2.3 Producing Robust Programs

2.3 Producing Robust Programs

1. Defensive Design

   • Defensive design is an approach to software development that aims to produce robust and reliable programs by: Anticipating misuse of the program and planning for things that could go wrong, Writing maintainable code that helps other diagnose problems if they arise, Testing the program with suitable test data to identify and fix errors before it is put into general use. Adopting a defensive design approach can help prevent bugs in programs from causing unwanted consequences, such as deleting important data or being exploited by cybercriminals to take over (hijack) the host machine.

2. Robust vs. Reliable Programs

   • Robust programs can handle unexpected inputs and data without crashing and without being tricked into malicious action. Reliable programs will work as intended under many different conditions or situations. We can confirm that programs are both robust and reliable through well-planned testing.

3. Anticipating Misuse

   • There are a number of ways that a system could be misused that a developer should consider: Malicious inputs could be used in an attempt to hijack a system - input sanitisation and validation helps to protect against this. An attempt to remotely connect to the system through remote-access systems (such as SSH). Using a firewall to prevent access from outsiders will help with this. Attempting to use lower-level access rights to gain access to sensitive information. User authentication should be used to combat against this. Brute-force attacks to gain access via passwords or PIN numbers - enforcing a maximum failed attempts policy will help protect against this.

4. Input sanitisation and validation

   • One of the biggest causes of error when running a program is users or other systems providing unexpected data. There are two ways to help prevent this from causing errors: Input sanitisation - 'cleansing' input data by removing malicious characters or special command before passing it on to be processed by the program; Input validation - checking that the input data meets certain criteria (length, format, range, etc) before being passed on for further processing. Input sanitisation and validation are often used together to form an effective barrier against anticipated misuse of a system.
   • Input sanitation involves the removal of unwanted characters from input data. This is a chief line of defence against SQL injection, where the characters ', ", ;, = and - can all be used to manipulate the SQL query being processed by the webserver. Any data entered by users that becomes part of an SQL query (e.g. their username and password, credit card details or address) should undergo sanitisation to ensure these characters are removed.
   • Input validation is the process of checking that input data meets certain criteria before allowing it to be accepting by the program. ■ If a user's input is rejected for being invalid they should be informed and asked to enter it again, ideally with some guidance on what criteria their input must meet. The are a number of different validation checks that can be made including a format check, range check, presence check, type check and length check. A classic example of a validation check is online services setting criteria for user passwords such as a minimum length or number of special characters or requiring that certain data is included within an online form.

5. Types of validation check

   • Type check - Tests the type of the data entered, for example whether it is integer, float (real), Boolean or string data.
   • Range check - Tests that the data falls within a permitted range. For numeric data, this might be "greater than or equal to 1 and less than or equal to 100". For string data this could be a range of permitted input options such as the a letter that corresponds to a menu option or "Y" or "N" at a "yes/no" prompt.
   • Presence check - Checks whether required data is present or not. This is often used on online forms to check for essential information such as a customer's credit card expiration date.
   • Format check Tests the data to check that it meets a set format. For example, if the input field was a customer's email address then a check would be made to ensure that it contained and @ symbol and at least one full stop (though not as the first or last character).
   • Length check Tests that the number of characters entered is within a permitted range. Password validation often uses this to ensure that customer passwords are at least X characters long.

6. Authentication

   • Authentication is the process of checking or confirming that a particular person or system (if accessing via an API) is authorised (permitted) to use a system and, if so, which parts of that system they can use.
   • The most common form of authentication is to require that users enter a username and password when logging into a system.
   • Once a user has logged into a system they should be able to see data relevant to themselves and no one else.
   • Modern systems might implement other authentication methods other than a username and password such as fingerprint scanning or facial recognition. These are potentially more secure than a username/password combination and result in less user error (you cannot forget your fingerprint!).

7. Planning for contingencies