Cybersecurity Principles Quiz

CR440 - Security Application

• This course covers application security requirements.
• The course uses OWASP ASVS (Application Security Verification Standard).
• ASVS is a standard for web application security, guiding the development of secure web applications.
• ASVS is currently at version 4.0.3.
• It is structured into three levels, offering varying assurance levels.
• OWASP provides a guide for developers to test application security.
• Links to the OWASP guide for web security testing and the testing framework will be included in the accompanying notes.

OWASP ASVS I

• Focuses on architectural designs and threat modeling.
• Includes guidelines on system architecture, concerning factors like Availability, Confidentiality, Integrity, Non-repudiation, and Privacy.
• Includes requirement on authentication, specifically passwords.
• Minimum password requirements (e.g., 12 characters).
• Password changes and validation checks.

OWASP ASVS II

• Highlights session management and access control.
• Includes unique and non-guessable session IDs.
• Rules for removing sessions and invalidating them.
• Access control and well-defined roles and permissions.
• Prevention of reusability for roles and permissions.
• Secure handling of input, utilizing validation and encoding processes.

OWASP ASVS III

• Focuses on cryptography-related requirements.
• Encoding of output data for security purposes.
• Secure handling and functioning of cryptographic modules.
• Proper use of random number generators.
• Secure management of access keys.
• Error and auditing practices.

OWASP ASVS IV

• Addresses management of stored information.
• Security and classification-based handling of stored info.
• Temporary storage of logs.
• Data protection, considering Confidentiality, Integrity, and Availability.

OWASP ASVS V

• Focuses on communication security protocols.
• Using TLS for secure data transmission.
• Updated recommendations for configuration and implementations of cryptographic algorithms/methods.
• Mitigation techniques for outdated or weak cryptographic algorithms.

OWASP ASVS VI

• Application logic and threat mitigation.
• Preventing malicious URLs or redirects.
• Ensuring safe and predictable application logic.
• Safeguards against malicious logic attacks and automated attacks.

OWASP ASVS VII

• File management and web service security standards.
• Requirements for secure handling of data from untrusted sources.
• Specific controls and permissions for accessing and handling web services.
• Adequate authentication, session management, and authorization for all web services.

OWASP ASVS VIII

• Emphasizes secure deployments, including cloud deployments.
• Secure and repeatable deployment environments.
• Secure dependencies and components.
• Importance of default security configurations, requiring conscious overwriting.

Testing Requirements and Quality Assurance

• Quality assurance and testing are crucial aspects of the course.
• OWASP provides a web security testing guide.
• Guides for different aspects of security testing for web applications.

OTG (Testing Guide)

• This is a testing guide that will show how developers can approach testing.

Architectural Review

• UML diagrams are discussed, providing insights into data flow and security measures.
• Data flow diagrams (DFDs) are useful for identifying potential threats.

Design Principles

• Several principles from the book "Adkins, 2020" regarding secure software architecture are outlined, such as designing programs for least privilege, which protects the system.
• There are also considerations focused on enabling clear understanding of the programming logic, adapting to changes in how the system might be employed, resilience to unexpected events, and mitigation of denial-of-service (DDoS) attacks.

Least Privilege

• Access controls are critical and must be as limited as possible.
• External input should be treated cautiously and not fully trusted.
• Access control based on roles, risks, and necessary access levels.
• Micro-Service Approach is suitable for fine-grained security.

Making Code Intelligible

• Developers need to understand the logic and intended behavior of the system to effectively detect bugs and flaws.
• Creating secure systems is facilitated by employing practices that focus on clarity and maintainability.
• Adaptability to changes (e.g., update to requirements/specifications) should be planned in advance.

Changes Implementation

• Changes should be incremental, limited in scope, and individually documented.
• Comprehensive testing is necessary, including unit tests.
• Modularization and isolation of changes prevent negative impacts (e.g., side effects on other functionalities).
• Gradual and controlled deployment procedures.

Easier Changes

• Upkeep and regeneration of solution components, for instance, by ensuring that dependencies are maintained.
• Consistent use of automated testing helps minimize issues during code changes.
• Utilize containerization for increased isolation and reproducibility.
• Micro-services and various types of deployment scheduling strategies.

Resilience I and II

• Important to make software components independently resilient.
• Maintain separate units across the system to prevent interconnected failures.
• System's resiliency should be automated so that it works as expected in cases of failure.
• Implementing ways to restore functionality if/when failures occur.

Recovery Techniques

• Creating mechanisms to restore the system when errors occur.
• Methods for disabling or revoking features, processes, roles, or access control lists.
• Flexible deployment speeds.
• Return to previous versions.

DDoS Attacks

• Methods for mitigating DDoS attacks.
• Using caching proxies to handle traffic spikes.
• Efficient and carefully-designed query and data access practices.

System Design and Critical Choices

• Architectural choices have a significant impact on the stability and security of a system.
• System design and choices are based on a well-established strategy.

Code Review

• Importance of reviewing the code and related design documents before release.
• Testing for bugs, and checking for discrepancies that may have been missed.

Dynamic Code Review

• Utilizing dynamic code review tools are essential.
• Tools help find errors not likely detected otherwise.
• Important insights provided by a code review process.

Advantages and Disadvantages of Various Validation Methods

• Understanding the strengths and weaknesses of different validation methods (e.g., checklists, TDD, etc.).

Development Driven by Testing

• Describe the process of creating applications following this approach.

• Demonstrate the steps used in the creation of a new application using this approach.

• Explain how the approaches described enhance code quality and security.

Test your knowledge on critical cybersecurity concepts. This quiz covers various aspects of security, error handling, and software robustness. Understand the best practices essential for protecting systems and data.