Preventive File Analysis measure (Harden)

[ioggstream]

I expect

• a preventive File Analysis technique under Harden
• we need to identify the relations between Subroutine, SourceFile and Library

Notes

Since SoftwareUpdate < PlatformHardening it might not apply to SDLC.

Specific techniques based on preventive file analysis:

1. HardcodedCredentialElimination: the elimination from code of credentials CWE-798 and security relevant constants CWE-547

I want to Harden an Application and SourceCode via HardcodedCredentialElimination

2. SensitiveInformationElimination: the elimination of sensitive information before storage or transfer (e.g. on a repo) CWE-212. This applies to SourceCode, File, ...

3.DeadCodeElimination: see CWE-561. DC < CWE-1164 < CWE-710 <

4. ContractFirstDesign: see CWE-1068 < CWE-710 Ensures that WebServerApplication have a consistent design

   I want to Harden WebServerApplication using ContractFirstDesign

5. ImageCodeSegmentVerification: see CWE-1357 Reliance on uncontrolled components built externally (e.g. jar files

I want to Harden an ImageCodeSegment using ImageCodeSegmentVerification

Other CWE

CWE-1078 Inappropriate codestyle includes various elements, but I don't know how to categorize it. Dead code elimination (aka CWE-561)[https://cwe.mitre.org/data/definitions/561.html] is probably related e.g. to cwe-710

[netfl0]

Yes, we'd call this something like Application Hardening (for the application binaries/distributed software)

We need a new section called Source Code Hardening (for the source code - still in control of developer)

CC @hack-sentinel

[netfl0]

closing, tracking on #193