Tutorial: Principles and Practices of Secure Cryptographic Coding in Java

Ya Xiao, Miles Frantz, Sharmin Afrose, Sazzadur Rahaman, Danfeng Daphne Yao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Various software libraries and frameworks provide a variety of APIs to support secure coding. However, misusing these APIs can cost developers tremendous time and effort, introduce security vulnerabilities to software, and cause serious consequences like data leakage or Denial of Service (DoS) on servers. Our tutorial aims to educate people on the best practice of secure coding, the pitfalls that should be avoided, and the detection tools and fixing suggestions of insecure code.To increase the security awareness of developers and improve the quality of their software products, we propose a 90-minute tutorial to teach participants the principles and practices of Java secure coding, including the SSL/TLS and Spring Security configuration. In this tutorial, we will introduce the principles of using security APIs, analyze typical API misuse cases to explain the causes and effects. We will also introduce a tool that we recently developed to automatically detect API misuse in Java.There are five parts in our tutorial. To reveal the secure coding practice, we will first introduce the findings in our recent study on StackOverflow posts relevant to Java security. Second, we will discuss the recommended principles of API usage by security experts. Third, to correlate the principles with existing practice, we will discuss some API misuse examples for the SSL/TLS certificate verification, Spring Security authentication, etc. Fourth, we will ask participants to examine extra code examples and discuss the security property. Finally, We will give an overview of the available tools and resources, demonstrate a tool named CryptoGuard that we developed to automatically detect API misuse in Java. We will also help participants install and use CryptoGuard plugins on their own machines and ask them for trials.By actively involving participants in code discussion and tool trial, we aim to raise the security awareness among developers, improve their secure coding capabilities, and equip them with the tools they need for secure coding.

Original languageEnglish (US)
Title of host publicationProceedings - 2020 IEEE Secure Development, SecDev 2020
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages5-6
Number of pages2
ISBN (Electronic)9781728183886
DOIs
StatePublished - Sep 2020
Externally publishedYes
Event2020 IEEE Secure Development, SecDev 2020 - Virtual, Atlanta, United States
Duration: Sep 28 2020Sep 30 2020

Publication series

NameProceedings - 2020 IEEE Secure Development, SecDev 2020

Conference

Conference2020 IEEE Secure Development, SecDev 2020
Country/TerritoryUnited States
CityVirtual, Atlanta
Period9/28/209/30/20

Keywords

  • Cryptographic API misuses
  • Java secure coding
  • practices
  • principles

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Hardware and Architecture
  • Software
  • Information Systems and Management
  • Safety, Risk, Reliability and Quality

Fingerprint

Dive into the research topics of 'Tutorial: Principles and Practices of Secure Cryptographic Coding in Java'. Together they form a unique fingerprint.

Cite this