1. Failure to protect stored data
Austin Woodruff
CSCE 548

2. Learning OBjectives Technical Overview of the Problem Examples
Detection Methods and Error Mitigation
Conclusion

3. Technical Overview
Comes from the idea that software designers will often worry about protecting data and information in transit more so than they will when it is on the disk. The reality is that the data spends more time on the disk than in transit.
To protect stored data the two big aspects to consider are having weak or missing access control mechanisms, and lousy or lacking data encryption.

4. Access Control on Stored Data
Windows: Access Control Lists (ACLs)
UNIX: Permission Model
Bad Practice

5. Encryption of Stored data
Don’t be lazy, do it!
Don’t do it lousy!

6. Related topics to help understanding
Information leakage
Race conditions
Use of weak password-based systems
Poor random numbers to generate encryption keys
Using the wrong cryptography

7. Examples SMS remote control program Cybration’s ICUII
Mozilla installer software

8. Detection Look for code that… Sets access controls
Creates an object without setting access controls
Writes configuration information into a shared area
Writes sensitive information into an area readable by low-priviledged users

9. Detection in code review

10. Mitigation Don’t be lousy in protection! Take it step by step
Encrypt! Encrypt! Encrypt!

11. Conclusion ACLs and permissions Encrypt! Integrate your defense! Apply
Analyze
Test and retest for weaknesses
Encrypt!
Integrate your defense!

12. Works Cited
"Common Weakness Enumeration." CWE - CWE-217: DEPRECATED: Failure to Protect Stored Data from Modification (2.9). N.p., n.d. Web. 26 July 2016.
Howard, Michael, David LeBlanc, and John Viega. 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them. New York: McGraw-Hill, Print.
"Common Vulnerabilities and Exposures." CVE - CVE N.p., n.d. Web. 26 July 2016.
"Common Vulnerabilities and Exposures." CVE - CVE N.p., n.d. Web. 26 July 2016.
"Common Vulnerabilities and Exposures." CVE - CVE N.p., n.d. Web. 26 July 2016.