Security Engineering and Management

Topics Covered

• Security engineering and management focus on applications, while security management focuses on the underlying infrastructure
• Security risk assessment involves creating a system based on assessing those risks
• System architectures must be designed with security in mind

Security Engineering

• Security engineering uses tools, techniques, and methods to develop and maintain systems resistant to malicious attacks intended to damage computer-based systems or data
• Security engineering is a sub-field of computer security

Application and Infrastructure Security

• Application security relies on software engineering to design systems to resist attacks
• Infrastructure security relies on systems management to configure infrastructure to resist attacks
• Application security is the primary focus

System Security Management

• User and permission management consists of adding/removing users and setting appropriate permissions
• Software deployment and maintenance involves installing and configuring application software and middleware to avoid vulnerabilities
• Attack monitoring, detection, and recovery includes monitoring for unauthorized access, designing resistance strategies, and developing backup and recovery plans

Security Risk Management

• Risk management involves assessing potential losses from attacks and balancing those losses against the cost of security procedures
• Risk management should be driven by organizational security policy
• Risk management contains:
  • Preliminary risk assessment
  • Life cycle risk assessment
  • Operational risk assessment

Misuse Cases

• Misuse cases are instances of threats to a system
• Interception threats include attackers gaining access to system assets
• Interruption threats include attackers making part of a system unavailable
• Modification threats include system assets being tampered with
• Fabrication threats include false information being added to a system

Asset Analysis

• The information system has a high value as it is required to support all clinical consultations and is potentially safety-critical, and is marked as a high exposure because the financial loss associated with clinics being canceled and the resulting cost of restoring the system
• The patient database has a high value because it's required to support all clinical consultations and is potentially safety-critical, and has a high exposure because of financial loss caused by the possibility of cancellations and harm due to treatments not prescribed
• An individual patient record typically has a low value, except for high-profile patients, resulting in a low exposure due to direct losses and a potential loss of reputation

Threat and Control Analysis

• Low probability of system manager account unauthorized use, so control by allowing managers from physically secure locations to perform system management, this has low cost
• High probability of system user account unauthorized use, counter by requiring user authentication, and logging all patient information changes. This has technically high cost and possible user resistance.

Design Guidelines for Security Engineering

• Design guidelines should encapsulate good practice in secure systems design
• Design guidelines are applicable during software specification and design

Security Guideline List

• Base security decisions on an explicit security policy
• Avoid a single point of failure
• Fail securely
• Balance security and usability
• Log user actions
• Use redundancy and diversity to reduce risk
• Validate all inputs
• Compartmentalize assets
• Design for deployment
• Design for recoverability

Design Guidelines 1-3

• Base decisions on security policy: Define a security policy for the organization, setting out fundamental security requirements for all organizational systems
• Avoid single point of failure: Ensure security failure results from multiple security procedure failures, and use password and question-based authentication
• Fail securely: Ensure sensitive information inaccessible to unauthorized users when systems fail, even when normal security procedures are unavailable

Design Guidelines 4-6

• Balance security and usability: Avoid security procedures that complicate system use, and accept weaker security for usability
• Log user actions: Maintain a log of user actions for analysis, deterring irresponsible behavior if users are aware of the log
• Use redundancy and diversity to reduce risk: Keep multiple copies of data and use diverse infrastructure to avoid a single point of failure

Design Guidelines 7-10

• Validate all inputs: Check if the inputs are within acceptable ranges
• Compartmentalize assets: Organize the system so that assets are in separate areas and users only have access to the information they need rather than all system information
• Design for deployment: Design the system to avoid deployment problems
• Design for recoverability: Design the system to simplify recovery after a successful attack

System Survivability

• Survivability is an emergent system property that shows the system's ability to deliver essential services while under attack or after damage
• Survivability analysis and design should be within the security engineering process

Importance of Survivability

• Economic and social lives rely on computer systems, specifically:
  • Critical infrastructure (electricity, gas, telecommunications, transport)
  • Healthcare
  • Government
• The loss of business systems has very severe economic effects, like:
  • Airline reservation systems
  • E-commerce systems
  • Payment systems

Survivability Strategies

• Resistance: Building capabilities into the system to resist attacks
• Recognition: Detecting problems by building capabilities into the system to detect attacks and failures and assess the resultant damage
• Recovery: Tolerating problems by building capabilities into the system to deliver services whilst under attack

Key Points

• General security guidelines sensitize designers to security issues and serve as review checklists
• Configuration visualization, setting localization, and minimization of default privileges help reduce deployment errors
• System survivability reflects the ability of a system to deliver services whilst under attack or after damage