Premium Essay

Practical Verification & Safeguard Tools for C/C++

In:

Submitted By drakomelfoy
Words 22394
Pages 90
P ra c t i c a l ve ri f i c a t i o n & s a fe g u a rd tools for C/C++
F Michaud . R. Carbone DRDC Valcartier

Defence R&D Canada – Valcartier
Technical Report DRDC Valcartier TR 2006-735 November 2007

Practical verification & safeguard tools for C/C++
F. Michaud R. Carbone DRDC Valcartier

DRDC Valcartier
Technical Report DRDC Valcartier TR 2006-735 November 2007

Principal Author

Approved by

Yves van Chestein Head/IKM

Approved for release by

Christian Carrier Chief Scientist

c Her Majesty the Queen in Right of Canada as represented by the Minister of National Defence, 2007 c Sa Majest´ la Reine (en droit du Canada), telle que repr´sent´e par le ministre de la e e e D´fense nationale, 2007 e

Abstract
This document is the final report of an activity that took place in 2005-2006. The goal of this project was first to identify common software defects related to the use of the C and C++ programming languages. Errors and vulnerabilities created by these defects were also investigated, so that meaningful test cases could be created for the evaluation of best-ofbreed automatic verification tools. Finally, when relevant, best practices were inferred from our experiments with these tools.

´ ´ Resume
Ce document est le rapport final d’un projet de recherche qui a eu lieu en 2005-2006. Le but de ce projet ´tait avant tout d’identifier les d´fauts logiciels courants li´s ` l’utilisation des e e e a langages de programmation C et C++. Les erreurs et vuln´rabilit´s cr´´es par ces d´fauts e e ee e ont aussi ´t´ ´tudi´es, de mani`re ` rendre possble la cr´ation de tests significatifs pour ee e e e a e l’´valuation des meilleurs outils de v´rification disponibles. Finalement, lorsque pertinent, e e de bonnes pratiques ont ´t´ d´duites de nos exp´rimentations avec ces outils. ee e e

DRDC Valcartier TR 2006-735

i

This page intentionally left

Similar Documents

Premium Essay

Philippine Caats

...Acknowledgment 1-3 4-6 7-16 17-25 26 27 28-29 The Auditing Standards and Practices Council (ASPC) issues Philippine Auditing Practices Statements (PAPS or Statements) to provide practical assistance to auditors in implementing the Philippine Standards on Auditing (PSAs) or to promote good practice. Statements do not have the authority of PSAs. This Statement does not establish any new basic principles or essential procedures; its purpose is to assist auditors, and the development of good practice, by providing guidance on the application of the PSAs regarding the use of Computer Assisted Audit Techniques as an audit tool. This Statement applies to all uses of CAATs involving a computer of any type or size. The auditor exercises professional judgment to determine the extent to which any of the audit procedures described in this Statement may be appropriate in the light of the requirements of the PSAs and the entity’s particular circumstances. PAPS 1009 Introduction 1. The overall objectives and scope of an audit do not change when an audit is conducted in a computer information technology (IT) environment. The application of auditing procedures may, however, require the auditor to consider techniques known as Computer Assisted Audit Techniques (CAATs) that use the computer as an audit tool. CAATs may improve the effectiveness and efficiency of auditing procedures. They may also provide effective tests of control and substantive procedures where there...

Words: 3364 - Pages: 14

Free Essay

Check List for Internal Control

...INVESTMENTS 6 A) SEGREGATION OF DUTIES 6 B) PROCEDURAL CONTROLS 6 IV. REVENUES AND RECEIVABLES 7 A) SEGREGATION OF DUTIES 7 B) PROCEDURAL CONTROLS 7 C) BILLING/REMITTANCE VERIFICATION 7 V. GRANT AND ENTITLEMENT MONITORING 9 A) GRANTS 9 B) Do ENTITLEMENT controls include the following? 10 VI. CAPITAL ASSETS 10 A) SEGREGATION OF DUTIES 11 B) PROCEDURAL CONTROLS 11 VII. PROCUREMENT AND PAYABLES 12 A) SEGREGATION OF DUTIES 12 B) PROCEDURAL CONTROLS 12 VIII. EMPLOYEE COMPENSATION 13 A) SEGREGATION OF DUTIES 13 B) PROCEDURAL CONTROLS 14 IX ELECTRONIC DATA PROCESSING 14 A) SEGREGATION OF DUTIES 15 B) PROCEDURAL CONTROLS 15 X. FINANCIAL REPORTING 16 A) SEGREGATION OF DUTIES 16 B) PROCEDURAL CONTROLS 17 INTERNAL CONTROL CHECKLIST Inventory of Specific Areas for study and evaluation of financial accounting internal controls I. BUDGETS AND PLANNING A) SEGREGATION OF DUTIES 1) Are responsibilities for budget preparation, adoption, execution, and reporting each assigned to different staff members?B) PROCEDURAL CONTROLS 1) Do personnel responsible for budget preparation: a) Have an awareness of budgets and budgetary procedures required by law? b) Prepare budgets for all significant activities regardless of whether mandated by law? c) Prepare a budget calendar to provide orderly submission and to obtain approval of the budget? d) Develop and prepare initial budget submissions by major...

Words: 8015 - Pages: 33

Premium Essay

Mcomm Costing

...K. Marathe College, Chembur, Mumbai - 400 71. Re-Edited by Prof. Kiran M. Rage (M.Com, D.F.M., F.C.A) N.G. Acharya, D.K. Marathe College Chembur, Mumbai - 400 071. Published by : DTP Composed by : Professor cum Director Institute of Distance and Open Learning University of Mumbai, Vidyanagari, Mumbai - 400 098. Pace Computronics "Samridhi" Paranjpe 'B' Scheme, Road No. 4., Vile Parle (E), Mumbai - 400 057. 2 CONTENTS Sr. No. Title Page No. SECTION - I (AUDITING) 1 Introduction To Auditing 01 2 Introduction To Auditing II 22 3 Audit Planning 33 4 Auditing Techniques And Internal Audit Introduction I 44 5 Internal Control 54 6 Vouching 89 7 Verification And Valuation Of Assets And Liabilities 106 8 Introduction To Company Audit 169 SECTION - II (COST ACCOUNTING) 9 Cost Accounting 173 10 Cost and Cost Classification - Cost Sheet 187 11. Reconcilation of Profit as per Cost and Financial Accounts 204 12. Material, Labour and Overheads 221 13. Method of Costing 237 14....

Words: 90883 - Pages: 364

Premium Essay

Customer Satisfaction Level

...Part-one • Organization profile(IBBL) • Job description Organization profile Of Islami bank Bangladesh limited (IBBL) After reading this chapter reader will be able to know about; • Corporate profile of IBBL • Mission and Vision of IBBL • Objectives of IBBL • Features of IBBL • Functions of IBBL • Management structure of IBBL • Basic Facts • Major differences between Conventional Bank & IBBL Corporate profile of IBBL: Islami Bank Bangladesh Ltd. (IBBL) was incorporated on March 13, 1983 under the companies Act, 1913 as the first interest free Shariah based commercial bank in South East Asia. IBBL started functioning on March 30, 1983 and formally inaugurated on August 12, 1983. The bank was promoted by 23 local sponsors including the Government of Bangladesh and 4 local institutions and 13 foreign sponsors including Islamic Development Bank (IDB). The foreign investors hold 57.37% of total shares while the local investors hold the rest 42.63%. There is a Shariah council, which is entrusted with the responsibility for ensuring that the activities of the bank are being conducted on the precepts of Islam. IBBL is one of the leading first generation private sector banks in Bangladesh, which provides all kinds of commercial banking services to the customer. The bank went for IPO in November, 1985. The IBBL got enlisted with Dhaka Stock Exchange Ltd (DSE) in 1985 and Chittagong Stock Exchange Ltd. (CSE) in...

Words: 9320 - Pages: 38

Free Essay

Counseling Management System

...Company Profile Star Wire (India) Limited, one of the leading Mini Steel Plant is engaged in the manufacturing of Alloy Steels, Stainless Steel and Special Steels for diversified engineering application in shape of castings, forging and rolled products. Plant is fully equipped with modern equipment and testing facilities which have created confidence and ability for manufacturing various sophisticated grades of steel conforming to international and National standards. It has its own research and development center to facilitate the manufacturing activities and also catering to engineering and manufacturing industries for failure analysis and other analytical activities. The plant is situated in Ballabgarh, about 37 KMs from Delhi - Capital of India on Main Mathura Road (NH No. 2). The location is at easy approach by Air, Rail and Road. ABSTRACT The project “Counseling Management system” is to exploit the computer technology with Internet Facility and all its aspects as necessity arises. The proposed project will be a web-based portal to provide support and services to the Students of participating in university counseling. The project will make available the Students care services of member colleges to its Students through the Internet. Through this proposed website the Students can register herself and take Admissions and support accordingly. The project “Counseling management system” is specially associated with online Admission procedure of...

Words: 9525 - Pages: 39

Free Essay

E Procurment

...Guidelines for compliance to     Quality requirements of eProcurement Systems                          STQC Directorate   Department of Information Technology,  Ministry of Communications & Information Technology,  Electronics Niketan, 6 CGO Complex, Lodhi Road,  New Delhi – 110003          Dt: 31.08.2011   CONTENTS    1.0   2.0   3.0   4.0   5.0 Specific requirements of eProcurement System  Requirements of Conformity  Operating Models of eProcurement System  Introduction  Testing framework for Quality and Security Characteristics    6.0     Evaluation & Certification process    Annexures    Annexure‐I        :  Risks of eProcurement Systems and related ISO 27001 controls  Annexure‐II         : Checklist for eSecurity Compliance (including CVC Guidelines)  Annexure‐III          : Checklist for compliance to GOI procurement procedures (GFR)  Annexure‐IV          : Checklist for legal compliance (IT Act – Amendment 2008)  Annexure‐V        :  Definitions and Reference Documents    Reference documents:    1. eTendering Process  2. eTendering Glossary  3. eProcurement Integrity Matrix   4. OWASP (Open Web Application Security Project) Top10 Application Security Risks‐ 2010  5. Business requirements specification‐ cross industry  e‐Tendering process (Source  CWA 15666)    Forms & Templates:  Template I                : Template for defining Usability Requirements Specifications of     the Software product  Template II               : Template for Performance Specification ...

Words: 32035 - Pages: 129

Premium Essay

Business Law

...SECTION C: GENERAL REQUIREMENTS TABLE OF CONTENTS TABLE OF CONTENTS 1 1.0 GENERAL 3 2.0 SCOPE OF WORKS 3 3.0 RULES, REGULATIONS AND STANDARDS 4 SECTION C: GENERAL REQUIREMENTS Clause Page 1. General 2 2. Scope of the Works 2 - 3 3. Rules, Regulations and Standards 3 - 4 4. Monitoring Defects of Building 5 5. Operation and Maintenance Works and Housekeeping Services 5 6. Consumables to be supplied by the Contractor and deemed to be included in the 6 Contract Sum 7. Operation and Maintenance Staff 6 - 8 8. Records and Reports 8 9. Workmanship 8 - 9 10. Equipment and Materials 9 11. Drawings and Technical Details 9 12. Operation and Maintenance Manual and Spare Parts Books 10 13. Access of E.R to the Works 10 14. Handover at the end of the Contract Period 10 15. Schedule of Rates 11 16. Certificate for Non Compliances 11 17. Health, Safety and Environmental Management 11 - 13 18. Building audit 13 19. Service level agreement and performance measurement 14 20. Documentation 20 1.0 GENERAL 1.1 The Contractor shall carry out the management, operation and maintenance of non-comprehensive maintenance of the Services as detailed in the Scope of Works below and in the Technical Specification of the tender document incorporating the specifications for the respective services for the Biotechnology Park in Nusajaya, Wilayah Iskandar, Johor Bharu, Johor. 2.0 SCOPE OF WORKS 2.1 The Contractor shall liaise with the relevant authorities,...

Words: 5270 - Pages: 22

Premium Essay

Riordan Manufacturing Proposal

...processes that are automatable and avoidable. Team C’s objective is to reduce costs and inefficiencies while adding the ability to improve inventory tracking from raw material beginnings to product sales throughout Riordan Manufacturing’s plants and facilities. A new manufacturing resource planning system (MRP) will allow Riordan Manufacturing to grow and remain competitive. Team C will work to create an MRP system for use by Riordan Manufacturing for tracking inventory and improving manufacturing tracking systems. Team C is confidence that one server in a central location will allow each of Riordan Manufacturing’s facilities to manage inventory better and improve the processing and storage of all data. Housing a backup server at another location will protect data for Riordan Manufacturing. This will save in labor costs by having fewer IT employees at each of the facilities that no longer house servers. Currently when shipments arrive the supervisor is responsible for checking in the material to coincide with the shipping orders. At the end of the day a clerk enters this information into the database. Team C will utilize the use of bar scanners to eliminate unnecessary paperwork. The use of bar scanners will free up workers to be available for other projects. This will also add to the saving in labor costs because of the automation of the bar coding system. Information will automatically transfer from the bar scanner to the database. This process eliminates the step of manually entering...

Words: 3648 - Pages: 15

Premium Essay

Asset Register Frame Work

...and  public agencies to help them implement their reform agenda.  The Finance Department, GOAP entrusted the project ‘Framework for Preparation  of  Asset  Register’  to  CGG  under  IDF  grant  for  strengthening  public  financial  management.   The Team   This  Report  on  ʹAsset  Register  Framework  for  Government  of  Andhra  Pradeshʹ  has  been  prepared  by  Mr.  A.  Srinivas  Kumar  IA&AS.,  Deputy  Executive  Director,  CGG  with  assistance  from  Mr  A  P  H  D  Varma,  ACA,  Consultant  and  Ms.  Vasantha Pratha, Knowledge Manager (PFM) CGG under the overall guidance of  Dr. Rajiv Sharma, IAS, Director General & Executive Director, CGG.   Acknowledgements  The study team would like express its sincere gratitude to Mr C R Kamalanathan,  IAS (Retd.), Consultant, CGG for his valuable guidance and support. We are also  grateful to Ms Vasudha Mishra, IAS, Secretary (IF), Finance Department, GoAP  for  her  involvement  and  active  participation  in  the  deliberations  of  the  workshop, which helped clarify many points. We would also like to thank Mr N  Madanaiah,  SE  (I&CAD)  Retd,  Consultant,  CGG  and  Mr J  Bhavani  Shankar,  Programme  Manager,  CGG  for  proving  useful  information  and  insights  on  infrastructure  assets.  They  would  also  like  to  acknowledge  with  sincere  thanks  the  help  rendered  by  departmental  officers  by  generously  sharing  their  knowledge...

Words: 27945 - Pages: 112

Premium Essay

Project

...LOAN DISBURSEMENT AND RECOVERY SYSTEM OF JANTA BANK LTD. Prepared by Md. Nizam Uddin Forhad ID: 112011097 Supervised by Palash Kumar Kundu Senior Lecturer Submitted in Partial Fulfillment of the Requirements for the Degree Bachelor of Business Administration Date: 09 August 2015 Internship Report Approval Form Student Name MD. Nizam Uddin Forhad ID No.112011097 Major: Accounting Year: 2015 Local Phone: +8801675000325 Email: nizam.uddin.bba@ulab.edu.bd --------------------------------------------------------------------------------------------------------------------------- INTERNSHIP/PROJECT INFORMATION Internship Organization/Project: Janata Bank Ltd. Internship /Project Report Topic: Loan Disbursement and Recovery System _____________________________________________________________________________________ _____________________________________________________________________________________ Semester (Tick one): □ spring 2015 □ summer 2015 □ fall 2015 --------------------------------------------------------------------------------------------------------------------------- SUPERVISOR APPROVAL (Please place a Tick) □ Approved □ Not Approved □ Partial Re-write □ Full Re-write Remarks (If Not Approved/Pretrial/Full Rewrite): _____________________________________________ _________________________________...

Words: 8224 - Pages: 33

Premium Essay

Information and Survey Analysis

...1. An IS auditor is reviewing access to an application to determine whether the 10 most recent "new user" forms were correctly authorized. This is an example of: A. variable sampling. B. substantive testing. C. compliance testing. D. stop-or-go sampling. The correct answer is: C. compliance testing. Explanation: Compliance testing determines whether controls are being applied in compliance with policy. This includes tests to determine whether new accounts were appropriately authorized. Variable sampling is used to estimate numerical values, such as dollar values. Substantive testing substantiates the integrity of actual processing, such as balances on financial statements. The development of substantive tests is often dependent on the outcome of compliance tests. If compliance tests indicate that there are adequate internal controls, then substantive tests can be minimized. Stop-or-go sampling allows a test to be stopped as early as possible and is not appropriate for checking whether procedures have been followed. 2. The decisions and actions of an IS auditor are MOST likely to affect which of the following risks? A. Inherent B. Detection C. Control D. Business The correct answer is: B. Detection Explanation: Detection risks are directly affected by the auditor's selection of audit procedures and techniques. Inherent risks usually are not affected by the IS auditor. Control risks are controlled by the actions of the company's management. Business...

Words: 97238 - Pages: 389

Premium Essay

Eia Malaysia

...ENVIRONMENTAL IMPACT ASSESSMENT (EIA) Procedure and Requirements in Malaysia CONTENTS Page I. ENVIRONMENTAL IMPACT ASSESSMENT What is Environmental Impact Assessment (EIA) Why do we need EIA? Which activities are subject to EIA How to conduct EIA II. THE EIA PROCEDURE IN MALAYSIA Integrated Project Planning Concept How is EIA Report Processed and Approved ? Organisational Structure Preliminary EIA Reports Detailed EIA Reports Classification of Projects by Timing of EIA Report Submission (Project Planning Cycle) Consultation III. ACTIVITIES SUBJECT TO EIA 1 1 1 1 1 1 2 4 4 4 5 9 9 9 LIST OF FIGURES 1 2 3a 3b Outline of Environmental Impact Assessment Procedure in Malaysia Integrated Project Planning Concept Organisational Structure of EIA Report Processing and Approval Procedure at State Offices Organisational Structure of EIA Report Processing and Approval Procedure at the Department of Environment Headquarters Organisational Structure of Detailed EIA Report Processing and Approval Procedure LIST OF TABLES 1 2a 2b 2c Classification of Projects by Timing of EIA Report Submission (Project Planning Cycle) Summary of Activities Subject to Environmental Impact Assessment (Activities Defined by Quantum) Summary of Activities Subject to Environmental Impact Assessment (Activities Defined by Project Size) Summary of Activities Subject to Environmental Impact Assessment (Activities Not Defined by Unit of Measure) 3 4 4 5 3c 6 7 11 12 13 ii LIST OF APPENDICES Appendix...

Words: 5472 - Pages: 22

Premium Essay

J Fksla

...hgThe Importance of Loan Policies   INTRODUCTION Over the years, the fate of a credit union has been closely tied to how well it manages credit risk. A written loan policy, approved by a credit union’s board of directors and adhered to in practice, is of critical importance in ensuring that the credit union operates in both a safe and a sound manner. In today’s competitive and challenging lending environment, an up-to-date policy, appropriate to a credit union’s lending function and business plan, may be more important than ever. This Bulletin summarizes features and benefits of an effective policy, details warning signs and potential consequences of an outdated policy, and offers practical advice about reviewing and updating a loan policy. ELEMENTS OF AN EFFECTIVE LOAN POLICY Written loan policies vary considerably in content, length, and specificity, as well as in style and quality. No two credit unions share the same tolerance for risk, offer the same loan products, and face the same economic conditions. An effective loan policy should reflect the size and complexity of a credit union and its lending operations and should be tailored to its particular needs and characteristics. Revisions should occur as circumstances change, and the policy should be flexible enough to accommodate new lending activity without a major renovation. During examinations, examiners will make a determination about the adequacy of a credit union’s loan policy. Examiners are guided in their...

Words: 4923 - Pages: 20

Premium Essay

Health and Social Care

...you an insight into how the course will be run. The BTEC first award is a 120 guided learning hour course which will give you a vocational qualification. It will give you the knowledge, understanding and skills to help prepare you for employment or to lead on to further areas of study. The course consists of 4 core units for the complete qualification which have specific learning outcomes. Three units have been broken down into assignment tasks which form part of a number of central assignment briefs. In addition, there will be an external examination to assess the remaining unit. The tasks cover different assessment criteria and are designed for you to produce finished pieces of work which also compliment and act as learning tools for each other and produce a complete interrelating body of work. As the course is vocational you will be visiting places of work, meeting and working with practising scientists and learning how to develop science with a set purpose. You will be able to discuss and evaluate the progress and end results of your work. You will also look at a variety of issues within the health and social care sector. The assignment tasks will be assessed and internally verified by your teachers and an external verifier will assess your work. The examination will be assessed externally. You will be given definite deadline dates for each assignment task. There will be continual comments/exchanges about your work and an interim feedback form will be...

Words: 6048 - Pages: 25

Premium Essay

Empowering Service Users

...you an insight into how the course will be run. The BTEC first award is a 120 guided learning hour course which will give you a vocational qualification. It will give you the knowledge, understanding and skills to help prepare you for employment or to lead on to further areas of study. The course consists of 4 core units for the complete qualification which have specific learning outcomes. Three units have been broken down into assignment tasks which form part of a number of central assignment briefs. In addition, there will be an external examination to assess the remaining unit. The tasks cover different assessment criteria and are designed for you to produce finished pieces of work which also compliment and act as learning tools for each other and produce a complete interrelating body of work. As the course is vocational you will be visiting places of work, meeting and working with practising scientists and learning how to develop science with a set purpose. You will be able to discuss and evaluate the progress and end results of your work. You will also look at a variety of issues within the health and social care sector. The assignment tasks will be assessed and internally verified by your teachers and an external verifier will assess your work. The examination will be assessed externally. You will be given definite deadline dates for each assignment task. There will be continual comments/exchanges about your work and an interim feedback form will be...

Words: 6048 - Pages: 25