3 Software Design
Controls are also needed over the in-house development or modification of any programs, because poorly written code can be exploited to give attackers administrative privileges. The primary weakness in most applications developed or modified in-house involves failing to adequately screen input data. Probably the most common input-related vulnerability is what is refers to as a buffer overflow attack, in which an attacker sends a program more data then it can handle. Buffer overflows may cause the system to crash or, even worse, may provide a command prompt, thereby giving the attacker full administrative privileges, and control, of the device. Because buffer overflows are so common, it is instructive to understand how they work.