Question

As a Security Software Architect, you will need to be able to identify components of modern software architecture - libraries (native and third-party) external objects, Remote Procedure Call (RPC), Remote Method Invocation (RMI), Application Program Interface (API), plug-ins, frameworks, (e.g. NET), interfaces (e.g. CSS), scripts, drivers (signed and unsigned), digital signatures, etc.

You are to discuss Insecure External Software Components that may be the target of threat actors. In particular, explore Application program interface (API), device drivers, and Dynamic link library (DLL), as mentioned above and how these components can be exploited.

Answer 1

Security Software Architects must safeguard systems against vulnerabilities in external software components such as APIs, device drivers, and DLLs to prevent potential exploits by threat actors.

Step-by-step explanation:

Insecure External Software Components

In the realm of software architecture, a Security Software Architect needs to identify and mitigate risks associated with external software components such as Application Program Interfaces (APIs), device drivers, and Dynamic Link Libraries (DLLs). Insecure external components can lead to vulnerabilities that threat actors could exploit.

APIs

APIs are critical for modern software interaction but can expose systems to risks if not properly secured. Insecure API implementation might result in data breaches or unauthorised data access. These components require strong authentication, encryption, and access control mechanisms to prevent exploitation.

Device Drivers

Device drivers, especially those that are unsigned, can be targets for malicious attacks. This is because they operate at a low level within the operating system, and a compromised driver can lead to system instability, data theft, or full system control by an attacker. Ensuring that drivers are signed and verifying their integrity is crucial.

Dynamic Link Libraries (DLLs)

DLLs are essential for code reuse and system modularisation, yet they can also be a point of entry for security exploits like DLL injection attacks. Such attacks modify the behaviour of a program by loading an external, malicious DLL. Protection against these attacks includes using safe library loading practices and validating the authenticity of DLLs.