Software can reside in a computer or be transferred from one computer to another. Files, data, emails, recorded voice, recorded videos, programs, and applications are on the computer. While in the computer, it can be damaged. It can still be damaged while in transit.
Any device with a processor and memory is a computer. So, for the purposes of this article, a calculator, smartphone, or tablet (such as an iPad) is a computer. Each of these devices and their data transmission medium over the network has software or transit software that needs to be protected.
Threats
To secure software, you must know its threats. Software must be protected from unauthorized access to its data. It must be protected from being used illegally (e.g. to cause damage). The software must be protected from disclosure to competitors. The software must not be damaged. The software must not be deleted unintentionally. The software must not be tampered with. The software must not have any unnecessary modifications. The data (software) must not be inspected without good reason, especially by unauthorized persons. The software must not be copied (pirated).
One or more of these bases, resulting in a certain type of classical threat.
Classes of software threats
Spoofing attack
This is a situation where a person (or program) successfully represents another person (or program) in some software activity. This is done by using false data to gain an advantage that is illegal.
Challenging.
This is a situation where someone is doing something wrong and denies that he or she is the wrong person. A person may use another person’s signature to do the wrong thing.
Data breach
A data breach is when secure or private information is intentionally or unintentionally exposed to an environment that is not trusted.
Denial of service attack
A software-based computer network has software running on the computers on the network. Each user typically uses his or her own computer in front of him or her and usually requests services from other computers on the network. A malicious user may decide to flood the server with unnecessary requests. The server has a limited number of requests that it can handle for a duration. In this flooding scheme, legitimate users cannot use the server as often as they need to because the server is busy responding to the criminal’s requests. This overloads the server, temporarily or indefinitely interrupting server services. At the same time, the host (server) slows down for legitimate users, while the criminal performs his evil deeds, which go unnoticed because the legitimate users standing by waiting for service could not have known that the server was being affected. Good users are denied service while the attack continues.
Privilege escalation
Different users of an operating system or program have different privileges. Thus, some users derive more value than others from the system. Exploiting a software bug or configuration oversight to gain greater access to resources or unauthorized information is privilege escalation.
The above classification schemes can be used for computer virus and worm infections.
One or more of the above classification schemes can be used for software attacks that include: intellectual property theft, database corruption, identity theft, sabotage, and extortion. If a person uses one or more schemes to disruptively modify a website so that the site’s customers lose confidence, this is sabotage. Information extortion is the theft of a company’s computer or falsely obtaining sensitive information about the company. A stolen computer may have sensitive information. This can lead to ransomware, where the thief demands payment in exchange for stolen property or information.
