A security feature framework for programming languages to minimize application layer vulnerabilities. Issue 1 (7th November 2019)

• Record Type: Journal Article
• Authors: Khwaja, Amir A.; Murtaza, Muniba; Ahmed, Hafiz F.
• Is Part Of: Security and privacy. Volume 3:Issue 1(2020)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2019-11-07
• Subjects: programming languages -- security evaluation of programming languages -- security features -- security framework; Computer security -- Periodicals; Data protection -- Periodicals; Cyberterrorism -- Periodicals; 005.8
• DOI: 10.1002/spy2.95
• Languages: English
• ISSNs: 2475-6725

Abstract

Abstract: Pervasiveness of Internet‐based applications and computing devices has increased cybersecurity threats for wide range of users. Studies have shown that application security flaws have their roots in programming languages used for application development. Some vulnerabilities are due to programmer's negligence and others are due to the vulnerabilities present in the programming languages and their libraries. Developers may not be aware of the existing flaws in the programming languages and do not have time to take necessary measures as they develop applications. To cope with the challenge, this article proposes a security feature framework for programming languages to understand various exploitations and possible mitigations in programming languages. This security feature framework can be used to evaluate existing programming languages for potential vulnerabilities, level of security support, and the language features needed to mitigate these vulnerabilities. Moreover, language designers may use this framework as a guide to ensure that the language being designed has necessary and sufficient security feature set. The proposed security feature framework is then applied to several popular programming languages to evaluate the level of security feature coverage and gaps in these languages along with some recommendations on how to address these gaps.