Case Project 7-1: Determining Software Engineering Risks for Alexander Rocco Aft

Question

Case Project 7-1: Determining Software Engineering Risks for Alexander Rocco After reviewing all the applications Alexander Rocco uses, you notice that many have been modified or changed during the past couple of months. Two of the company's financial applications are written in C and , according to Randy Stegner, the IT security administrator, monitor the company's accounts and financial data.Mr.Stegner discovered that several modifications weremade to one program, with no documentation indicating who made the changes or why. Based on this information, write a memo to Mr. Stegner with your findings and any recommendations you might havefor improving the security of the company's software engineering practices. Search the internet for any information on securing company software. Does the OSSTMM address any of these issues? What improvements would you recommend to better protect this information?

Explanation / Answer

Following steps can be taken to enhance software system security in an enterprise

1. Separation of duties: We should divide the duties among different teams and they should be as mutually exclusive as possible. So that whenever there is such unnoticed or unannounced change in the software, we can see that which area of the code is modified and thus we know that which particular team is to be questioned. This narrows down our search.

2. Security awareness training: Application users should be trained about the best practises, in order to guarantee the on-going security of the application. Training can be in the form of an educative email to the users or an outright training program with a technical facilitator.

3. User authentication: Passwords, tokens and biometrics are some authentication tools that can be deployed to improve the security of software applications. This way we can guarantee that only authentic user can log into our system.

4. Audit trails: This means that whenever any user does any activity on the application, it should be recorded somewhere. So this way whenever a user makes any change in the code or does any other activity, we will havee the Date and Time of that activity and also the information about who had made that change. Every organization should comply to this requirement.

Related Questions

Navigate

• Browse (All)
• Browse C
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.