Security Static Analysis Tools (Software assurance U4)

TABLE OF CONTENTS (TOC)

DOMAIN 1-PROJECT OUTLINE………………………………………………………..3

1-1 PROJECT OUTLINE AND REQUIREMENTS…………………………..4

DOMAIN 2 -SECURITY IN THE DEVELOPMENT LIFE CYCLE…………………….8

DOMAIN 3 -SOFTWARE ASSURANCE TECHNIQUES………………………………12

DOMAIN 4 -SECURITY IN NONTRADITIONAL DEVELOPMENT MODELS……...15

DOMAIN 5-SECURITY STATIC ANALYSIS…………………………………………..20

DOMAIN 6-SOFTWARE ASSURANCE POLICIES AND PROCESSES………………29

DOMAIN 1-1 PROJECT OUTLINE AND REQUIREMENTS

Telecom and Network Security Requirements

Remote Access Security Management

Remote Connections

· xDSL – Digital Subscriber Line

· Cable modem

· Wireless (PDAs)

· ISDN – Integrated Services Digital Network

Securing External Remote Connections

· VPN – Virtual Private Network

· SSL – Secure Socket Layer

· SSH – Secure Shell

Remote Access Authentication

· RADIUS – Remote Access Dial-In User Server

· TACACS – Terminal Access Controller Access Control Server

Remote Node Authentication

· PAP – Password Authentication Protocol – clear text

· CHAP – Challenge Handshake Authentication Protocol – protects password

Remote User Management

· Justification of remote access

· Support Issues

· Hardware and software distribution

Intrusion Detection

· Notification

· Remediation

Creation of:

· Host and networked based monitoring

· Event Notification

· CIRT – Computer Incident Response Team

· CIRT Performs

· Analysis of event

· Response to incident

· Escalation path procedures

· Resolution – post implementation follow up

Intrusion Detection Systems

· Network Based – Commonly reside on a discrete network segment and monitor the traffic on that network segment.

· Host Based – Use small programs, which reside on a host computer. Detect inappropriate activity only on the host computer, not the network segment.

· Knowledge Based – Signature based

· Behavioral Based – Statistical Anomaly

Knowledge Based

Pros Cons

Low false alarms Resource Intensive

Alarms Standardized New or unique attacks not found

Behavior Based – less common

Pros Cons

Dynamically adapts High False Alarm rates

Not as operating system specific User activity may not be static enough to implement

CIRT – (CERT) – Computer Incident Response Team

Responsibilities:

· Manage the company’s response to events that pose a risk

· Coordinating information

· Mitigating risk, minimize interruptions

· Assembling technical response teams

· Management of logs

· management of resolution

Network Availability

· RAID – Redundant Array of Inexpensive Disks

· Back Up Concepts

· Manage single points of failure

RAID – Redundant Array of Inexpensive Disks

· Fault tolerance against server crashes

· Secondary – improve system performance

· Striping – Caching and distributing on multiple disks

· RAID employs the technique of striping, which involves partitioning each drive's storage space into units ranging from a sector (512 bytes) up to several megabytes. The stripes of all the disks are interleaved and addressed in order.

· Hardware and software implementation

RAID Advisory Board

· Three types – Failure Resistant Disk Systems (FRDS) - the only current standard, Failure Tolerant Disk Systems, and Disaster Tolerant Disk Systems.

· FRDS: provides the ability to reconstruct the contents of a failed disk onto a replacement disk.

· Enables the continuous monitoring of these parts and the alerting of their failure

· FRDS+

· Protect from disk failure – can reconstruct disks by automatically hot swapping while server is running

· Includes environmental

· FRDS+ adds hazard warning

DOMAIN 2 -SECURITY IN THE DEVELOPMENT LIFE CYCLE

Instruction Execution Cycle

Two Phases

· Fetch

· CPU presents address of the instruction to memory

· Retrieves instructions located at that address

· Execute

· Instruction is decoded and executed

· Controlled by the CPU clock signals

· Multi-Phase clock signals used for DRAM

· Single Phase clock signals used for SRAM

· Some instructions require more than one machine cycle to execute

· Different States of Operation:

Run or operating state

· Application or problem state

· Non-privileged instruction – subset of instructions for user

· Supervisory State

· Privileged instructions – System Administrator may execute

· Wait State - accessing slow memory

Modern Computer Enhancements

· Pipelining – increases performance by overlapping the steps of instructions

· Three Phases - Fetch – Decode – Execute

· Complex Instruction Set – instructions perform many operations per instruction, based on taking advantage of longer fetch times

· Reduced Instruction Set - simpler instruction that require less clock cycles to complete

· Result of faster processors that enabled the fetch process to be done as quickly as decode and Execute

· Scalar Processor – processor that executes one instruction at a time

· Superscalar Processor – processor that enables concurrent execution of multiple instructions in the same pipeline

· Very Long Instruction Word Processor – VLIW – processor in which a single instruction specifies more than one concurrent operation

· Multiprogramming – Executes two or more programs simultaneously on a single processor

· Multitasking – Executes two or more subprograms at the same time on a single processor

· Multiprocessor – Executes two or more programs at the same time on multiple processors

Input / Output Structures

· A processor communicates with outside devices through (I/O) interface adapters

· Complex provide

· Data buffering

· Timing and interrupt controls

· Adapters have addresses on the computer bus

If the adapter has address in the memory space it is known on memory-mapped (I/O)

· Benefit is that CPU sees adapter as any other memory device

Types of I/O:

· Block devices (write blocks of data; hard disk)

· Character devices (not addressable; keyboard and printer)

CPU operating states: ready state, problem state, supervisory state, and wait state

Direct Memory Access – DMA

Data is transferred directly to and from the memory bypassing the CPU

Interrupt Processing – an external signal interrupts the normal program flow and requests service, when the service is complete the CPU restores the state of the original program, CPU can turn off interrupts

· Software – Binary codes is machine language instructions

· Assembly Language - Mnemonics for basic instruction set specific to the computer

· One to one relationship for each assembly instruction to each machine instruction

· Source code - assembly goes through assembler to become object (machine) code

· Disassembler will reverse machine code into assembly

· MACRO’s can be used to represent several functions in assembly

· High level languages – English like statements, C, Java, Pascal FORTAN, BASIC

· High level code is compiled in compiler or interpreter into machine code

· Compiler – FORTAN, C, Java

· Interpreter – Java, BASIC

Generation Language (GL) 1GL (machine), 2GL (assembly), 3-5 GL (High level)

· 1 GL – machine language: Assembler – translates from assembly language to machine language.

· 2 GL – assembly language: Disassembler – translates machine language to assembly.

· 3 GL – Fortran, BASIC, C languages: Compiler – translates high-level language to machine code.

· 4 GL – NATURAL, FOCUS, and database query languages: Decompiler – translates machine language into high-level language.

· 5GL – Prolog, LISP and other Artificial Intelligence languages: Interpreter – translates high-level language one command at time to machine code.

Operating System (OS)– program or set of programs that controls the resources and operations of the computer

Controller - OS communicates with I/O through controller (i.e. disk controller)

Open systems – published specifications, subject to open review and evaluation, vulnerabilities exposed during review.

Closed systems – vendor proprietary usually not compatible with other systems, no open review, may have unexposed vulnerabilities

DOMAIN 3 -SOFTWARE ASSURANCE TECHNIQUES

Triples

· Threat – an event that could cause harm by violating the security ( i.e. Operator abuse of privileges)

· Vulnerability – weakness in a system that enables security to be violated (i.e. Weak Segregation of duties)

· Asset – anything that is a computer resource (i.e. software data)

C.I.A.

· Confidentiality – operations controls affect confidentiality of data.

· Integrity – how well operations controls are implemented affects data integrity

· Availability – fault tolerance and ability to recover

Controls and protections

Controls to protect hardware, software and media from:

· Threats in an operating environment

· Internal and external intruders

· Operators inappropriately accessing resources

Categories of Controls

· Preventative – prevent harmful occurrence

· Lower amount and impact of errors entering the system

· Prevent unauthorized intruders from accessing the system

· Detective – detect after harmful occurrence

· Track unauthorized transactions

· Corrective – restore after harmful occurrence

· Data recovery

Additional Control Categories

· Deterrent Control – encourage compliance with external controls

· Application Controls – designed into software applications

· Transaction Controls – control over the various stages of a transaction

· Input Controls – ensure transactions properly input

· Processing Controls – guarantee transactions are proper and valid

· Output Controls – protect the confidentiality and integrity of output

· Change Controls – preserve integrity when configuration changes are made

· Test Controls – ensure data integrity and confidentiality of data during testing

Orange Book Controls – TCSEC – Trusted Computer Security Evaluation Criteria

Assurance – level of confidence that security policies have been implemented correctly

Operational Assurance – focuses on basic features and architecture of a system

· System Architecture

· System Integrity

· Covert Channel Analysis

· Trusted Facility Management

· Trusted Recovery

Life Cycle Assurance – controls and standards required for building and maintaining a system

· Security Testing

· Design Specification and testing

· Configuration Management

· Trusted Distribution

DOMAIN 4 -SECURITY IN NONTRADITIONAL DEVELOPMENT MODELS

Software Development Lifecycle

· Goals:

· Produce Quality product that meets users’ needs

· Stay within budget and time schedule

Simplistic Model

Took into account each stage but did not take into account any rework that may be required by later stages

Waterfall Model

· Allows developer to go back and work on the previous stage

· Limited to one stage back

· Fundamental problem:

· Assumes that a stage will finish at a specific time

· Usually not the case in the real world

· If an ending phase is forcibly tied to a milestone, the milestone cannot be considered met until the rework is concluded

· In 1976 Barry Boehm, reworked waterfall model to have all phases end with a Milestone and the back references represents verification and validation against baselines

Verification – evaluates the product against the specification

Validation – evaluates the product against the real world requirements

Waterfall Model: System Requirements-Software Requirements-Analysis-Program Design-Coding-Testing-Operations & Maintenance

The Spiral Model

· Developed in 1988 by Barry Boehm

· Incorporates the various phases of software development

· Broken out into Quadrants

· Cost is on the radial dimension (Y – Axis)

· Quadrants:

· Lower Left – Developing Plans

· Upper Left – Defines Objectives

· Upper Right – Prototyping to identify risks

· Lower Right – Final Development

· Left Horizontal Axis represents major review to complete each full cycle

Information Security and the Life Cycle Model

· Information Security: controls conception, development, implementation, testing, and maintenance should be conducted concurrently with the system software life cycle phases

Testing Issues

· Unit testing should be addressed when modules are designed

· Personnel separate from the developers should test

· Should include out of range situations

· Test cases should be used with known expected values

Software Maintenance Phase

· Request Control – manage user requests

· Establish priorities

· Estimate Costs

· Determine interface presented to user

Change Control

· Recreating and analyzing the problem

· Developing changes and tests

· Performing quality control

· Tools to be used for changes

· Documentation of changes

· Restriction of changes’ effect on other parts of code

· Recertification and accreditation

· Release Control

· Issuing the latest release of the software

Configuration Management

BS 7799 – The discipline of identifying components of a continually evolving system for the purposes of controlling changes to those components maintaining integrity and traceability throughout the lifecycle.

· Configuration Item – component which is to be changed

· Version – recorded state of the configuration item

· Configuration – collection of component configuration

· Building – process of assembling a version

· Build List – set of version used to build configuration item

· Software Library – controlled area

Configuration Identification – identify and document the functional characteristics of configuration item

Configuration Control – control changes to configuration items from software library, issuing versions

Configuration Status Accounting – record the processing of changes

Configuration Audit - Control of the quality of configuration management

· The Software Capability Maturity Model Quality of finished product is a component of the quality of the development process

· CMM developed by the Software Engineering Group (SEI) in 1986

· Defines Five Maturity Levels

· Level 1 – Initiating – competent people, processes are informal and ad hoc

· Level 2 – Repeatable – has project management processes

· Level 3 – Defined – technical practices are integrated with management practices

· Level 4 – Managed – product and processes are quantitatively controlled

· Level 5 – Optimizing – Continuous process improvement

The Software CMM supports the concept of continuous improvement

Process Improvement IDEAL Model

Phase 1 – Initiate – begin formal process improvement effort

Phase 2 – Diagnose – Perform Assessment

Phase 3 – Establish – Develop prioritized action plan

Phase 4 – Action – implement process improvement

Phase 5 – Leverage – reassess and continuously improve

Benefits:

· Improved Software Quality

· Reduced Lifecycle

· More accurate scheduling

· Management visibility

· Proactive Planning and tracking

DOMAIN 5-SECURITY STATIC ANALYSIS

Making the plans for recovery and putting them into action to recover with as little impact on the business as possible.

Business Continuity – ensuring the business can continue in an emergency

Disaster Recovery – recover as quickly as possible

BCP Process includes:

· Scope and Plan Initiation

· Business Impact Analysis (BIA)

· Business Continuity Plan development

DRP Process includes:

· DRP planning process

· Testing the DRP

· Disaster Recovery Procedures

Key difference between BCP and DRP - DRP addresses the procedures to be followed during and after the loss

Business Continuity Planning

· Created to prevent interruptions to normal business activity

· Protect critical business process from manmade and natural disasters

· Minimize the effect and all resumption of business process

BCP Should Address:

· Local and Wide Area Networks and servers

· Telecommunications and data links

· Workstations and workspaces

· Applications software and data

· Media and records storage

· Staff duties

Number One priority is always People First!

Continuity Disruptive Events

Natural Events:

· Fires, Explosions, hazardous material spills of environmental toxins

· Earthquakes, storms, floods, and fires from nature

· Power outages and utility failures

Man Made Events:

· Bombings Sabotage

· Strikes, job actions

· Employee or Operator unavailability due to emergency evacuation

· Communications infrastructure failures

Four Prime Elements of BCP

· Scope and Plan Initiation – marks the beginning of BCP process

· Business Impact Analysis – used to help business understand the impact of a disruptive event

· Business Continuity Plan Development – using information from the BIA to develop the actual BCP Plan, includes testing

· Plan Approval and Implementation – This involves getting final management approval, creating awareness, updating as needed

Scope and Plan Initiation –

· Creating the scope

· Creating detailed account of work required

· Listing the resources to be used

· Defining management practices

Roles and Responsibilities

· BCP is enterprise wide, requires involvement from many personnel enterprise wide

BCP Committee – Responsible to create, implement and test the plan

· Made up of

· Senior Management

· Business Units

· Information Systems

· Security Administrator

Senior Managements Role

· Has ultimate responsibility for all phases of the plan

· Senior Management support is critical

Due Diligence - Stock Holders may hold Senior Management responsible as well as the Board of Directors if a disruptive event causes losses that could have been prevented with base standards of care

BCP Involvement

Who Does What

Executive Management Initiates project, gives final approval, gives ongoing support

Senior Business Unit Management Identifies and prioritizes time critical systems

BCP Committee directs the planning, implementation and test processes

Functional Business Units Participate in implementation and testing

Business Impact Assessment

· Helps to document what impact a disruptive event will have on the business

Vulnerability Assessment

Three Elements:

· Criticality Prioritization – every business unit process is identified and prioritized

· Downtime Estimation – Determine Maximum Tolerable Downtime (MTD), often much shorter than expected

· Resource Requirements – resource requirements for critical processes

Business Impact Analysis

Four Steps

· Gathering assessment material

· Perform the assessment

· Analyze the compiled information

· Document the results

Gathering assessment material

· Org Chart to determine functional relationships

· Examine Business Success Factors, priorities and alternate processing

The Vulnerability Assessment

· Often part of the BIA, similar to risk assessment, smaller than full risk assessment

· Both quantitative and qualitative approaches

· Conduct a loss impact analysis.

· Necessary to define loss criteria quantitatively and qualitatively

Quantitative Loss Criteria

· Incurring financial loss from loss of revenue or capital expenditure

· Additional operational expenses incurred due to disruptive event

· Incurring financial loss from resolution of violated contract

· Incurring financial loss from regulatory compliance

Qualitative Loss Criteria

· Loss of competitive edge

· Loss of public confidence

· Incurring public embarrassment

Critical Support Areas must be defined:

· Telecommunications, data communications, Information Technology Areas

· Physical Infrastructure or plant facilities, transportation

· Accounting, Payroll, transaction processing, customer service, purchasing

Analyze the Compiled Information

· Documenting the process

· Identify Interdependencies

· Determine acceptable interruption period

· Documentation and Recommendation Full documentation of all processes, procedures, analysis and results

Business Continuity Plan Development

· Use of information from BIA to create recovery strategy plan

· Map out strategy:

· Defining the continuity strategy

· Document the continuity strategy

Criticality Survey – helps to identify the most critical business functions

IT Department

· Ensures adequate backup and restoration process

· Ensures physical security of vital network and hardware components

· Ensuring sufficient logical security

· Ensuring adequate system administration

Defining the Continuity Strategy

Elements of Continuity Strategy

· Computing – needs to preserve hardware and software, communication lines, applications and data

· Facilities – needs to address use of buildings

· People – defined roles in implementing the strategy

· Supplies and equipment – paper, forms, HVAC, security equipment

Documenting the Continuity Strategy

· Creation of documentation

Plan Approval and Implementation

Last step plan is implemented

· Approval by Senior Management – must be able to make informed decisions in the event of a disaster

· Creating awareness – training and awareness enterprise wide

· Maintenance of the plan – plans get outdated quickly

Disaster Recovery Planning

· Comprehensive statement of actions to be taken before, during and after a disruptive event causes loss of Information Systems.

· Primary objective is to provide an alternate site and return to primary site in a minimal time frame

Goals and Objectives of DRP

· Provide an organized way to make decisions if a disruptive event occurs

· Reduce confusion and enhance the ability to deal with crisis

· Planning and development must occur before the disaster

· Objectives Protect the company from major computer services failure

· Minimize the risk from delays in providing services

· Guarantee reliability of standby systems through testing

· Minimize decision making required by personnel during a disaster

· DRP assumes BIA has been done, now focusing on the steps needed to protect the business.

Data Processing Continuity Planning – planning for disaster and creating plans to cope with it

Data Recovery plan Maintenance – keeping plans up to date

Data Processing Continuity Planning

· Mutual Aid Agreements – reciprocal agreement

· Arrangement with another company with similar hardware or software configurations

· Agreement by both parties, assumes sufficient capacity in time of need (Big Assumption)

· Should only be considered if no other options, or perfect partner (i.e. subsidiary)

· Advantages:

· Very little or no cost

· If processing requirements are similar it may be workable

· Disadvantages:

· Highly unlikely the capacity will exist

· Severely limits responsiveness and support

Subscription Service

· Third party commercial services provide alternate backup and processing facilities

· Most common of the implementations.

· Three Basic Forms:

Hot Site

Warm Site

Cold Site

DOMAIN 6-SOFTWARE ASSURANCE POLICIES AND PROCESSES

Covers computer crimes, preserving evidence and conducting basic investigations.

Many computer crimes go unreported – difficult to estimate.

Two Categories:

· Crimes against the computer

· Crimes using a computer

Most Common Crimes:

· Denial of Service (DoS)- hogging system resources to point of degraded service

· Theft or passwords

· Network Intrusions – unauthorized penetrations

· Emanation Eavesdropping – interception of computer terminal images through use of Radio Frequency (RF) Signals. U.S. Government developed Tempest to defeat this by shielding RF.

· Social Engineering – social skills to gain information

· Illegal Content of Material - porn

· Fraud – using computer to perpetuate crimes, i.e. auctions of non-existent merchandise

· Software Piracy – illegal copying

· Dumpster Diving – paper trails

· Malicious Code – viruses and Trojan Horses

· Spoofing of IP Addresses – inserting false IP to disguise original location

· Information Warfare – attacking infrastructure of a Nation, including military and power grid

· Espionage

· Destruction or alteration of information

· Use of readily available Attack Scripts – Script Kiddies, unskilled users

· Masquerading – pretending to be someone else

· Embezzlement – Illegally acquiring funds

· Data-Diddling – modification of data

· Terrorism

Examples of Crime –

· DDoS of Yahoo, Amazon and ZDNet in Feb. 2000

· Love Letter Worm in May of 2000

· Kaiser – transmissions of personal client information to unintended recipients in Aug. 2000

· Penetration of Microsoft, access to source code in Oct. 2000

· Mitnik's attacks against telephone companies 1989, broke into Tsutomo Shimomurs Corp in 1995 and was arrested

· Wisconsin medical records in 1982

· Morris internet worm DDoS Cornell Student in 1988

· Germans working for the KGB accessed US Classified Systems – The Cuckoo’s Egg

Laws have been passed in many countries. International boundaries cause issues. Being addressed by United Nations, Interpol, European Union and the G8.

Technology outpaces Law

· Law enforcement relies on traditional laws against embezzlement, fraud, Denial of Service, wiretapping and digital currency to prosecute.

Many types of legal systems in the world

Common Law – United States, United Kingdom, Australia and Canada

· Islamic Law

· Religious Law

· Civil Law – France, Germany, Quebec

Common Law – United States

Three Branches of Government

Legislative – makes the statutory laws

Administrative – administrative laws

Judicial – common laws found in court decisions

Compilation of Statutory Law

Arranged in order of enactment or as statutory codes

In the U.S. held in Statutes at Large in the United States Code (U.S.C.)

Usually quoted “18 U.S.C § 1001 (1992)”

· The Code Title Number

· Abbreviation of the Code (U.S.C.)

· Statutory section

· Date of the edition

Title 18 of the 1992 Edition of the U.S.C. - contains Crimes and Criminal Procedures. Many computer crimes are prosecuted under this title.

US Computer Fraud and Abuse Act – addresses fraud using government computers can be found at 18 U.S.C. § 1030 (1986)

Other Titles Are:

Title 12 – Banks and Banking

Title 15 – Commerce and Trade

Title 26 – Internal Revenue Code

Title 49 - Transportation

Compilation of Administrative Law

Chronologically listed in administrative registers or by subject matter in administrative codes. Federal Register (Fed. Reg.) And Code of the Federal Register (C.F.R.)

Referenced “12 C.F.R. § 100.4 (1992)

· The Title Number Federal Register (C.F.R.)

· Abbreviation of the Code (C.F.R.)

· Section number

· Year of publication

Compilation of Common Law - common law from court decisions

· Common law is compiled as Case Reporters in chronological order and Case Digests by Subject matter

Common Law System Categories – not to be confused with common law from court decisions

· Criminal Law – Violates government laws for the protection of the people. Financial penalties and imprisonment

· Civil Law – wrong inflicted upon an individual or organization results in damage or loss, no prison

· Administrative Law – standards of performance and conduct, financial penalties and imprisonment

Intellectual Property Law

· Patent – Provides owner legally enforceable right to exclude others for specified time (U.S. 17 years)

· Copyright – Protects original works of authorship, can be used for software and databases

· Trade Secret – Secures confidentiality of proprietary technical and business related information

· Company must meet requirements:

· Invested resources to develop the information

· Valuable to the business

· Valuable to competitor

· Non-obvious information

· Trademark – establishes word, name, symbol, color or sounds used to identify and distinguish goods

Information Privacy Laws

· Intent varies widely from country to country

· European Union - has developed more protective laws for individual privacy

· Transfer of data from EU to US is prohibited unless equivalent protections are in place

EU Principles Include:

· Data collected in accordance with law

· Information cannot be disclosed without consent

· Records should be accurate and up to date

· Data should be used for the purpose it was collected

· Individuals entitled to report of information kept about them

· Transfer of data is prohibited unless equivalent protections are in place

Health Care Issues:

· Access controls do not provide sufficient granularity to implement least privilege rule

· Most off the shelf systems do not have adequate controls

· Systems must be accessible to outside parties

· Access to Internet creates potential problems

· Criminal and civil penalties can be imposed

· Public perception of large organizations misusing data

Health Care should follow: (based on E.U. principles)

· Individual should have ability to monitor stored information about themselves, ability to correct information

· Data should be used for the purpose it was collected

· Organization should provide safeguards to ensure data is used for the purpose it was collected

· Existence of private information should not be kept secret

Reference:

Tipton, H. F., & Nozaki, M. K. (2005). Information security management handbook. Boca Raton, FL: Auerbach.