Microsoft software security expert Michael Howard defines some heuristics for determining code
review in “A Process for Performing Security Code Reviews”. Which of the following heuristics
increase the application’s attack surface? Each correct answer represents a complete solution.
Choose all that apply.
A.
Code written in C/C++/assembly language
B.
Code listening on a globally accessible network interface
C.
Code that changes frequently
D.
Anonymously accessible code
E.
Code that runs by default
F.
Code that runs in elevated context
Explanation:
Microsoft software security expert Michael Howard defines the following heuristics
for determining code review in “A Process for Performing Security Code Reviews”: Old code:
Newer code provides better understanding of software security and has lesser number of
vulnerabilities. Older code must be checked deeply. Code that runs by default: It must have high
quality, and must be checked deeply than code that does not execute by default. Code that runs
by default increases the application’s attack surface.
Code that runs in elevated context: It must have higher quality. Code that runs in elevated
privileges must be checked deeply and increases the application’s attack surface. Anonymously
accessible code: It must be checked deeply than code that only authorized users and
administrators can access, and it increases the application’s attack surface. Code listening on a
globally accessible network interface: It must be checked deeply for security vulnerabilities and
increases the application’s attack surface. Code written in C/C++/assembly language: It is prone to
security vulnerabilities, for example, buffer overruns. Code with a history of security vulnerabilities:
It includes additional vulnerabilities except concerted efforts that are required for removing them.
Code that handles sensitive data: It must be checked deeply to ensure that data is protected from
unintentional disclosure. Complex code: It includes undiscovered errors because it is more difficult
to analyze complex code manually and programmatically. Code that changes frequently: It has
more security vulnerabilities than code that does not change frequently.