3.2.3 Robust software and vulnerability identification

What Makes Software Robust?

Robust software continues to function correctly and safely under a wide range of conditions, including unexpected inputs, heavy load, attempted attacks and hardware failures. Robust software does not crash unexpectedly, does not produce incorrect results silently and does not allow unauthorised access to data or functionality.

Developing robust software matters because: software failures can cause financial loss, damage to reputation, safety risks (medical systems, transport) and data breaches. The cost of fixing a security flaw after deployment is far greater than finding it during development.

Key practices that contribute to robustness include: input validation, error handling, thorough testing, secure coding practices, and — critically — systematic vulnerability identification.

Identifying Vulnerabilities

A vulnerability is a weakness in software that could be exploited to cause harm — allowing unauthorised access, data corruption, crashes or system compromise. Two key methods for identifying vulnerabilities before attackers do are audit trails and code reviews.

 Audit Trails

An audit trail (or audit log) is a chronological record of events in a system — who accessed what, when, what actions were taken, what data was changed. Audit trails support vulnerability identification in several ways:

  • Detecting unusual patterns of access that may indicate an attack or exploit
  • Identifying which accounts accessed sensitive data before a breach
  • Tracing the sequence of events that led to a system failure
  • Providing evidence for legal or regulatory investigation after a security incident

Audit logs are passive — they record what happened, but do not prevent it in real time. Their value lies in detection and investigation.

 Code Reviews

A code review is a systematic examination of source code by one or more developers (other than the original author) to identify errors, vulnerabilities and areas for improvement. Types include:

  • Peer review: a colleague manually reads through the code looking for logic errors, security flaws, poor input handling and violations of coding standards
  • Automated review: static analysis tools scan code for common vulnerability patterns (e.g. SQL injection risks, buffer overflows, unvalidated inputs) without running the code

Code reviews catch vulnerabilities before code is deployed — much cheaper and safer than fixing live software after exploitation.

 Key Takeaways

  • Robust software functions correctly under a wide range of conditions and resists failure and attack.
  • A vulnerability is a weakness in software that can be exploited.
  • Audit trails log system events chronologically — useful for detecting unusual access and investigating incidents.
  • Code reviews involve humans or tools inspecting source code to find vulnerabilities before deployment.
  • Identifying vulnerabilities early is far cheaper than fixing them after a breach.