are the most common target for an attack, many
operating systems include a variety of defensive mechanisms. The most
common defense is to divide access to a computer into separate accounts.
This is like limiting bank tellers to just handling a certain amount of money
while only the bank president and a few other trusted people have actual
access to the bank’s vaults.
Such access control limits what people can do from within their specific
account on the computer. This reduces the chance of a catastrophic accident
wiping out data used by other people while also reducing the threat
from hackers at the same time. If a hacker breaks into an ordinary user
account, the hacker can’t cause too much damage, which is like a burglar
breaking into a garage but not being able to access the rest of the house.
Another common defense mechanism is data execution protection (DEP),
which protects against buffer overflow attacks. Trying to wipe out all possible
buffer overflow exploits may be impossible, so DEP simply tells the computer
never to run any commands found in its memory buffer. Now hackers
can flood the computer with all the malicious commands they want, but the
computer simply refuses to run any of those commands.
One way that hackers exploit programs is that they know programs behave
predictably by storing data in the same areas. So another defense mechanism
is address space layout randomization (ASLR). The idea behind ASLR is
to keep changing the address of its memory. If hackers or malware can’t reliably
predict where a program is storing specific data, they can’t insert their
own commands or programs into the computer to trick the computer into
running those commands instead.
Computer security is actually less about protecting the physical parts of a
computer and more about protecting the data stored on those computers. As
individual hackers have given way to organized criminals, untrustworthy government
agencies, and self-serving corporations, the field of computer security
is constantly growing and changing. If there’s one certainty in society, it’s
that crime will never go away, which means guaranteed opportunities for
anyone interested in protecting computers from the prying eyes of others.