D487: SECURE SOFTWARE DESIGN

SDLC

stands for software design life cycle

SDL

security development life cycle

eight major phases of the SDLC

planning, requirements, design, development, testing, deployment/implementation, maintenance and end of life

deployment phase

during this phase of the SDLC, security is pushed out

design phase

during this phase of the SDLC, requirements are prepared for the technical design

end of life phase

during this phase of the SDLC, the proper steps for removing software completely are considered

implementation phase

during this phase of the SDLC, the resouces involved in the application from a known resource are detemined

maintenance phase

during this phase of the SDLC, ongoing security monitoring is implemented

planning phase

during this phase of the SDLC, necessary software requirements are determined

what is SDLC?

structured process that enables the production of software

what is SDL

process that standardizes security best practices

testing phase

during this phase of the SDLC, software is tested to verify its functions thru a known enviroment

threat modeling

structured process in the Architecture (A2) phase where you identify potential security threats and design defenses before writing code

Building Security In Maturing Model (BSIMM)

studies real world software security initiatives. It allows you to determine where your software security stands and how to develop it over time

NIST (National Institute of Standards and Technology)

provides reseach, information, and tools for goverment and coporate information security.

application security

developing, adding, and testing security features to prevent vulnerabilities within applications.

dynamic analysis

the analysis of computer software that is performed when executing programs on a real or virtual processor in real time

programmers monitor system memory, functional behavior, response times and overall performance

fuzz testing

automated or semi automated testing that provides invalid, unexpected, or random data to the computer software program

measurement model

allows an org to determine the effectiveness of its security controls

open web application security project (OWASP)

flexible and prospective framework to build security into your software development org

static analysis

analysis of computer software that is performed without executing programs

agile methodology

• mixes traditional and new software development practices.
  
  uses collaboration b/e self organizing and cross functional teams.
  
  has 4 core values and 12 principles that can be followed.
  
  allows for customer satisfaction thru rapid, continuous delivery of useful software

• iterative development

extreme programming (XP)

software development methodology that is intended to improve software quality and responsiveness

type of agile software development

scrum

flexible, holistic product development strategy where a devlopment team works as a unit to reach a common goal

v-model

variation of the waterfall model, where the stage is turned back upwards after the coding phase

waterfall

sequential, step by step process for requirements.

the outcome of one phase acts as the input of the next phase

an advantage of the waterfall is splitting project deliveries into different stages, making it easier for an org to control the development process

a disadvantage is that it doesnt allow time for reflection or revision to the design

resembles an assembly-line approach

Security Assessment (A1) phase of SDL

what are our objectives? ASSESSING

• the first phase of the SDL in which the project team identifies the product risks and creates a project outline for security milestones
  
  all key stakeholders should discuss, identify, and have a common understanding of the security and privacy implications, considerations, and requirements
  
  basically the RISKS. threat profile, PIA, security objectives, SDL project outline

3 areas of focus in secure software requirements

1. gathering the software requirements

2. data classification

3. managing data protection requirements

opertional requirements

refer to how system should function based on the enviroment in which the system will operate

3 areas of compliance requirements

legal, financial and industry standards

functional requirements

requirements that describe what the system will do and its core purpose

what the software must do

specific features, user actions, system behaviors, and inputs/outputs

ex: The house must have a front door with a lock.

non functional requirements

requirements that describe any constraints or restrictions on a design but do not impact the core purpose of the system

how does it behave

system qualities, constraints, security, performance, and usability

ex: The front door must be made of steel and withstand 500 lbs of force

Privacy impact assessment (PIA)

process that evaluates issues and privacy impact rating in relation to the privacy of personally identiable information (PII) in the software

product risk profile

helps to determine the actual cost of the product from different persepctives

requirement traceability matrix

a table that lists all of the security requirements

threat profile

the environment in which the product will operate and potential threats in that environment

architecture (A2) phase

how can we be attacked? DESIGN, turn security requirements into secure architecture/design. the second phase of the SDL that examines security from perspective of business risks

threat model, DFDs, risk strategy, requirements, classify data

software security policy

defines what needs to be protected and how it will be protected

threat modeling

process to pinpoint security threats and potential vulnerabilities that will help priortize remediation rather reacting after threats are discovered

five steps of threat modeling

1. identify security objectives

2. survey the application

3. decompose it

4. identify threats

5. identify vulnerabilities

data flow diagrams

visual representation of the threat/process flow

STRIDE

threats can be categorized by type:

Spoofing

Tampering

Repudiation

Information of Disclosure

Denial of service

Elevation of privilege

PASTA

methodology of threat modeling stands for the process of attack simulation and threat analysis

DREAD

Model is one of the most popular risk models.

consists of Damage potential. Reproducibility, Exploitability, Affected users, and Discoverability

Trike

a framework for security auditing from a risk management perspectives

application centric threat modeling

threat models that start with visualizing the application you are building

the software design, architecture, and data flow diagrams (DFDs)

you look at the blueprints of the application you are building to see where the data goes.

asset centric threat modeling

threat models focused around senior management and protecting the assets of the org

high value assets and data

you start by listing the most valuable things the org owns- such as propriety souce code, customer credit card databases or trade secrets

application decomposition

determining the fundamental functions of an app

taking the application apart piece by piece to see how it works and where it can break

third party codes

reusable software developed externally from the orgs platforms

threat source

the entity carrying out the attack

threat vector

the path an attacker can take to explout a vulnerability

alpha level testing

testing done by the developers themselves

before the release of the product/application

beta level testing

testing done by those not familiar with the actual development of the system

by someone not internal to the org and only after the release of the product/application

black box testing

tests from an external perspective with no prior knowledge of the software

Design and Development (A3) phase (secuirty planning)

the third phase of the SDL cycle, in which centered around establishing secure planning, design updates, and compliance baselines. basically planning/building. how will we test? IMPLEMENTATION - build secure software and perform code/security reviews

test plan, test cases (making strategy tangible), secure source code, vulnerability identification, design security review

external resources

resources hired on a temporary basis to come into a project, test the application, and report findings

functional testing scripts

step by step instructions for a specific scenario or situation

verify what the system does (behavior, logic, user actions, expected outputs)

if a test checks business logic, user input, or return data

gray box testing

analyzes the source code for the software to help designe the test cases

internal resources

resources from the companys org

secure testing scripts

created specifically for the application being tested

scripts

detailed, logical steps of instructions to tell a person or tool what to do during the testing

system test

test the system and its interactions with other systems

abstract syntax tree (AST)

the basis for software metrics and issues to be generated at a later stage

a tree diagram that breaks down source code into its grammar and structure so tools can inspect it

its a hierarchical, tree-structured data rep of the syntactic structure of source code used by compilers. interpreters, and static application security testing (SASR) tools to analyze programs without executing them.

active scanner

benchmamodifies the HTTPS inputs and analyzes the response to identify vulnerabilities

scanner that actively injects inputs, payloads, and simulated attacks against a target to observe the response

benchmarks

tests used to compare estimates to actual results

code review

finds and fixes a large number of security issues before the code is tested or shipped

a process done to identify security vulnerabilities during software development

four basic techniques for code review are automated scanning, manual penetration, static analysis, and manual code review

AppSec

the process of finding, fixing and preventing security vulnerabilities at the application level

difficult to scale for large orgs

control flow analysis

the mechanism used to step thru logical conditions in the code

what order do statements run in?

order of statement execution / execution paths / branches and loops

static code analysis technique, no running the code

data flow analysis

how does data move and change?

the mechanism used to trace data from the points of input to the points of output

proxy scripts

effectively used to communicate a web security -bug or web security control

SonarQube

gives developers the ability to continuously inspect the quality of code they produce

open source platform for static code analysis that can detect bugs, code smells, vulnerabilities, and hotspots in over 25 programming languages

Design and Devlopment (A4) phase (testing and validation)

the fourth of the SDL, in which you will build onto the proper process of security testing and continue to analyze necessities at the security level. does it work securely?

TESTING/VERTIFICATION the code: code review, static and dynamic analysis. test security and find vulnerabilities, remediation report, PIA updated

exploratory tests

done by the development tester to continually assess the quality of his or her work

OWASP Zed Attack Proxy

an open source security tool used widely by software security developers

passive scanner

silently analyzes all the hypertext transfer protocol (HTTP) requests and responses passing thru the web application security tool

pull request

a request to merge your code into another branch

scheduled tests

mandatory requirements testing to validate the security of the software and associated system(s)

Spider

identifies inputs and supplied those to the scanning components of the security tool

automated tool that crawls thru a website or web application by following links and discovering pages, files, and other resources

Static Analysis

analysis of computer software that is performed without actually executing programs

Zed Attack Proxy (ZAP)

free, open source penetration testing tool

Ship (A5) phase (deployment readiness)

occurs when the security team perform its final analysis and security review on the applications or software, verifies that the product complies with security policies

can we ship it safely? (pen testing, vulnerability scan & reports, compliance review, final security review)

four phases of Pen testing

1. assess

2. identify

3. evaluate and plan

4. deploy

Nmap

popular tool used for network scanning and security auditing

authenticated scans

scans that require software to log onto a system to scan it

external scans

scans that target security issues that found outside the firewall

internal scans

scans to identify security issues that malicious attacker could exploit from inside the network

intrusive target search

scans to exploit a vulnerability when it is identified

open source software license compliance

regulations regarding the software licensing of in house products

open source software security

identifying software security within in house developed software

range

a networking laboratory created to conduct vulnerability analysis testing

SQL injection

code injection that might destroy your software

application input handled improperly

target machine

virtual space to practice identifying attack surfaces of the machine

merger and acquisition (M&A)

when companies consolidate

software security may go under architectural review to identify any changes that will need to take place once the M&A is complete

Product Security Incident Response Team (PSIRT)

the team that receives, investigates, and reports security vulnerabilities

Post release support phase

the phase of the SDLC in which orgs prepare for vulnerabilities after the product has been released

Post release PSIRT response

responds to software product security incidents that involve the external discovery of post release software vulnerabilities

software security champion (SSC)

an expert on promoting security awareness, best practices, and simplifying software security

helping their developers/team

software security evangelist (SSE)

an expert to promote awareness of products to the wider software community

software types

1. agile: flexible development approach that focuses on quickly delivering software and adapting to change. Iterative development

2. DevOps: development environment that combines development and operations to deliver and maintain software quickly and continuously (teams collaborating throughout). continuous integration and deployment

3. digital enterprise: an org that uses digital technology thru out its business to improve processes, products, services and customer experiences (tech thru out the business)

4. cloud: API invocation processes

OpenSAMM (open software assurance maturity model)

an open framework to help orgs implement software security tailored to the org’s specifics risks

business functions include governance, construction, verification, and deployment