This paper presents guidelines to develop secure applications in the form of "Do's and Don'ts " applying mostly to the software design level, but also to the implementation level. It builds on two collections of similar rules published in two seminal books in the area of secure software development, criticizes and improves those earlier rules and extends them by several new ones. The paper does not cover how to apply such rules in general. The main direction of improvement is making the rules more constructive, less ambiguous, and removing aspects not related to security.

No abstract available

Routers are critical components of IP networks, but hardly any tool support for analyzing their security exists to date. We have developed such a tool, named CROCODILE, that tracks the security implications of related configuration directives that may be scattered all over the router's configuration, instead of analyzing only isolated configuration clauses like other tools do. Our tool offers several novel evaluation capabilities and presents its findings as a collection of multi-view displays, enabling the user to focus on selected aspects, and to navigate deeper and deeper into specific details. We demonstrate the practical use of CROCODILE, and a comparison with the well-known RAT tool illustrates CROCODILE's remarkable capabilities.

Abstract We describe a mobile agent application for distributed searching of the global Usenet network, implemented on top of the Ara mobile agent system. After short overviews of Ara and the Usenet, the application is presented in detail, beginning with some critical thoughts on mobile agent applications in general. The function and performance of the search application is then described, demonstrating the advantage of using mobile agents over an equivalent stationary implementation of the same application under certain conditions, and also discussing the limits of such conditions. This is followed by descriptions of the language to express the search queries and of the search algorithms employed. The application presentation closes with a critical discussion. The paper then concludes with some observations about mobile agent programming in general. Copyright © 2002 John Wiley & Sons, Ltd.