C706- Secure Software Design 1
A study of real-world software security initiatives organized so that you can determine where you stand with your software security initiative and how to evolve your efforts over time.
BSIMM (Building Security In Maturity Model)
What is the agile development approach?
Based on both iterative and incremental development methods. Requirements and solutions evolve through collaboration among self-organizing, cross-functional teams, and a solution resulting from every iteration is reviewed and refined regularly throughout the process. The Agile method is a time-boxed iterative approach that facilitates a rapid and flexible response to change, which in turn encourages evolutionary development and delivery while promoting adaptive planning, development, teamwork, collaboration, and process adaptability throughout the lifecycle of the project.
Content is based on the principle that software security is fundamentally a software engineering problem and must be managed in a systematic way throughout the SDLC.
Build Security In (BSI)
Developers and team members involved in threat modeling must know how to do which two things?
Build software Deconstruct software
CWE is an abbreviation for _____
Common Weakness Enumeration
Under 44 U.S.C., Sec. 3442 ??? is defined as: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
Confidentiality
What are some examples of security principles in the threat modeling process?
Confidentiality Integrity Availability Authentication Authorization Nonrepudiation
What are the three primary goals of the secure software development process?
Confidentiality, integrity, and availability
What is the NIST SAMATE (Software Assurance Metrics And Tool Evaluation) project?
Dedicated to improving software assurance by developing methods to enable software tool evaluations, measuring the effectiveness of tools and techniques, and identifying gaps in tools and methods.
DIACAP is an abbreviation for _____
Department of Defense Information Assurance Certification and Accreditation Process
DHS is an abbreviation for _____
Department of Homeland Security
What are functional requirements?
Describe what an application must do to serve a business need. i.e. load a web page
What SAMM business function describes the process to define software requirements and create software Includes: threat modeling, threat assessment, security requirements, security architecture
Design
DAST is an abbreviation for _____
Dynamic Application Security Testing
What terms describe quality code?
Ease of use, reusable, and maintainable
What are the five phases of the IDEAL Model?
Five phase model: -Initiating -Diagnosing -Establishing -Acting -Learning
What tools are primarily used in the SDL?
Fuzzing, static analysis, and dynamic analysis
What SAMM business function describes activities an organization undertakes to manage its software development process. Includes: strategy, metrics, policy, compliance, education, guidance
Governance
Standard provides guidance to help organizations embed security within their processes that help secure applications running in the environment, including application lifecycle processes.
ISO/IEC 27034
What are Bugtraq IDs?
Identifiers for a commercially operated vulnerability database that are used in security advisories and alerts, as well as for discussions on the Bugtraq mailing list.
What is the purpose of SAST?
Identifies vulnerabilities during the development or quality assurance phase of a project. It provides line-of-code level detection that enables development teams to remediate vulnerabilities quickly
What is the purpose of DAST?
Identifies vulnerabilities within a production application. These tools are used to quickly assess a system's overall security and are used within both the SDL and SDLC.
What SAMM business function describes building and deploying software components and managing flaws in those components Includes: secure build, secure deployment, defect management
Implementation
What is the Lean approach?
In its simplest form, you select, plan, develop, test, and deploy one feature before you select, plan, develop, test, and deploy the next feature; The objective is to further isolate risk to the level of an individual feature.
Under 44 U.S.C., Sec. 3442 ??? is defined as: The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.
Information Security
Under 44 U.S.C., Sec. 3442 ??? is defined as: Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.
Integrity
What level of the SW/CMM is little or no defined software development process; people charging ahead in a disorganized fashion?
Level 1: Initial
What level of the SW/CMM is basic lifecycle management processes introduced? Reuse of code in an organized fashion and repeatable results expected from similar projects.
Level 2: Repeatable
What level of the SW/CMM is software developers operate according to a set of formal, documented software development processes? all projects take place within constraints of new standardized management model.
Level 3: Defined
What level of the SW/CMM is Quantitative measures used to gain a detailed understanding of the development process?
Level 4: Managed
What level of the SW/CMM is the process of continuous improvement occurs; sophisticated software development processes in place to ensure feedback from one phase reaches to previous phase to improve future results
Level 5: Optimizing
Bringing in the security team into the development process early as possible benefits in which ways?
Lower cost of security control implementation Vulnerability mitigation
What is the spiral method?
Metamodel that allows for multiple iterations of a waterfall-style process where the waterfall process is applied to the development of each prototype - created by Barry Boehm in 1988
NVD is an abbreviation for _____
National Vulnerability Database
Open-source product maintained by OWASP. Provides a framework for integrating security activities into software development and maintenance process & offer organizations ability to assess maturity. Five business processes: governance, design, implementation, verification, operations
OWASP Open SAMM (OWASP Software Assurance Maturity Model)
What are some examples of design principles in the threat modeling process?
Open design Fail-safe design Least privilege Separation of Duties Least common mechanism Economy of Mechanism Complete Mediation Psychological Acceptability Weakest Link Leveraging Existing Components Defense in Depth
What SAMM business function describes actions to maintain security throughout the software lifecycle after code is released Includes: incident management, environment management, operational management
Operations
What are the privacy ratings?
P1 High Privacy Risk P2 Moderate Privacy Risk P3 Low Privacy Risk
One of the most important components of the SDL process includes protecting user's _____
Privacy
What are the key deliverables for the Security Assessment phase (A1)?
Product risk profile SDL project outline Applicable laws and regulations Threat profile Certification requirements List of third-party software
What is the software security architect ultimately responsible for?
Providing architectural and technical guidance to product security across all of the company
Secure code does not mean _________ ___________
Quality code
What are two goals of the SDL?
Reduce the number of security vulnerabilities & privacy problems and reduce the severity of the vulnerabilities that remain.
Designed to facilitate gradual, consistent, and cost-effective implementation of the SDL by development organizations outside of Microsoft; enables development managers and IT policy makers to assess the state of the security in development.
SDL Optimization Model
What is a Software Security Evangelist (SSE)?
SSCs in training & evangelist for the overall software product security program promulgated policy, enforcing policy, and evangelizing overall SDL process
What is phase A1?
Security Assessment
What are the Phases of the SLC?
Security Assessment Architecture Design and Development Ship Post Release Support
SDL vs SDLC
Security Development Lifecycle: aimed at developing secure software. Software Development Lifecycle: aimed at developing quality software.
What does the NCSD Software Assurance (SwA) Program do?
Seeks to reduce software vulnerabilities, minimize exploitation, and address ways to improve the routine development and deployment of trustworthy software products
What is the model that describes the principles and practices underlying software process maturity; the quality of software depends on the quality of its development process. 5 Stages: Initial, Repeatable, Defined, Managed, Optimizing
Software Capability Maturity Model (SW-CMM/CMM)
Who is a key player in software security practice, survival, and success; will touch every element of the SDLC and SDL; and should be apart of the sign-off process at each stage of the SDLC process?
Software Security Architect
What are these: BSIMM (Building Security In Maturity Model) OWASP Open SAMM (OWASP Software Assurance Maturity Model)
Software Security Maturity Models
SAST is an abbreviation for _____
Static Application Security Testing
What are key components of the PIA?
Summary of the legislation Required process steps Technologies and techniques Additional resources
What does the CWE do?
The CWE provides a standard means for understanding residual risks and thus enables more informed decision making by suppliers and consumers concerning the security of software.
NCSD is an abbreviation for _____
The Department of Homeland Security National Cyber Security Division
What is SAFECode and what do they do?
The Software Assurance Forum for Excellence in Code (SAFECode) is a nonprofit organization dedicated to increasing trust in information and communications technology products and services through the advancement of effective software assurance methods.
What is the NVD?
The U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP); databases of security checklists, security-related software flaws, misconfigurations, product names, and impact metrics.
What is Dynamic Analysis?
The analysis of computer software that is performed by executing programs on a real or virtual processor in real time
What is static analysis?
The analysis of computer software that is performed without actually executing programs
What are the two challenges to fix vulnerabilities?
The cost and most secure activities happen post-release
At which point in time is it better to identify and manage security risks?
The earlier, the better
What is the iterative waterfall method?
The overall project is divided into various phases, each executed using the traditional Waterfall method; Dividing larger projects into smaller identifiable phases results in a smaller scope of work for each phase
What is software security?
The process of building & designing secure software prior to release. Its proactive.
What's purpose is to provide details on where and to what degree privacy information is collected, stored, or created within the software that you are developing; should continue to be reviewed and updated as major decisions occur or the proposed use of the software and scope change significantly
The purpose of the PIA
Limiting the elevation of privilege is a significant part of ______ ______ as a core component of the Architecture (A2) phase of our SDL
Threat modeling
What is the Software Security Champion's (SSC) role?
Time to be trained in software security and on the centralized and business unit-specific software security tools, plans, and processes; and, most important, must not only know how to develop (build) software but also how to deconstruct it (take it apart) while "thinking like a hacker" regarding all possible paths or exploits (attack planes) that an adversary could take to exploit the software.
What is necessary before developing a Privacy Impact Assessment (PIA)?
To evaluate what regulatory legislation or policies are applicable to the software you are developing
What is the advantage of Static Analysis?
Tools can review a great deal of code very quickly with no lack in efficiency, something humans cannot do well
Which SDL model is the most well known and mature?
Trustworthy Computing Security Development Lifecycle
What SDL models are available for the secure software development process?
Trustworthy Computing Security Development Lifecycle Cigital Software Security Touchpoints model OWASP SDL CISCO Secure Development Lifecycle (CSDL)
What is the Microsoft threat modeling and process steps?
Understand the potential security threats to the identified system/software, determine the risk, and mitigate those risks. To be more specific, Microsoft uses the following five steps in Threat Modeling: Identify security objectives Survey the application Decompose it Identify threats Identify vulnerabilities
What is the waterfall development approach?
Uses requirements that are already known, each stage is signed off before the next commences, and requires extensive documentation because this is the primary communication mechanism throughout the process. - can only go back one phase - created by Winston Royce 1970
What SAMM business function describes activities to confirm that code meets business and security requirements Includes: architecture assessment, requirements-driven testing, secure testing
Verification
The process of understanding the potential security threats to the system, determine risk, and establish appropriate mitigations (What? How bad is it? How can it be fixed?)
What is threat modeling?
In OOP, what is polymorphism?
characteristic of an object that allows it to respond with different behaviors to the same message or method because of changes in external conditions
In OOP, what is a class?
collection of the common methods from a set of objects that define the behavior of those objects is a class
In OOP, what is a message?
communication to or input of an object
In OOP, what is delegation?
forwarding of a request by an object to another object or delegate; occurs when an object does not have a method to handle the message
In OOP, what is a method?
internal code that defines the actions an object performs in response to a message
In OOP, what is coupling?
level of interaction between objects -lower coupling: less interaction, better software design, objects more independent and easier to troubleshoot/update
In OOP, what is inheritance?
methods from a class (parent or superclass) are inherited by another subclass (child) or object
In OOP, what is an instance?
objects are instances of or examples of classes that contain their methods
In OOP, what is a behavior?
results or output exhibited by an object. The results of a message being processes through a method
What is application security?
the process of protecting the complete & designed secure software after release. Its reactive.
In OOP, what is cohesion?
the strength of the relationship between the purposes of methods in the same class -high cohesion: all methods have similar purposes (preferred) -low cohesion: methods do not have similar purposes (system is not well designed)
What is the acronym to remember IDEAL/SW-CMM phases?
"I...I, Dr. Ed, am lo (w)" Initiating, Initial Diagnosing, Repeatable Establishing, Defined Acting, Managed Learning, Optimizing
What percent of current business security vulnerabilities are found within software applications rather than the network boundaries?
70%
What is the discovery meeting?
A SDL kick-off meeting where the key SDLC stakeholders get on the same page at the beginning of the process so that security is built in rather than bolted on post-release.
What is fuzzing or fuzz testing?
A black-box software testing technique which can be automated or semi-automated, which provides invalid, unexpected, or random data to the inputs of a computer software program
What is The MITRE Corporation Common Computer Vulnerabilities and Exposures (CVE)?
A list of information security vulnerabilities and exposures that aims to provide common names for publicly known problems.
In Scrum, what is the basic unit of development?
A sprint
To define what needs to be protected and how it will be protected. It also includes analyzing policies that exist outside the SDL domain so designers and architects will know what the security and privacy features of the product are and how they must be implemented.
A2 policy compliance analysis
What increases the attack surface?
Accessibility
What are nonfunctional requirements (NFRs)?
Address how well the functional requirements are met or how they constrain the functional requirements to specified operating ranges i.e. how long it takes to load the web page
What is the Scrum approach?
Adopts an empirical approach, accepting that the problem cannot be fully understood or defined and focusing instead on maximizing the team's ability to deliver quickly and to respond to emerging requirements
What is the Open Web Application Security Project (OWASP)?
An industry-standard resource that is used by development organizations to raise awareness of the most critical web application vulnerabilities
What is phase A2?
Architecture
What is meant by the term "attack surface" regarding software?
Attack surface refers to the entry and exit points of software. Where can a hacker touch or access the system/software
Under 44 U.S.C., Sec. 3442 ??? is defined as: Ensuring timely and reliable access to and use of information.
Availability
