Software Security and Professional Ethics
Domain 8 combines secure design with professional conduct. Expect scenario questions: identify the vulnerability class and fix, or decide what a code of ethics requires when an employer instruction conflicts with public safety.
Security fundamentals
Core model is confidentiality, integrity and availability. Authentication establishes who a principal is; authorization decides what it may do. Recurring principles: least privilege, separation of duties, defense in depth, fail-safe defaults, complete mediation, minimize attack surface, and never trust client input. Threat modeling with STRIDE covers spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
Common defect classes: injection from building queries by string concatenation, fixed with parameterized queries; cross-site scripting, fixed with contextual output encoding plus a content security policy; cross-site request forgery, fixed with anti-CSRF tokens and SameSite cookies; broken access control and insecure direct object references, fixed by server-side authorization on every object; secrets in source; vulnerable third-party dependencies found with software composition analysis. Hashing is one-way and is not encryption, which is reversible; passwords are stored as salted slow hashes such as bcrypt or Argon2, never encrypted or in plain text, and TLS protects data in transit.
Ethics and licensing
The ACM/IEEE-CS Software Engineering Code of Ethics orders obligations as public, client and employer, product, judgment, management, profession, colleagues, self; public safety takes precedence over an employer's convenience. Disclose conflicts of interest, state competence limits honestly, protect confidential data, respect intellectual property, and use responsible disclosure to vendors before publishing. Permissive licences (MIT, BSD, Apache-2.0) allow proprietary reuse, with Apache-2.0 adding an explicit patent grant; copyleft licences such as the GPL require distributed derivative works to carry the same terms.
Worked example
A login handler builds the query by concatenating user input into a SQL string. Reasoning: input alters query syntax, so it is injection, mapping to tampering or elevation of privilege in STRIDE. The fix is a parameterized query that binds input as data, plus server-side authorization, rate limiting and generic error messages to prevent account enumeration. Client-side validation alone is not a control because attackers bypass the browser. Add a regression test using the payload that closes the quote and appends an always-true condition, and record the change under configuration control.
Traps that cost marks
- Calling Base64 encoding or a hash encryption.
- Storing passwords with fast hashes or reversible encryption.
- Assuming HTTPS prevents injection or access control flaws.
- Treating obfuscated code as a security control.
- Believing a manager's instruction overrides public-safety duties in the code of ethics.