Unit 2 3 Robust Programs Lesson 1 Defensive

Unit 2. 3 Robust Programs Lesson 1 - Defensive Design Consideration © OCR 2016

Big Picture How can ROBUST programs be created that are defensive against hacks and attacks. How can this be implemented in the design stage of the program development? © OCR 2016

Learning Objectives 1. To understand the elements of defensive program design 2. Know how comments and indentation can support maintainability 3. Describe the role of testing, including how to identify errors and select appropriate test data. © OCR 2016

Engagement Activity https: //www. youtube. com/watch? feature=player_embedded&v=r. Gll. Cl. Lz. Yts © OCR 2016

Engagement Activity • • What caused the SONY hack? What are the outcomes of this hack? How could SONY have prevented the attack? How might SONY alter their programs to prevent this kind of attack in the future? © OCR 2016

Key Words • • • Data Validation Data Sanitisation Authentication Maintainability Comments Indentation © OCR 2016

Defensive Design Considerations • Make a list of where you commonly enter data. • How much of this is personal data? • When data is entered into a program it is important that it is valid in order for the program to operate correctly. • Sometimes users will deliberately enter incorrect or ‘spam’ data in an attempt to access a program or the program code. © OCR 2016

Input Validation • Validation is a check made by a computer to ensure that the data entered is sensible or reasonable. • It cannot check that it is correct because a user may lie or make a mistake. • It attempts to ensure that it is within certain limits or rules. © OCR 2016

Input Validation • For example, a user is asked to enter a mobile phone number but only enters 9 digits. • A standard UK mobile number is 11 digits. • A length check validation can be used to ensure that 11 digits are entered © OCR 2016

Activity One • Sort the cards into the correct order create a table of the: • Name of the validation technique • A definition • An example © OCR 2016

Activity 1 Answers Check digit the last one or two digits in bar code readers in supermarkets use a code are used to check digits the other digits are correct Format checks the data is in the right format a National Insurance number is in the form LL 99 99 99 L where L is any letter and 9 is any number Length checks the data isn't too short or too long a password which needs to be six letters long Lookup table looks up acceptable values there are only seven possible days of in a table the week Presence checks that data has been in most databases a key field cannot entered into a field be left blank Range checks that a value falls within the specified range number of hours worked must be less than 50 and more than 0 Spell check looks up words in a dictionary MS Word uses red lines to underline misspelt words © OCR 2016

Input Sanitisation • Another method for validating data and stopping attacks is to clean up the data that is inputted so that it is ready for the application to use. • Some users may additional data to try and access the program or provide clues on how to access the program. • Data sanitisation trims or strips strings, removing unwanted characters from strings • For example, Dave not dav%e, the % would be removed • This ensures that the input is correct and contains only the permitted characters, letters and symbols. © OCR 2016

Input Sanitisation Activity 2 • Look at the data below and identify the issues 1. Dav 3 2. Sarah@#gmail. com 3. Name: claire swainsworth 4. £ 546. 56. 67 5. O 1982 56 O 635 © OCR 2016

Input Sanitisation Answers Look at the data below and identify the issues 1. Dav 3 2. Sarah@#gmail. com 3. Name: claire swainsworth 4. £ 546. 56. 67 (two options here) 5. O 1982 56 O 635 © OCR 2016

Anticipating Misuse • Defensive program design will consider and anticipate misuse. • Misuse may be in the form of a brute force attack on the program. • Many programs and systems only allow a user to enter a password three or four times before it locks out the system. © OCR 2016

Anticipating Misuse • The program should be able to identify when a user keeps inputting the same data. • Consider Twitter which allows you to send the same tweet only once. • If you send the same Tweet twice the program identifies this and removes the tweet, sending you an error message. © OCR 2016

Planning for contingencies • Once a programmer has anticipated the misuse they can then plan for these issues. • For example: • Limiting the number of logon attempts • Ensuring the code is robust in validating the data entered. • Another method used is authentication © OCR 2016

Authentication • Authentication is a coding method to check that a user is who they say they are and allowed to accesses the program. • This can be as simple as the user entering a user name and password which is compared against a stored user name and password. • If they match then the user is authenticated. © OCR 2016

Authentication • Authentication can also be physical. • New software often requires a key code which is generated by an app on the users phone and then entered. • Online banking requires a user to enter credentials into a webpage and then a number is generated which is entered into a key device. • This returns a number code which is entered into the webpage as well. • Without the second part of the code the user is not authenticated. © OCR 2016

Authentication • Authentication methods vary from passwords to patterns and even image scanners. • Authentication also occurs when you access a website, you request access to the server which hosts the page. © OCR 2016

Authentication A summary of basic web authentication goes like this: • You make for a request for a webpage by typing in the URL • The server responds with an error, requesting authentication • Your device retries request - with authentication details encoded in request • Again the server checks the details and sends the page requested, or another error © OCR 2016

Make a list of programs where authentication is required and what type of authentication happens • Facebook Login © OCR 2016

Maintainability • If a program is to be defensive against attacks then it has to be maintained and up to date. • API and code changes, which means that programs will need to adapt to complement new requirements. • Comments and indentation are two methods to provide information for future users or programmers that may be required to maintain the code. © OCR 2016

Indentation • Code is indented for a number of reasons. 1. To group together a function 2. The code does not use a { syntax and indentation is used instead 3. If altering a function in the future it can be easily found. © OCR 2016

Comments in programs serve a number of purposes 1. To inform them reader of a bug or issues 2. To explain the code and its function in more detail 3. To stop a line of section of code from executing © OCR 2016

Activity 3/Homework • Create a simple ‘Top 10 tips for effective coding’ poster • For example: • add comments as you write the program and be polite • Include examples and best practice • You could include screen shots and images © OCR 2016

Plenary • Play Pictionary: draw words / terms related to the lesson content. • Evaluate a program(s) that you have written: • Are they robust? Make a list of features that are and that are not • Apply defensive design to your own programs. © OCR 2016

OCR Resources: the small print OCR’s resources are provided to support the teaching of OCR specifications, but in no way constitute an endorsed teaching method that is required by the Board, and the decision to use them lies with the individual teacher. Whilst every effort is made to ensure the accuracy of the content, OCR cannot be held responsible for any errors or omissions within these resources. © OCR 2016 - This resource may be freely copied and distributed, as long as the OCR logo and this message remain intact and OCR is acknowledged as the originator of this work. OCR acknowledges the use of the following content: youtube. com/ADN Media/bbc Please get in touch if you want to discuss the accessibility of resources we offer to support delivery of our qualifications: resources. feedback@ocr. org. uk © OCR 2016