2 cissp ® Official Study Guide Eighth Edition

874
Chapter 20 
■
Software Development Security
Object-Oriented Programming
Many modern programming languages, such as C++, Java, and the .NET languages, sup-
port the concept of object-oriented programming (OOP). Older programming styles, such 
as functional programming, focused on the flow of the program itself and attempted to 
model the desired behavior as a series of steps. Object-oriented programming focuses on 
the objects involved in an interaction. You can think of it as a group of objects that can be 
requested to perform certain operations or exhibit certain behaviors. Objects work together 
to provide a system’s functionality or capabilities. OOP has the potential to be more reli-
able and able to reduce the propagation of program change errors. As a type of program-
ming method, it is better suited to modeling or mimicking the real world. For example, 
a banking program might have three object classes that correspond to accounts, account 
holders, and employees, respectively. When a new account is added to the system, a new 
instance, or copy, of the appropriate object is created to contain the details of that account.
Each object in the OOP model has methods that correspond to specific actions that can 
be taken on the object. For example, the account object can have methods to add funds, 
deduct funds, close the account, and transfer ownership.
Objects can also be subclasses of other objects and inherit methods from their parent 
class. For example, the account object may have subclasses that correspond to specific types 
of accounts, such as savings, checking, mortgages, and auto loans. The subclasses can use 
all the methods of the parent class and have additional class-specific methods. For example, 
the checking object might have a method called 
write_check()
, whereas the other sub-
classes do not.
From a security point of view, object-oriented programming provides a black-box 
approach to abstraction. Users need to know the details of an object’s interface (generally 
the inputs, outputs, and actions that correspond to each of the object’s methods) but don’t 
necessarily need to know the inner workings of the object to use it effectively. To provide 
the desired characteristics of object-oriented systems, the objects are encapsulated (self-
contained), and they can be accessed only through specific messages (in other words, input). 
Objects can also exhibit the substitution property, which allows different objects providing 
compatible operations to be substituted for each other.
Here are some common object-oriented programming terms you might come across in 
your work: