comp3521 chapter 13

Security Engineering

• Security engineering involves using tools, techniques, and methods to develop and maintain systems resilient to malicious attacks aiming to damage computer-based systems or their data.
• Security engineering is a subfield of computer security.

Security Dimensions

• Confidentiality ensures that information in a system is not disclosed or made accessible to unauthorized people or programs.
• Integrity ensures that information in a system is not damaged or corrupted, maintaining its accuracy and reliability.
• Availability ensures authorized users can access a system or its data when needed.

Security Levels

• Infrastructure security maintains the security of all systems/networks providing shared services to an organization.
• Application security focuses on securing individual application systems or related groups of systems.
• Operational security ensures the secure operation and use of organizational systems.

System Layers

• Security can be compromised in various system layers, including:
  • Application
  • Reusable components and libraries
  • Middleware
  • Database management
  • Generic, shared applications (browsers, emails)
  • Operating System
  • Network
  • Computer hardware

Application Security vs. Infrastructure Security

• Application security is a software engineering challenge where the system is designed with security in mind.
• Infrastructure security is a systems management challenge where the infrastructure is configured for security.

System Security Management

• User and permission management involves adding/removing users and setting appropriate permissions.
• Software deployment and maintenance involves installing/configuring software and middleware to avoid vulnerabilities.
• Attack monitoring, detection, and recovery involves monitoring for unauthorized access, designing resistance strategies, and developing backup/recovery plans.

Operational Security

• Operational security is a human and social issue focused on preventing actions that compromise system security.
• Users might take insecure actions for convenience, thus system security must be balanced against system effectiveness and usability.

Security and Dependability

• Security is a system property reflecting its ability to protect itself from accidental or deliberate external attacks.
• Security is essential for networked systems due to the possibility of external access via the internet.
• Security is a prerequisite for availability, reliability, and safety.
• Insecure networked systems lead to unreliable statements about system safety and reliability.
• Intrusion can alter the executing system and/or its data, thus invalidating reliability and safety assurances.

Security Terminology

• Asset: Something of value, such as software or data, that must be protected.
• Attack: Exploitation of a system’s vulnerability, often from outside the system, intending to cause harm.
• Control: A protective measure, like encryption, that reduces a system's vulnerability.
• Exposure: Possible loss or harm to a computing system, such as data loss or the time and effort for recovery.
• Threat: Circumstances with potential to cause loss or harm, like a system vulnerability being targeted by an attack.
• Vulnerability: A weakness in a computer-based system that can be exploited to cause harm.

Security Terminology (Mentcare example)

• Asset: Patient records.
• Exposure: Potential financial loss, legal action, or reputation damage due to data breaches.
• Vulnerability: Weak password systems.
• Attack: Impersonation of an authorized user.
• Threat: Unauthorized access via password guessing.
• Control: Password checking systems banning dictionary words.

Threat Types

• Interception threats allow attackers to gain access to an asset, exemplified by unauthorized access to patient records.
• Interruption threats make part of the system unavailable, potentially through a denial of service attack.
• Modification threats allow attackers to tamper with a system asset, like altering or destroying patient records.
• Fabrication threats enable attackers to insert false information into a system, such as adding false transactions.

Security Assurance

• Vulnerability avoidance designs the system to avoid vulnerabilities, for instance, by eliminating external connections.
• Attack detection and elimination detects and neutralizes attacks on vulnerabilities before they cause exposure.
• Exposure limitation and recovery minimizes the consequences of successful attacks; for example, a backup policy allows for compromised information to be restored.

Security and Reliability

• Attacks that corrupt a system or its data can induce system failures, compromising reliability.

Security and Availability

• A common web-based system attack to affect availability is a denial of service, which floods the web server with a high volume of service requests.

Security and Safety

• An attack that corrupts the system or its data means that assumptions about safety may not hold
• Altered safety assumption may induce safety-related failures and invalidate the safety case made for the software.

Security and Resilience

• Resilience is a system characteristic that reflects its ability to resist and recover from damaging events.
• Resilience is aimed at deterring, detecting and recovering from cyberattacks..

Security as a Business Issue

• Security is expensive, so security decisions are to be made in a cost-effective manner.
• A security risk analysis is a business process, not a technical process.
• There is no point in spending more than the value of an asset to keep that asset secure.
• Organizations use a risk-based approach to support security decision making with a defined security policy.

Organizational Security Policies

• Security policies offer strategies for information access across the organization.
• The security policy should be concise and informative, not a detailed technical document.
• The security policy defines the security goals of the organization; security engineering implements these.

Security Policies Topics

• Assets that must be protected, focusing on cost-effectiveness.

• The level of protection required for assets, based on sensitivity.

• Responsibilities of individual users, managers, and the organization, such as defining password practices.

• Existing security procedures and technologies that should be maintained even with known limitations, based on practicality and cost.

Security Risk Assessment and Management

• Risk assessment & Management assesses losses from system attacks against the cost of risk-reducing security procedures.
• Risk management should adhere to an organizational security policy.
• Risk Management involves:
  • Preliminary risk assessment
  • Life cycle risk assessment
  • Operational risk assessment

Preliminary Risk Assessment

• The aim of initial risk assessment is to identify generic risks applicable to the system to achieve an adequate security level at a reasonable cost.
• The risk assessment focuses on identification and analysis of high-level risks.
• Risk assessment outcomes identify security requirements.

Design Risk Assessment

• This includes risk assessment during the system development life cycle that informs technical design and implementation decisions.
• Assessment results may change security requirements.
• Known vulnerabilities determine how functionalities are implemented, tested, and deployed.

Operational Risk Assessment

• This focuses on the use of the system and possible risks from human behavior.
• Assess the use of system and risks caused by human behaviour.
• This should continue after system installation.
• Organizational changes lead to new security requirements.

Security Specification Similarities

• Security specification aligns with safety requirements specification by focusing on preventing adverse incidents.

Security Specification Differences

• Safety issues are accidental or errors, but security addresses hostile attacks exploiting system weaknesses.
• The causes of safety failures may be identifiable, while attackers can conceal the cause of security failures.
• Though shutting down prevent safely failures it is sometimes the aim of attack.
• Adversarial attacks are deliberate, with attackers actively seeking to discover weaknesses over time.

Types of Security Requirements

• Identification, Authentication, Authorization, Immunity, Integrity, Intrusion detection, Non-repudiation, Privacy, Security auditing, System maintenance safety

Security Requirement Classification

• Risk avoidance sets out to avoid risks by removing the design from creating them.
• Risk detection defines mechanisms to identify and neutralize the risk.
• Risk mitigation sets out how the system should recover and restore system assets after a loss occurs.

Security Risk Assessment Process

• The process includes:
  • Asset Identification
  • Asset Value Assessment
  • Exposure Assessment
  • Threat Identification
  • Attack Assessment
  • Control Identification
  • Feasibility Assessment
  • Security Requirement Definition.

Preliminary Risk Assessment Report - Assets (Mentcare)

• The information system: Supports all clinical operations and can become potentially safety-critical.
  • Potential high financial loss if clinics are cancelled including high cost restoring system.
• The patient database: Supporting all clinical operations and potentially safety-critical.
  • High financial loss if clinics are cancelled including high cost restoring system.
• An individual Patient Record: Normally low value can become high valuable to high profile patients.
  • Low Direct losses, include possible loss of reputation.

Preliminary Risk Assessment Report - Threats (Mentcare)

• Threats include unauthorized user gaining access to the a system manager, and making the system unable to be utilized.
  • Controls include only allowing system management from specific locations that are physically safe.
    • Low cost to distribute, but keys are needed to ensure in the event of emergency.
• Unauthorized User Accesses high level of confidential Information.
  • Controls include using biometric mechanism, Log all usage of patient information.
    • Technician is feasible, but can lead to a high costing and a low user resistance to using the software.

Security Requirements For Mentcare

• Patient information must be downloaded to a secure area on the clinical Staff system client.
• Encrypt all patient information on the systems client.
• Upload patient information to database after clinic session and delete the information on the client.
• Maintain a log on a separate computer from database server by the system database.

Types of Misuse Cases

• Misuse cases are instances of threats to a system.
• Interception, interruption, Modification, and Fabrication

Mentcare system: Transfer data (Actors, data, Stimulus and comments.)

• Medical Receptionist, Patients records system
  • A receptionist can transfer data to the patient records system to update patient diagnosis, treatment and personal information.
    • Patients information, treatment summary
      • User commanded by medical receptionist.
        • Confirmation from PRS.
        • Medical Receptionist use appropriate permission to access PRS.

Mentcare system: Intercept transfer (Misuse case)

• Medical receptionist, Patient Records System, Attacker
  • A receptionist transfers data from their system to the Montcare system, where an attacker intercepts the data transfer and stores it.
    • Patients information and Patients Treatment Summary.
    • The attacker creates and adds a network interceptor and creates a fake server to send to the database to intercept.

Mentcare system: Intercept transfer (Misuse case) - Mitigation.

• Networking equipment maintained in locked room. Engineers accessing the equipment must be accredited.
  • Encrypt data transferred between client and server.
    • Client-server communication to be certificated.
• All communication must use secure socket layer such as https protocol must use all encryption standards.

Secure Systems Design

• Must design security into the system, or will be difficult to implement an insecure system.

Design Compromises

• Adding Security to system can affect attributes of the system - can affect performance and Usability to those within.

Design Risk Assessment

• Risk can be assessed while system is being developed or after it has been deployed. - All Data becomes available such as system, middleware ,Data organization. - All Vulnerabilities will be identified with development choice.

Protection Requirements

• Protection requirements derive with information presentation and system - Separation of patient and treatment limits data that personal patients data that needs to be protected.

Protection copies of records:

• Records protect local patients to protects against service attacks

Design decisions from COTS use

• Authenticate users by using name/password combination.

• Systems Architecture consists of client- server through web browser.

  • Information is then presented in a web form.

Security Requirments

• Password will available and shown on the systems administrator .

• Client System must approve and access for client systems. -All clients must use single approved web browser.

Architecture Design

• Protection , How system should organize what critical assets , Distribution how should assets be distributed - If assets are distributed then it can be more expensive to protect while having performance compromises.

Aspects of Secure Systems programming

• Vulnerabilities are often language specific.
• Array bound checking is automatic in Java, so that this is not an ability that can be exploited on the server
• Programs without bound checking can often crash so they can make improvements to increase the security system,

Design guidelines for security programming

• 1. Limit visibility, 2. Check all input for validity 3. handler for exceptions 4. Minimize for error prone structures 5.Provide restart 6.Check Array Bounds 7. Timeouts for calls 8. Name all constants real world valued

Security testing and assurance

• Extent can which a system protects from external attacks.
• security is shall not requirements, it can specify what to check in the system ( ie restraints) can be checked for the system,
• Systems that can attack is intelligent and search for vulnerabilities and loopholes within the system.

Security Validation

• Experience based - Review System and analyse team against type of attacks they know off.

• Penetration Testing - Team is established, to seek goal and reach system by simulating type hacks on the current system.

Secure Systems Programming Attributes

• Vulnerabilities are often language-specific for many attacks. - Security vulnerabilities are closely related to program reliability.
• Systems security consist of programming and languages can have different vulnerability depending on coding structures.