CSC 1029 Week 06 Design Secure Software PDF

CSC 1029 DESIGNING SECURE SOFTWARE OBJECTIVES AGENDA: WEEK 06 Identify how security-minded 1. Designing & Building Secure Software thinking, or security engineering, 2. Threat Modeling is integrated into the software 3. Software Security Requirement...

CSC 1029 DESIGNING SECURE SOFTWARE OBJECTIVES AGENDA: WEEK 06 Identify how security-minded 1. Designing & Building Secure Software thinking, or security engineering, 2. Threat Modeling is integrated into the software 3. Software Security Requirements development process Enumerate a series of design 4. Avoiding Software Design Flaws principles for writing secure 5. Favor Simplicity software 6. Trust with Reluctance Explain how such principles can 7. Defense in Depth be violated, pointing to actual 8. Top Design Flaws incidents Put these principles into practice 9. Case Study by drawing inspiration from well- 10. Interview on Building Secure Software designed, secure systems 11. Interactive Lesson 12. TODO & Resources for Help DESIGN AND BUILDING SECURE SOFTWARE Protection of Information in Computer Systems, by Saltzer and Shroeder. Classic paper from 1975 that is still highly relevant today. THREAT MODELING S: spoofing T: tampering R: repudiation I: information disclosure D: denial of service https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling E: elevation of privledge https://owasp.org/www-community/Threat_Modeling_Process#stride-threat-list SOFTWARE SECURITY REQUIREMENTS AVOIDING SOFTWARE DESIGN FLAWS A security flaw, glitch, or weakness found in software code that could be exploited by an attacker (threat source). Software Vulnerability - Glossary | CSRC Most of our time so far has been spent focusing on implementation-level issues---bugs that constitute vulnerabilities, and means of avoiding those bugs, mitigating them, or recovering from them. But we must also be concerned about flaws, which are security problems in a software system's design. To address both flaws and bugs effectively, we need to consider security through the entire development process. SECURE DESIGN PRINCIPLE: FAVOR SIMPLICITY Read the articles: o Simplicity Is the Ultimate Sophisticationhttps://dev.to/zenstack/simplicity-is-the-ultimate- sophistication-1cfk o Bruce Schneier's plea for simplicity in computer systems. SECURE DESIGN PRINCIPLE: TRUST WITH RELUCTANCE Trust with reluctance – need-to-know  SECURE DESIGN PRINCIPLE: DEFENSE IN DEPTH Most applications can be compromised when single, and often only, layer of defense is breached (firewall) Defense in Depth: If one defense layer is breached, what other defense layers (if any) provide additional protection to the application? SECURE DESIGN PRINCIPLE: SOFTWARE DESIGN FLAWS Attack Surface: Any part of an application that is accessible by a human or another program Minimize the number of exposed attack surface points a malicious user can discover and attempt to exploit CASE STUDY: VERY SECURE FTPD INTERVIEW WITH GARY MCGRAW ON BUILDING SECURE SOFTWARE CYBERSECURITY PRINCIPLES INTERACTIVE LESSON This interactive lesson introduces the Cybersecurity Principles - the fundamental qualities of a system that make it secure. The Cybersecurity Principles are modularity; simplicity of design; layering (defense in depth); separation (of domains); complete mediation; least privilege; fail safe defaults/fail secure; isolation; encapsulation; usability; open design; least astonishment (psychological acceptability); trust relationships; and minimize trust surface (reluctance to trust). A self-assessment is provided at the end of the lesson. EARN YOUR PRE-WORK GRADE...WEEK06 Post your weekly discussion question and research solution to D2L TODO...WEEK 06 Complete Week 06 Content Module in D2L to 100% WHAT'S COMING UP NEXT...WEEK 07  QUESTIONS | CLARIFICATIONS | HELP Student Office Hours: Schedule Meeting with Julie o By Appointment (both on-campus and remote via Zoom) o Drop-In Times Available (on-campus) Email: [email protected] RRCC On Campus Tutoring: https://www.rrcc.edu/learning- commons/tutoring 24/7 Online Tutoring: D2L > Content > Resources for Help