Security Design Principles

Fundamental Security Design Principles

• Design security measures in hardware and software to be as simple and small as possible for easier testing, verification, less costly maintenance, and simplified configuration.
• Base decisions on permission rather than exclusion; the default situation is lack of access for quicker detection of permission refusal.
• Every access must be checked against the access control mechanism, without relying on cached access decisions.
• Security mechanisms should be open rather than secret to gain high confidence.
• Encryption and hash algorithms should be open to public scrutiny, however, encryption keys must remain secret.
• Multiple privilege attributes are needed to achieve access to restricted resources.
• Multifactor user authentication uses multiple techniques to authorize a user.
• Access to program resources should be divided by user privileges.
• Users and processes should operate using only the minimum set of privileges necessary.
• Each role is assigned only the necessary permissions to perform its functions using Role Based Access Control methodologies.
• Each permission specifies permitted access to a resource, such as read/write access to a file/directory.
• Assign special privileges only when necessary
• The design should minimize functions shared by different users for mutual security.
• Reduces the number of unintended communication paths and amount of hardware and software shared by all users.
• Security mechanisms should not interfere unnecessarily with users while still meeting the authorization needs.
• Transparency or minimal obstruction of security mechanisms should be incorporated.
• If a user's mental model of protection differs from the security mechanisms, mistakes are more likely.
• Isolation applies in public access systems from critical resources.
• Isolation applies in user processes and files from one another, except where explicitly desired
• Isolation applies in security mechanisms to prevent access to those mechanisms.
• Encapsulation is a specific form of isolation rooted in object oriented functionality.
• Protection is offered by encapsulating procedures and data objects in their own domain.
• Security functions should be developed as separate and protected modules.
• Modular architecture supports migration and upgrades without system redesign, which provides common security functions and services like cryptographic functions.
• Layering utilizes multiple, overlapping protection approaches addressing people, technology, and operations.
• The failure of any single protection approach doesn't leave the system unprotected.
• "Defense in depth" is considered a best practice for system security protection.
• Layers ensure potential attack surfaces are reduced.
• A program or user interface should always respond in the most predictable way to avoid user surprise.
• Authorization mechanisms should be transparent enough for intuitive understanding.

Attack Surfaces and Attack Trees

• Attack surfaces consist of reachable and exploitable system vulnerabilities.
• Examples - Open ports on outward-facing web servers, services on the inside of firewalls, interfaces such as SQL and web forms.
• Software attack surfaces are vulnerabilities in application, utility, or O/S code.
• Network attack surfaces are vulnerabilities over an enterprise network
• Human attack surfaces are vulnerabilities created by personnel, outsiders, social engineering, human error, trusted insights.
• Attack surface analysis assesses the scale and severity of threats.
• It helps developers decide where security mechanisms are needed.
• It provides guidance on priorities for strengthening security, testing and modifying services or applications.
• Attack trees are potential techniques for exploiting security vulnerabilities.
• The security incident that starts an attack is the root of the node tree.
• The ways an attacker can reach the goal are iteratively represented as branches or sub-nodes.
• Final nodes on the path outward from the root are "leaf nodes"
• Attack trees document security attacks can be performed and in a structured form that reveals vulnerabilities.
• Attack trees assess risk of each attack as well as design principles and can design a comprehensive security facility.

Computer Security Strategy

• A comprehensive security strategy involves the aspects of specification/policy, implementation/mechanisms, and correctness/assurance..
• Security policy is a formal statement of rules and practices that regulate how an organization provides security services.
• Security policy protects sensitive and critical resources

Security Policy Factors

• Assets to be protected.
• System vulnerabilities.
• Potential threats and likelihood of attacks.
• Ease of use vs. security.
• Cost of security vs. cost of failure and recovery.
• Security implementation involves four complementary courses of action: prevention, detection, response, and recovery.
• Prevention aims for an ideal security scheme, where no attacks succeed, but is not always practical.
• Detection systems identify security attacks.
• Intrusion detection systems detect unauthorized individuals logged onto a system.
• Response involves halting attacks and preventing further damage upon detection.
• IDS/IPS and SIEM are deployed to detect usual and unusual traffic.
• Recovery uses backup systems to restore data integrity when compromised.
• Assurance provides confidence that a system operates as enforced by its security policy, without formal proof of correctness.
• Evaluation examines a computer product or system against certain criteria, involving testing and mathematical techniques.
• The central push of evaluation is to develop evaluation criteria that can be applied to any security system.