Secure Software Design

Secure Software Design SDL Goals - ANS Reduce the number of vulnerability and Privacy issues Reduce the severity of the remaining vulnerabilities Three main goals of secure software development - ANS Quality Security Maintainability What are the three threat intention categories? - ANS unintentional Intentional but non-malicious malicious What are the primary issues in modeling - ANS Doing it well Doing it thoroughly enough Doing Knowing what to do with the results 12 categories of BSIMM - ANS Strategy and Metrics Compliance and Policy Training Attack Models Security Features and Design Standards and Requirements Architecture Analysis Code Review Security Testing Penetration Testing Software Environment Configuration and Vulnerability Management ISO 27001 - ANS Specifies a management system intended to bring information security under formal management control. ISO 27034 - ANS Guidance to help organizations embed security within their processes that help secure applications running in the environment. SAFECode - ANS Global industry led effort to identify and promote best practices for software, hardware and services. DHS Software Assurance Program - ANS Created the Build Security In website (BSI) to push security in the SDLC NVD - ANS National Vulnerability Database SAMATE - ANS Dedicated to improving software assurance by developing methods to enable software tool evaluations, measuring the effectiveness of tools and techniques, and identifying gaps in tools and methods. What is an exposure? - ANS A mistake in software that allows access to information or capabilities that can be used by a hacker as a stepping-stone into a system or network. Fuzzing - ANS a technique of penetration testing that can include providing unexpected values as input to an application to make it crash Static Analysis - ANS The analysis of computer software that is performed without actually executing programs Dynamic Analysis - ANS Analysis of the code while it is executed. Software Security Champions - ANS Software engineers/designers who are capable of thinking like an attacker, stepping stone to an architect role. When might Waterfall Development be used? - ANS When requirements are fully understood and not complex. What kinds of teams are used in Agile development - ANS Cross functional teams that are responsible all functions in each iteration What is the goal of Scrum? - ANS Maximize the ability to deliver quickly and respond to emerging needs. Lean development - ANS You select, plan, develop, test, and deploy one feature before moving on the the next. What is the discovery meeting? - ANS SDL kickoff meeting Functional Requirements - ANS What an application must do to serve a business need. Nonfunctional Requirments - ANS How well the functional requirements are met. PIA - ANS Privacy Impact Assessment (Data Sensitivity Assessment.) What 4 things should be included in a PIA - ANS Summary of the legislation Required process steps Technologies and techniques Additional Resources Four C's of privacy design - ANS Comprehension Consciousness Control Consent What type of cookies should be used to store PII? - ANS Session cookies whenever possible. What is the purpose of the PIA - ANS provide details on where and to what degree privacy information is collected, stored, or created within the software that you are developing Who is best positioned to determine the success criteria of the SDL? - ANS The security team 5 key success factors - ANS Accuracy of planned SDL activities Product risk profile Accuracy of threat profile Coverage of relevant red tape Coverage of security objectives Key Deliverables from SDL A1 - ANS Product risk profile SDL project outline Applicable laws and regs Threat profile Cert requirements List of 3rd party software Metrics template Who typically handles threat modeling? - ANS Senior security architect Seasoned security champions 5 steps of the risk modeling process - ANS Identify Security objectives Survey the application Decompose it Identify threats Identify vulnerabilities Threat modeling steps - ANS Break down using data flow diagrams Use STRIDE threat categories to identify threats Map all threats with relevant vulnerabilities Rank threats. Define the mitigation plan/countermeasures Fix the vulnerabilities What is the focus of a DFD - ANS How data moves through the software solution and what happens to the data as it moves STRIDE - ANS Spoofing Tampering Repudiation Information disclosure Denial of service Elevation of privilege How is the STRIDE model used? - ANS Break the system down into relevant components and analyze at that granularity. Risk Model - ANS Probability X Damage Potential DREAD model - ANS Damage Reproducibility Exploitability Affected users Discoverability RiskDREAD formula - ANS (DREAD)/5 Trike model - ANS using risk-based approach with distinct implementation, threat, and risk models. 7 steps to PASTA modeling - ANS Define Objectives Define Technical Scope Application Decomposition Threat Analysis Vulnerability and Weakness Analysis Attack Modeling Risk and Impact Analysis Three components of CVSS scoring - ANS Base Score Temporal Score Environmental Score Who sets the Base Score - ANS The Vendor. Really doesn't change over time. Who sets the Temporal score - ANS The vendor. Is reevaluated over time. Who sets the Environmental score? - ANS End user orgs compute this score. OCTAVE - ANS Operationally Critical Threat, Asset, and Vulnerability Evaluation What is Octave primarily used for? - ANS Primarily to enumerate risks Four ways to address risk - ANS Eliminate the threat Implement standard mitigation Invent new mitigation strategy Accept vulnerabilities with low risk and high effort to fix Mixed Source - ANS A blend of open-source and proprietary software. Key success factors of Architecture step - ANS Identification of business requirements and risks Effective threat modeling Effective architectural threat analysis Effective risk mitigation strategy Accuracy of data flow diagrams Deliverables for the SDL A2 - ANS Business requirements Threat Modeling Artifacts Architecture Threat Analysis Risk Mitigation Plan Policy Compliance Analysis Security Development Life cycle - ANS Broken up into A1 - A5 A1 - ANS Security Assessment A2 - ANS Architecture A3 - ANS Design and Development A4 - ANS Design and Devlopment A5 - ANS Ship What is reviewed in A3 policy compliance? - ANS Policies from outside the domain of the SDL Why is security testing conducted in A3? - ANS To demonstrate that the software functions as specified by the reequipments. Can security testing guarantee there are no vulnerabilities? - ANS No., it can just provide a small-scale view of what is needed to verify the security of the software. What type of security testing should always be the basis of your testing? - ANS Requirements-based testing Where should misuse cases be developed? - ANS Developed in A2 and then tested in A3 Steps to implement a test plan - ANS Define Test scripts Define the user community Identify the showstoppers Identify internal resources identify external resources Property-based testing - ANS validates that the software's implemented functionality satisfies its specifications. Source-code fault injection - ANS testing all code paths, especially error-handling code paths that may not be exercised during functional testing. Dynamic code analysis - ANS examines the code as it executes in a running application so that any vulnerabilities or anomalies that arise in the executing interfaces are simultaneously located in the source code. Binary fault injection - ANS faults are injected into the environment resources that surround the application. Fuzz testing - ANS Putting random inputs, valid and invalid, into a program. Binary code analysis - ANS Generate a human-readable source code representation of the program's behavior, enabling manual code review for design-level security weaknesses and subtle back doors that cannot be found by automated scanners. Black box debugging - ANS monitor the execution of a program, start and stop a program, set breakpoints, and modify values. Fail safe - ANS if a system fails, it should fail to a state where the security of the system and its data are not compromised Economy of mechanism. - ANS Keep it simple so there are fewer ways to fail. Complete mediation - ANS Every request by a subject to access an object in a computer system must undergo a valid and effective authorization procedure Least common mechanism - ANS don't share your mechanisms used to access resources. Psychological acceptability - ANS Ease of use and intuitiveness of the user interface that controls and interacts with the access control mechanisms. P1 - ANS High risk: Involving PII Changing settings Installing software P2 - ANS Moderate risk: one-time, user-initiated, anonymous data transfer. P3 - ANS Low risk: No anonymous or personal data is transferred Functional specifications should include: - ANS An accurate and complete description of the intended use of a feature or function. A description of how to deploy the feature or function in a secure fashion. Key success factors for A3 - ANS Comprehensive security test plan Effective threat modeling Design security analysis Privacy implementation assessment Policy compliance review A3 deliverables - ANS Updated threat modeling artifacts Design security review Security test plans Updated policy compliance analysis Privacy implementation assessment results Benchmarks - ANS Compare estimates to actual results Scheduled tests - ANS Testing mandatory requirements to validate the security of the software and associated system Exploratory tests - ANS The tester actively controls the design of the tests, and those tests are performed while testing to design new and better tests. Four steps of code review - ANS Identify Security Code Review Objectives Perform Preliminary Scan Review Code for Security Issues Review for Security Issues Unique to the Architecture Flow of activities for a code review - ANS Threat modeling Code Reviews Resolve Problems Learn the lesson Goals and constraints for code review should consider what? - ANS Time Types of issues Out-of-scope items What should be the focus of the Preliminary Scan? - ANS Input data validation Code that authenticates and authorizes Error-handling code Complex code Cryptography Interop Static Analysis - ANS Analysis of a program by examining it, but without running it. Dynamic Analysis - ANS Analysis of a program while running it. Three phase code analysis process - ANS Run all available code analysis tools Look for common vulnerability patterns Dig deep into risky code DAST - ANS Dynamic Application Security Testing Control flow analysis - ANS the mechanism used to step through logical conditions in the code Data flow analysis - ANS the mechanism used to trace data from the points of input to the points of output. A4 Key success factors - ANS Security test case execution Security testing Privacy validation and remediation Policy compliance review A4 Deliverables - ANS Security test execution report updated policy compliance analysis privacy compliance report security testing reports remediation report Four phases of pen testing - ANS Assess Identify Evaluate and Plan Deploy Two major issues to be aware of when using open sources software - ANS License Compliance Software security Three possible outcomes of Final security review - ANS Passed Passed with Exceptions Not passed and requires escalation The four-step process for final security review - ANS Assess resource availability Identify feature eligibility Evaluate and plan for remediation Release and ship Key A5 success factors - ANS Policy compliance analysis Vulnerability scanning Penetration testing Open-source licensing review Final security review Final privacy review Customer engagement framework A5 deliverables - ANS Updated policy compliance analysis Security testing reports Remediation report Open-source licensing review report Final security and privacy review reports Customer engagement framework SSE - ANS Software Security Evangelist PSIRT - ANS Product Security Incident Response Team ISO 29147 - ANS provides guidance on how vendors should deal with vulnerability reports from external finders and the recommended process for interfacing between vendors and the external discoverers or finders ISO 30111 - ANS provides guidance on how vendors should investigate, triage, and resolve all potential vulnerabilities, whether reported by external finders or via the vendor's internal testing Five step process for handling vulnerability reports - ANS Report received Verification Resolution development Release Post release Technical debt - ANS The difference between what was delivered and what should have been delivered. Post release support deliverables - ANS External vulnerability disclosure response process Post-release certifications Third-party security reviews Security strategy and process for legacy code, M&A, and EOL Three core activities of software development - ANS Write secure code Manual code review Static analysis Architecture Task flow for projects that are new or a redesign - ANS Security Strategy Architecture Assessment Threat Model Design Review Test Plan Architecture design flow - ANS Requirements Architecture Design McGraw's principles - ANS Secure the weakest link Defend in depth Fail Securely Grant least privilege Separate privilege's Economize mechanisms Do not share mechanisms Be reluctant to trust Assume your secrets are not safe Mediate completely Make security usable Promote privacy Use your resources Strategic Attacks targets what? - ANS Targets essential infrastructure software belonging to government, the economy, or society at large What is a Strategic attack - ANS Strategic software attacks are highly repeatable and use general targeting such as against a broad industry or groups of individuals, and must have long-term staying power. Tactical Attacks - ANS Surgical by nature, have highly specific targeting, and are technologically sophisticated. User-Specific Attacks - ANS can be strategic, tactical, or personal in nature, and target personal devices that may be either consumer- or enterprise-owned. DOD new defense concepts - ANS Enhance cyber best practices to improve its cyber security. Deter and mitigate insider threats, strengthen workforce communications, workforce accountability, internal monitoring, and information management capabilities. Employ an active cyber defense capability to prevent intrusions onto networks and systems. Develop new defense operating concepts and computing architectures. BSIMM VS SAMM - ANS