6. SecureSoftwareDevelopement - Control Questions

Question 1

What is the CVE?

Answer 1

○ publicly available database of known vulnerabilities

Question 2

Why is developing secure software difficult?

Answer 2

○ The table is tilted
■ Developer constraints: time, resource, functionality
■ Attacker constraints: motivation and preparedness
○ Security testing is challenging
■ Functional testing: how the system should work
■ Security testing: how the system should NOT work
○ Weak business motivation
■ Measurement is difficult → no customer enforced competition
○ End-users suffer
■ Developers are not motivated enough

Question 3

● Outline the stages of Microsoft’s Secure Development Lifecycle!

Answer 3

ábra

Question 4

● Outline the stages of Microsoft’s Secure Development Lifecycle!

Answer 4

○ Development team: who does the actual development of the product
○ Development Team Security Contact: member of the dev team, security advisor contacts this person with security info
○ Security advisor:
■ point of contact between the devs and sec team (if there is one)
■ holds SDL kick-off meeting
■ hold design and threat-model reviews with the dev team
■ analyzes security related bugs
■ addresses security and privacy questions/ideas
○ Security Leadership Team: regular communication about security and privacy bug counts, updates, security status in general

Question 5

● What is a bug tracking system?

What is required for successful bug tracking?

Answer 5

○ Database about bugs
○ Include security/privacy related info as well!
○ Required fields: ábra

Question 6

● What does the design principle “economy of mechanism” say?

Answer 6

○ The more complex the SW, the greater chance of bugs

○ Smaller code base is easier to maintain

Question 7

● What does the design principle “fail-safe defaults” say?

Answer 7

○ White-listing approach
■ Initially: access is denied
■ If access is requested, check that it is permitted
○ Result: false negative
■ Access is denied, when it should have been permitted

Question 8

● What does the design principle “complete mediation” say?

Answer 8

○ Check every access to every object

Question 9

● What does the design principle “separation of privilege” say?

Answer 9

○ Multiple conditions should be met before granting permissions
■ Systems are more robust and flexible
● Single check may fail or be subverted
○ Prerequisite: compartmentalization
■ Break the system down into smaller components
■ Each component can check a condition

Question 10

● What does the design principle “least privilege” say?

Answer 10

○ Programs should run with the minimum amount of privilige that is necessary to accomplish the task
○ Limits the damage from accidents and errors

Question 11

● What does the design principle “open design” say?

Answer 11

○ Don’t depend on the secrecy of the design

○ That is security by obscurity

Question 12

● What does the design principle “least common mechanism” say?

Answer 12

○ Minimize the amount of mechanism
■ Common to more than one user, and
■ Depended on by all users
○ Sharing is a channel to information transmission

Question 13

● What does the design principle “psychological acceptability” say?

Answer 13

○ If users do not accept it, they will bypass it
○ Consider the human in the loop!
○ Interaction with the system should be easy and intuitive
○ Resource access should remain easy

Question 14

● What is the attack surface of the software?

Answer 14

○ Consider the attack surface of the software!
■ All paths for data/commands into and out of the application
■ Code that protects these paths
■ All valuable data used in the application
■ Code that protects these data

Question 15

● Your software detects that the input is corrupted. What should the software do?

Answer 15

○ Input: filtering and validation
■ – Terminate on suspicious input, don’t try to fix it !
■ – Whitelist strategy

Question 16

● Describe the signedness bug!

Answer 16

○	Signedness bugs occur when an unsigned variable is interpreted as signed,
or when a signed variable is interpreted as unsigned.  This type of
behaviour can happen because internally to the computer, there is no
distinction between the way signed and unsigned variables are stored.
// signedness bug

Question 17

● Are the results of arithmetic operations mathematically correct? Why?

Answer 17

○ No guarantee that the result of arithmetic operations is mathematically correct
○ Mert az unsigned int csak pozotív míg az int negatív értéket is felvehet.

Question 18

● Name 3 examples of improper error handling!

Answer 18

○ Improper handling of errors can introduce a variety of security problems for a web site. The most common problem is when detailed internal error messages such as stack traces, database dumps, and error codes are displayed to the user (hacker). These messages reveal implementation details that should never be revealed. Such details can provide hackers important clues on potential flaws in the site and such messages are also disturbing to normal users.

●	Nem egyértelmű hibajelzés és kezelés
●	Error-t vagy Exception-t használjunk?
●	Kivétel után nincs érvényes állapot helyreállítás
●	Helytelen kezelés 
●	Információ kiszivárogtatás
// Improper_Error_Handling#Description

Question 19

● What information required for logging?

Answer 19

○ When: log date and time, event date and time
○ Where: app identifier or address, code location, geolocation, service
○ Who: IP address, user identity (user name, licence number, …)
○ What: type of event, severity of event, description, security relevant flag

Question 20

● What is the importance of logs?

Answer 20

○	Logs are the main source of data for: 
■	Identifying security incident 
■	Monitoring policy voilations 
■	Assisting non-repudiation controls 
■	Incident investigation

Question 21

● What type of data should never be logged?

Answer 21

○	What not to log? 
■	Keys 
■	Passwords 
■	Source code 
■	Tokens 
■	And other sensitive information

Question 22

● When should security testing be performed?

Answer 22

○ during each software development lifecycle phase

Question 23

● What is white-box security testing?

Answer 23

○ Tester has knowledge of how the system is implemented → Requires access to the source code

Question 24

● Name 4 approaches to white-box security testing!

Answer 24

○ Data flow analysis: how data is handled within the application
○ Control flow analysis: how control flow changes
○ Code review: manual or automatized
○ Code-based fault injection: injects source code to force changes to the state of the application, usually for testing anomalous circumstances

Question 25

● What is black-box security testing?

Answer 25

○ Tester has limited knowledge of the system under test → Only inputs and outputs are observable

Question 26

● Name 4 approaches to black-box security testing!

Answer 26

○ Syntax testing: generating a wide range of legal and illegal input values
○ Exploratory testing: testing without specific expectation about outcomes
○ Test scaffolding: support tools to carry out tests e.g. injecting error code
○ Coded scripting: write a series of instructions that describe user behavior

Question 27

● What is the goal of penetration testing?

Answer 27

○ Process of attempting to gain access to resources without normal means of access
○ Success: obtaining/subverting protected information
○ Demonstrates what an attacker could do

Question 28

● What are the phases of penetration testing?

Answer 28

○ Reconnaissance: learn as much about the system as possible
■ Tools: Nmap, Nessus, Jack the Ripper, etc.
○ Check public databases for known vulnerabilities
○ Launch attack(s) based on collected information
■ Tool: Metasploit framework
○ Compile the results into a legible format for decision makers

Question 29

● What is the difference between the security response plan and the incident response plan?

Answer 29

○ Create the security response plan → Security Response Center
■ New vulnerabilities will appear
■ What should you do when your application is affected as well?
■ How can others get in touch if they uncover a vulnerability?
○ Create the incident response plan → Incident Response Team
■ What if the vulnerability disclosure was not responsible?
■ What if your service is attacked?

Question 30

● Describe the vulnerability lifecycle!

Answer 30

ábra

Question 31

● What is security response center?

What are its tasks during Post-SDL Response phase?

Answer 31

ábra

Question 32

● What are tasks of the development team during the security response process?

Answer 32

ábra

Question 33

● What is the task of the incident response team?

Answer 33

ábra