Security

Core Pillars A software product’s security posture depends on preserving three fundamental elements: confidentiality, integrity, and availability. The more ways these can be compromised, the weaker the overall security position becomes. Types of Weaknesses Two primary weakness categories exist: Architecture Flaws: Design decisions or missing coding standards. Example: allowing students to enter class identification codes themselves rather than verifying against actual student records. Coding Defects: Programming errors that create vulnerabilities. Example: missing authorization checks when group leaders attempt to remove members. ...

Availability represents the final pillar of information security, ensuring that “the data is available when the system says it will” with timeframes ranging from immediate access to several days, depending on system requirements. Multi-Layer Implementation Effective availability requires management across three layers: Network Layer: Controls request handling capacity through firewalls, load balancing, and network sizing. Distributed denial-of-service attacks deliberately overwhelm systems by flooding networks and servers with excessive requests. Server Layer: Optimizes processing power, memory, and disk allocation. Running only necessary processes allows servers to dedicate resources efficiently and minimizes security risks. ...

Integrity represents the second core principle of software security, focused on ensuring data trustworthiness through accuracy and completeness. Data Corruption Risks The article notes that “data can be corrupted due to system errors, unauthorized modification, and data tampering.” These risks apply across all application types, regardless of domain. Real-World Educational Platform Examples In learning systems, integrity failures could result in graded submissions using outdated versions or incorrect grade assignments. The concept of eventual consistency acknowledges that distributed systems experience propagation delays—similar to inter-bank transfers requiring processing time. ...

Confidentiality represents how systems manage user data and serves as a fundamental component of user trust. Organizations must clearly communicate data usage intentions and honor those commitments transparently. Core Principle The foundational concept is straightforward: “Information you provide should only be shared with others when you explicitly consent.” Implementation proves challenging, requiring systems to exclude user data from logs entirely and treat all information as private until the user grants sharing permission. ...