beyond coding - adopting the right mindset for secure software … · 2011-11-10 · alessandro...
TRANSCRIPT
Beyond Coding - Adopting the Right Mindset for Secure Software Development
(ISC)2 Rome Event, November 2011 Alessandro Moretti CISSP, CSSLP (ISC)2 European Advisory Board
Decision Making – Natural?
• Mental cognitive process resulting in the selection of a course of
action among several alternatives to produce a final choice.
• The output can be an action or an opinion of choice.
• Objectives must first be established, classified and placed in
order of importance
• Alternative actions must be developed
• The alternative must be evaluated against all the objectives
• The alternative that is able to achieve all the objectives is the
tentative decision
• The tentative decision is evaluated for more possible
consequences
• The decisive actions are taken, and additional actions are taken
to prevent any adverse consequences from becoming problems
and starting both systems (problem analysis and decision making)
all over again
Risk Assessment – Skilful?
• Supports most of our daily life decisions
• Supports Gain vs Loss decision
• Decision makers not paid to gamble
• Apply risk assessment “holistically” to Software
Security and the SDLC...
• Choice?
Beyond Coding
• Supply vs Demand – The need for a security mindset
• Risk Assessment – what is good Secure Software
Development?
• What next? - Sustaining Assurance
Alessandro Moretti
Alessandro Moretti, CISSP, CSSLP, MBCS, CEng, CITP is Co-
Chair of the European Advisory Board for (ISC)2, a non-profit
professional consortium which represents over 80,000
members worldwide.
Alessandro has over fifteen years experience in information
security. He has formerly held posts at National Computing
Centre, ICL, BNFL. Currently employed as Head of IT Risk
Services for UBS.
Overview & Background
• Global leaders in certifying and educating information security professionals with the CISSP
® and related
concentrations, CSSLP® and SSCP
®.
• Formed in 1989, not-for-profit consortium of industry leaders.
• Over 80,000 certified professionals in more than135 countries.
• Board of Directors - top information security professionals worldwide.
• All credentials are accredited ANSI/ISO/IEC Standard 17024 with the CISSP being the first technology-related credential to receive this accreditation.
Macro trends – Risk and Security
• Increased threat due to economic issues: Risk
tradeoffs among security, flexibility, performance,
and cost
• Globalization means companies take advantage of
vendors and suppliers around the world.
• The externalisation of IT moves technical controls
over information to contractual and legal controls.
– the application servers may reside in a “cloud”
(SaaS)
• Security and privacy concerns increase; increased
regulation and inspection.
Supply vs Demand – The need for a
security mindset
• Designers , Architects, Business analysts focused
on functional specifications.
• Rapid application development techniques
reduce time to market, but reduce time on
building in security.
• Commercial system providers, customers, and
in-house developers need to change their
security mindset.
People and Process – Planning for
security and risk
• Software (application) security is the responsibility
of all the stakeholders that are influencers in the
software development life cycle (SDLC).
• Any software is the result of a confluence of
people, process, and technology. Secure software
is the result of educated and informed people
implementing processes using inherently secure
technologies to provide solutions to a business
need.
Insecure Software: Process Problem
Developers have little appreciation for basic security tenets :
• Protection from disclosure (confidentiality)
• Protection from alteration (integrity)
• Protection from destruction (availability)
• Validating who is making the request (authentication)
• What rights and privileges does the requestor have (authorization)
• The ability to build historical evidence (auditing) and the management of configuration, sessions and exceptions
• If they are aware of the principles, do they understand the implementation practices?
Insecure Software: People Problem
Three primary conditions create information security
vulnerabilities in enterprise software applications:
• Inexperienced developers writing code
• Experienced developers writing code with inadequate
training in best practices for security
• Designers and managers failing to include security
considerations prior to development.
Influencers not understanding information security issues
as they pertain to the secure software lifecycle
IT Decision Making – Preparing for Choice
• Customer – How to I choose the right
provider, with the right security mindset?
• Supplier – How do I demonstrate we have the
right security mindset?
• People and Process Certification - The “Right”
security mindset – Certified Secure Software Lifecycle Professional (CSSLP)
– BCS ISEB qualifications
– OWASP – The Software Assurance Maturity Model
(SAMM)
– NCC - IT Department Accreditation
Certification – Benefits
Certification of professional staff can lead to:
• Improved workforce assurance
• Better critical infrastructure protection
• Reduced data loss
• Lowered organizational risk, including software
malpractice suits
• Enabling stricter adherence to industry and government
regulations
• Helps to implement the repeatable and measurable
processes of QA
Risk Assessment – what is good
Secure Software Development?
• Mature application security development lifecycle.
• Qualified and security certified professionals.
Stakeholders in the SDLC
Software Assurance Maturity Model
(SAMM)
Open framework to help organizations formulate
and implement a strategy for software security
that is tailored to the specific risks facing the
organization. The resources provided by SAMM
will aid in: • Evaluating an organization’s existing
software security practices
• Building a balanced software security program
in well-defined iterations
• Demonstrating concrete improvements
to a security assurance program
• Defining and measuring security-related activities
within an organization
Software Assurance Maturity Model
(SAMM)
SAMM Roadmaps
• To make the “building blocks”
usable, SAMM defines Roadmaps
templates for typical kinds of
organizations
• Independent Software Vendors
• Online Service Providers
• Financial Services Organizations
• Government Organizations
Certified Secure Software Lifecycle
Professional (CSSLPCM) Domains
(ISC)²® CSSLP CBK Domains
• Secure Software Concepts
• Secure Software Requirements
• Secure Software Design
• Secure Software Implementation/Coding
• Secure Software Testing
• Software Acceptance
• Software Deployment, Operations, Maintenance, and
Disposal
Secure Software Concepts
•Confidentiality, Integrity, Availability
•Authentication, Authorization, and Auditing
•Security Design Principles
•Risk Management (e.g., vulnerabilities, threats and controls)
•Regulations, Privacy, and Compliance
•Software Architecture (e.g., layers)
•Software Development Methodologies
•Legal (e.g., Copyright, IP and trademark)
•Standards (e.g., ISO 2700x, OWASP)
•Security Models (e.g., Bell-LaPadula, Clark-Wilson and Biba)
•Trusted Computing (e.g., TPM TCB)
•Acquisition (e.g., contracts, SLAs and specifications)
Secure Software Design
• Design Processes
– Attack surface evaluation, Threat modeling, Control Identification,
Control prioritization
• Design Considerations
• Confidentiality, Integrity, Availability, Authentication,
Authorization, and Auditing
• Security design principles, Interconnectivity, Security management
interfaces, Identity management
• Architecture
• Distributed, Service-oriented, Rich Internet applications, Pervasive
computing
• Integration with existing architectures
• Software as a Service
• Technologies
• IAM, Audit, DRM, Flow control (e.g., proxies, firewalls,
middleware)
• Data protection (e.g., DLP, encryption and database security)
• Computing environment (e.g., programming languages,
virtualization, and operating systems
• Integrity (e.g., code signing)
Secure Software Design
Saltzer & Schroeder: Security Design Principles
• Economy of mechanism
• Fail Safe Defaults
• Complete Mediation
• Open Design
• Separation of Privilege
• Least Privilege
• Least Common Mechanism
• Psychological acceptability
Secure Software Requirements
• Policy Decomposition
– Confidentiality, Integrity, Availability Requirements
– Authentication, Authorization, and Auditing
Requirements
– Internal and External Requirements
• Identification and Gathering
– Data Classification
– Use Cases
– Abuse Cases (inside and outside adversaries)
Secure Coding
•Declarative versus programmatic security (e.g., bootstrapping,
cryptographic agility, and handling configuration parameters)
•Common software vulnerabilities and countermeasures
•Defensive coding practices (e.g., type safe practices, locality,
memory management, error handling)
•Exception management
•Configuration management (e.g., source code and versioning)
•Build environment (e.g., build tools)
•Code/Peer review
•Code Analysis (static and dynamic)
•Anti-tampering techniques (e.g., code signing)
•Interface coding (e.g., proper authentication and third party API)
Secure Software Testing
•Testing for Security Quality Assurance
–Functional Testing (e.g., reliability, logic, performance and scalability)
–Security Testing (e.g., white box and black box)
–Environment (e.g., interoperability)
–Bug tracking (e.g., defects, errors and vulnerabilities)
–Attack surface validation
•Test types
–Penetration Testing
–Fuzzing, Scanning, Simulation Testing (e.g., environment and data)
–Testing for Failure
–Cryptographic validation (e.g., environment and data)
•Impact Assessment and Corrective Action
•Standards for software quality assurance (e.g., ISO 9126, SSE-CMM and
OSSTMM)
•Regression testing
Secure Software Acceptance &
Deployment
• Pre-release or pre-deployment
– Completion Criteria (e.g., documentation, BCP)
– Risk Acceptance
– Documentation (e.g., DRP and BCP)
• Post-release
– Validation and Verification (e.g., Common Criteria)
• Independent testing (e.g., third-party)
• Installation and Deployment
– Bootstrapping (e.g., key generation, access management)
– Configuration Management (e.g., elevated privileges, hardening,
platform change)
Secure Software Operations &
Maintenance
• Operations and Maintenance
– Monitoring (e.g., Metrics and Audits)
– Incident Management
– Problem Management (Root Cause Analysis)
– Patching
• End of life policies
What next? - Sustaining Assurance
• Confucius said, “The superior man, when resting in safety,
does not forget that danger may come. When in state of
security he does not forget the possibility of ruin. When
all is orderly, he does not forget disorder may come. Thus
his person is not endangered and his states and all their
clans are preserved.”
• Applying this wisdom, it is easy to see that when it comes
to software security, not only should software be
designed, developed, and deployed securely, but it should
also be operationally secure and should maintain the level
of security as intended.
Sustaining Assurance
• A secure, formal and structured software
development methodology, along with
enforceable and pertinent policies, must become
a part of any organization’s operations.
• Trained and qualified people who are
empowered with the knowledge of how to
implement software security controls, balance
threats and countermeasures, and balance
business with technology.
CSSLP Case Study / Whitepaper
• (ISC)² Case Study: Securing the Right Information Security Team
• (ISC)² Hiring Guide Securing the Organization: Creating a Partnership Between HR
and Information Security
• CSSLP Whitepaper I: The Need for Secure Software
• CSSLP Whitepaper II: Software Assurance: A Kaleidoscope of Perspectives
• CSSLP Whitepaper III: Software Security Being Secure in an Insecure World
• CSSLP Whitepaper IV: The Ten Best Practices for Secure Software Development
• CSSLP Whitepaper V: Code (In)Security
www.isc2.org/d-zone
Ten Best Practices
1. Protect the Brand Your Customers Trust
2. Know Your Business and Support it with Secure Solutions
3. Understand the Technology of the Software
4. Ensure Compliance to Governance, Regulations, and Privacy
5. Know the Basic Tenets of Software Security
6. Ensure the Protection of Sensitive Information
7. Design Software with Secure Features
8. Develop Software with Secure Features
9. Deploy Software with Secure Features
10. Educate Yourself and Others on How to Build Secure Software