CSCD 303Essential ComputerSecuritySpring 2013

Lecture 18Creating Secure Programs

Overview

• Developing Secure Programs– Traditional– Secure Code Model– Security Threats– What Microsoft Does

Secure Software

What does it mean for software to be secure? Software security is an idea implemented

to protect software against malicious attack and other hacker risks so that the software continues to function correctly under such potential risks

Build Security In

Security First, Designing with SecurityAll these names were used to address the

“new” concept to include security in with the design of the software

Prior to this radical idea, security was and still is an afterthought to most popular software

Here is a good summary of this concept by Gary McGraw

http://searchsecurity.techtarget.com/opinion/Gary-McGraw-on-software-security-assurance-Build-it-in-build-it-right

There are many reasons for Security First ….

Why Put Security First?

1. Adding security later is wrapping security around existing features, not designing features with security in mind.

2. Adding security later is expensive.3. Adding security may change how

you implement application features.4. Adding security may change user

interface.

How is Software Created

Modern software systems Developed through a software

development process or model Many different development models Look at the most classic and then see

how secure development fits within this model

Waterfall ModelRequirements – defines needed information, function, behavior, performance and interfaces.Design – data structures, software architecture, interface representations, algorithmic details.Implementation – source code, database, user documentation, testing Test – Test each component and integrated testsInstallation – self explainedMaintenance – Fix minor problems, bug fixes and updates

Waterfall Strengths

Easy to understand, easy to use Provides structure to inexperienced staff Milestones are well understood Sets requirements stability Good for management control (plan, staff, track) Works well when quality is more important than cost or schedule

Waterfall Deficiencies All requirements must be known up front Deliverables created for each phase are considered frozen – inhibits flexibility Can give a false impression of progress Does not reflect problem-solving nature of software development – iterations of phases Integration is one big bang at the end Little opportunity for customer to preview the system (until it may be too late)

Using Waterfall Model

Where could we inject security into the development process ?And, what could we do?

Security Development Lifecycle

Product Inception Assign resource

Security plan

DesignDesign guidelines appliedSecurity architectureSecurity design reviewShip criteria agreed upon

Guidelines & Best PracticesCoding StandardsTesting based on threat modelsTool usage

Security PushSecurity push trainingReview threat modelsReview codeAttack testing Review against new threatsMeet signoff criteria

Final Security Review (FSR)Review threat modelsPenetration Testing Archiving of Compliance Info

Security ResponseFeedback loop- Tools/Processes

- Postmortems- SRLs

RTM & DeploymentSignoff

Design Response

Threat ModelingModels createdMitigations in design and functional specs

Security Docs & ToolsCustomer deliverables for secure deployment

Requirements Implementation Verification Release

Model developed by Microsoft

Version 02U-1 12

Security Development Lifestyle Artifacts

Security in the Development Cycle

Security Modeling in Development is a RiskMitigation Strategy

• You will not find all the bugs…• You will not see all the

vulnerabilities…• Your design will have errors of

omission and oversight– But, better than the alternative

which is do nothing

Security Modeling

Another way to label the process of developing secure software

Techniques to evaluate an application’s overall security or assess the impact of a specific threat

Objectively identify vulnerabilities and address countermeasures

Integrated steps to take in the development process

Security Modeling – The Process

Define threatsConsider the data stored in the system, and how it can be

misused

Consider the architecture of the system, and the opportunities it affords malicious users

Specific threat identification processes can be usedAssess the Impact

You’ve found a vulnerability… what happens if someone actually finds it? How badly would you or your users be affected?

Implement a Countermeasure Mitigate the risk to the best of your ability – code a

preventative action, limit the exposure

Defining the Threats Decompose your application to ask questions about how each use case or application component could go awry

STRIDE STRIDE is a classification scheme for characterizing known threats according to the kinds of exploit that are used (or motivation of the attacker).

Spoofing IdentityTampering with DataRepudiationInformation DisclosureDenial of ServiceElevation of Privilege

DREADDREAD is a classification scheme for quantifying, comparing and prioritizing

the amount of risk presented by each evaluated threat.

STRIDE Threat CategorizationMicrosoft Developed ThisSpoofing

ex: Replaying authentication transaction.Tampering

ex: Modifying authentication files to add new user.Repudiation

ex: Denying that you purchased items you actually did.Information disclosure

ex: Obtaining a list of customer credit card numbers.Denial of service

ex: Consuming CPU time via hash algorithm weakness.Elevation of privilege

ex: Subverting a privileged program to run your cmds.

Microsoft article on Stride with Example

http://msdn.microsoft.com/en-us/magazine/cc163519.aspx

Stride in a Nutshell OWASP overview of Stride and other threat

modelshttps://www.owasp.org/index.php/Threat_Risk_Modeling

Version 02U-1 19

Evaluate Risk with DREAD

Damage Potential Extent of damage if vulnerability exploited.Reproducibility How often attempt at exploitation works.Exploitability Amount of effort required to exploit vulnerability.Affected Users. Ration of installed instances of system that would be affected if exploit became widely available.Discoverability Likelihood that vulnerability will be discovered.

Assessing Vulnerabilities ImpactDREAD aims to quantify a threat

DREAD modeling influences the thinking behind setting the risk rating, and is also used directly to sort the risks. The DREAD algorithm, shown below, is used to compute a risk value, which is an average of all five categories.

Assign a value between 1 and 10 and use the mean

Risk_DREAD = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5

Damage Potential• 0 – no damage; 10 – complete system damage

Reproducibility• 0 – Almost impossible to reproduce; 10 – can reproduce at any time

Exploitability• 0 – Extremely sophisticated skills required; 10 – anybody with a browser

Affected Users• 0 – No users; 10 – All users (or beyond… think VA data leak)

Discoverability• 0 – Requires source code; 9 – details of exploit are in public domain; 10 – it’s

in easily discoverable data in the application itself.

Threat Modeling in General

Version 02U-1 22

Goals of Threat Modeling

1. Understand threats to guard against during requirements analysis.

2. Provide basis for which security mechanisms to include during design.

3. Verify security of system design.4. Provide basis for prescribing secure

implementation practices.5. Provide basis for testing system

security after implementation.

Version 02U-1 23

Threat Modeling Process

1. Understand adversary’s view of system

2. Evaluate threats

Version 02U-1 24

Understanding the Adversary’s View1. Identify System Assets.– System resources that an adversary might

attempt to access, modify, or steal.– Ex: credit cards, network bandwidth, user access.

2. Identify Entry Points.– Any location where data or control transfers

between the system being modeled and another system.

– Ex: network sockets, RPCs, web forms, files

3. Determine Trust Levels.– Privileges external entities have to legitimately

use system resources.

Version 02U-1 25

Evaluate Threats

Identify Threats For each entry point, determine how an

adversary may attempt to affect an asset. Based on asset, predict what adversary would

try to do and what his goals would be.

Analyze ThreatsDecompose threats into individual, testable

conditions using techniques like attack trees.Evaluate risk of threat with DREAD categories.

Version 02U-1 26

Identify Threats Can an unauthorized network user view

confidential information such as addresses or passwords?

Can an unauthorized user modify data like payments or purchases in the database?

Could someone deny authorized users access to the application?

Could an authorized user exploit a feature to raise their privileges to administrator level?

Version 02U-1 27

Analyze Threats

• Decompose threats into individual, testable conditions using attack trees

• Attack Trees– Hierarchical decomposition of a threat– Root of tree is adversary’s goal in the

attack– Each level below root decomposes the

attack into finer approaches– Child nodes are ORed together by default– Special notes may indicate to AND them

Version 02U-1 28

Attack Trees—Graph Notation

Goal: Read file from password-protected PC

Read File

Get Password Network Access Physical Access

Search Desk Social Engineer Boot with CD Remove hard disk

Version 02U-1 29

Attack Trees—Text NotationGoal: Read message sent from one PC to another

1. Convince sender to reveal message.1.1 Blackmail.1.2 Bribe.

2. Read message when entered on sender’s PC.1.1 Visually monitor PC screen.1.2 Monitor EM radiation from screen.

3. Read message when stored on receiver’s PC.1.1 Get physical access to hard drive.1.2 Infect user with spyware.

4. Read message in transit.1.1 Sniff network.1.2 Usurp control of mail server.

Other Stages Secure Development

Version 02U-1 31

Implementation

Coding standardsAcceptable libraries and functions.Checklists.

Static analysis toolsIdentifies common errors.

Code reviewsMore effective than testing in many

reports.

Version 02U-1 32

Verification

Fuzz TestingAutomatic testing with random data.

Unit TestsTest security features.

Penetration TestingDriven by application risks.Threat model identifies most important

assets and entry points.

Version 02U-1 33

Maintenance

Prepare before release time.Receiving vulnerability reports.Releasing security advisories.Developing, testing, and distributing

patches.

Microsoft Security Development

Version 02U-1 35

SDLC at MicrosoftManagement support

Bill Gates letter about 2002 security push

http://www.wired.com/techbiz/media/news/2002/01/49826

Mandatory educationFor managers and engineers.Annual updates.

MetricsEducation coverage.Vulnerabilities discovered.

Central Security TeamEnsures someone is responsible.Keeps process and education updated.

Engineering Excellence

Raise the bar of software securityRaise the bar of software securityImproved development processImproved development process

New tools designed to help developersNew tools designed to help developers

Guidance and training focused on secure codingGuidance and training focused on secure coding

Advance the state of the art of Advance the state of the art of secure software developmentsecure software development

Quality & Engineering ExcellenceImproved Development Process

Threat modelingThreat modelingCode inspectionCode inspectionPenetration testingPenetration testing

Unused features off by defaultUnused features off by defaultReduce attack surface areaReduce attack surface areaLeast PrivilegeLeast Privilege

Prescriptive GuidancePrescriptive GuidanceSecurity Tools Security Tools Training and EducationTraining and Education

Community EngagementCommunity EngagementTransparencyTransparencyClear policyClear policy

39Source: Microsoft Security Bulletin Search

6565

3535

DaysDays

30 90150

210270

330390

450510

570630

690720

Quality & Engineering ExcellenceHelping Developers Write More Secure Code

.NET Framework 1.1.NET Framework 1.1Cryptographic APIsCryptographic APIsIntegrated PKIIntegrated PKI

Visual Studio .NET 2003Visual Studio .NET 2003Security ToolsSecurity ToolsWeb Services EnhancementsWeb Services Enhancements

Microsoft Security Developer CenterMicrosoft Security Developer CenterWriting Secure Code v2Writing Secure Code v2Developer webcastsDeveloper webcasts

41

Education for the SDL

42

Outreach And Communications

Pre Pre ReleaseRelease

Security Bulletin Advance Notification - three business days prior to release

Second Second TuesdayTuesday

Release Release DayDay

Updates posted on Download Center, Windows Update and/or Office Update

Bulletins posted

RSS Feeds

Customer email and instant message notifications

Community outreach

MS Field alerts and call downs

Post Post ReleaseRelease

Security Bulletins Webcast (Wednesday following release, 11AM PT)

Supplementary Webcasts if needed

Monitor bulletin uptake and customer issues through PSS and Windows Update

Bulletin maintenance

43

Customer Process Improvement

Build a more Build a more Simplified, Simplified,

Manageable Manageable ProcessProcess

Enhance and Enhance and Improve Bulletin Improve Bulletin

Content Content

Expand Expand Resources and Resources and

SupportSupport

Moved to monthly release of security bulletins:A predictable, manageable processEnable advance planning and preparationsSoftware Update Validation Program to help ensure quality

Advance notification three business days prior to releasePublicly posted on Microsoft.com; Email alert available

Revamped technical security bulletin format:Added a monthly summary bulletin that includes a summary table of affected software for each bulletin

Added mitigations and workarounds per vulnerability

Added more information and guidance on distribution and deployment

Improved bulletin search tool on TechNet Security

Security AdvisoriesTechnical webcast on Wednesday following the releaseRSS feed for security bulletinsNew notification services, including a comprehensive version and instant message alertsMalicious Software Removal Tool

44

SSIRP - Software Security Incident Response Plan

Companywide process to deal with critical security threats

Mobilize Microsoft resources worldwide

Goals:Quickly gain a thorough understanding of the problem

Provide customers with timely, relevant, consistent information

Deliver tools, security updates and other assistance to restore normal operation

45

WatchWatch

Observe Observe environment to environment to detect any detect any potential issuespotential issues

Leverage existing Leverage existing relationships with:relationships with:

PartnersPartners

Security Security researchers researchers and findersand finders

Monitor customer Monitor customer requests and requests and press inquiriespress inquiries

AlertAlertand and

MobilizeMobilize

Convene and Convene and evaluate severityevaluate severity

Mobilize security Mobilize security response teams response teams and support and support groups into two groups into two main groups:main groups:

Emergency Emergency Engineering TeamEngineering Team

Emergency Emergency Communications Communications TeamTeam

Start monitoring Start monitoring WW press interest WW press interest and customer and customer support lines for support lines for this issuethis issue

AssessAssessandand

StabilizeStabilize

Assess the Assess the situation and the situation and the technical technical information information availableavailable

Start workingStart workingon solutionon solution

Communicate Communicate initial guidance initial guidance and workarounds and workarounds to customers, to customers, partners and partners and presspress

Notify and inform Notify and inform Microsoft sales Microsoft sales and support fieldand support field

ResolveResolve

Provide Provide information and information and tools to restore tools to restore normal operationsnormal operations

Appropriate Appropriate solution is solution is provided to provided to customers, such customers, such as a security as a security update, tool or fixupdate, tool or fix

Conduct internal Conduct internal process reviews process reviews and gather and gather lessons learnedlessons learned

Guidance, Tools & Response Delivering Support and Creating Community

Security toolsSecurity toolsMicrosoft Baseline Security AnalyzerMicrosoft Baseline Security Analyzer

Security Bulletin Search ToolSecurity Bulletin Search Tool

Guidance and trainingGuidance and trainingSecurity Guidance CenterSecurity Guidance Center

E-Learning ClinicsE-Learning Clinics

Community engagementCommunity engagementNewslettersNewsletters

Webcasts and chatsWebcasts and chats http://www.microsoft.com/securityhttp://www.microsoft.com/security http://www.microsoft.com/protecthttp://www.microsoft.com/protect

Microsoft ResourcesGeneralGeneral

http://www.microsoft.com/securityhttp://www.microsoft.com/security

XP SP2 Resources for the IT ProfessionalXP SP2 Resources for the IT Professionalhttp://www.microsoft.com/technet/winxpsp2http://www.microsoft.com/technet/winxpsp2

Security Guidance CenterSecurity Guidance Centerhttp://www.microsoft.com/security/guidancehttp://www.microsoft.com/security/guidance

ToolsToolshttp://www.microsoft.com/technet/Security/toolshttp://www.microsoft.com/technet/Security/tools

How Microsoft IT Secures MicrosoftHow Microsoft IT Secures Microsofthttp://www.microsoft.com/technet/itsolutions/msithttp://www.microsoft.com/technet/itsolutions/msit

E-Learning ClinicsE-Learning Clinicshttps://www.microsoftelearning.com/securityhttps://www.microsoftelearning.com/security

Events and WebcastsEvents and Webcastshttp://www.microsoft.com/seminar/events/security.mspxhttp://www.microsoft.com/seminar/events/security.mspx

Secure Software Resources

Waterfall Model http://www.techrepublic.com/article/understanding-

the-pros-and-cons-of-the-waterfall-model-of-software-development/6118423

David LeBlanc's Blog about Dreadhttp://blogs.msdn.com/b/david_leblanc/archive/

2007/08/13/dreadful.aspx

Gary McGraw's site Secure Code stuff http://www.cigital.com/~gem/

End

System Security Flaws

( …Its the people)

Lab this week is on buffer overflow, do on your own