Chapter 20 Software Development Security Flashcards
Describe programming languages.
Computers understand binary code. This is known as machine language. Each CPU chipset has its own machine language, and no human can decipher it without assistance.
Assembly language is a higher-level alternative that uses mnemonics to represent the basic instruction set of a CPU, but it still requires hardware-specific knowledge and can be tedious–adding two numbers can take 5 or 6 lines of code.
Programmers use high-level languages. C, Java, and Fortran are compiled languages. You have to run them through a compiler to convert them into an executable file designed for use on a specific OS. Generally speaking, you can’t directly view the code, although experts use decompilers to take the binary executables and convert them back into source code, whereas dissassembly turns it to assembly language.
Runtime environments allow the portable execution of code across different OS. Java is an example of this. Users run the Java VM on their systems and may then rely on that runtime to execute Java code.
Python, R, JavaScript, and VBScript are interpreted languages. Programmers distribute the source code, which contains the original instructions. When end users execute the program, it automatically triggers the use of an interpreter to execute thes ource code.
Compiled code is less prone to third party manipulation, but it’s also easier for a malicious programmer to embed backdoors.
What are software libraries?
Developers often rely on shared software libraries with reusable code. These libraries can be used for everything from text manpulation to machine learning, and help improve efficiency. Many are open source, although some are sold or maintained internally. The Heartbleed vulnerability struck the OpenSSL library in 2014. Important to know the origins of source code and any vulnerabilities that could result.
What is an integrated development environment?
Integrated development environments (IDE) provide programmers with a single environment to write code, test it, debug, and complie it. RStudio Desktop IDE is an example.
What is object oriented programming?
C++, Java, and .NET are among the languages that support OOP. Other programming styles, such as functional programming and scripting, focus on the flow of the program itself. OOP focuses on the objects involved. Think of it as a group of objects that can be requested to perform certain operations. They work together to provide functionality.
OOP has the potential to be more reliable and able to reduce propagation. Better suited to modeling or mimicking the real world. For example, a banking program might have three object classes (accounts, account holders, and employees). When a new account is created, a new copy of the apporpriate object is created with the correct details. The account object might have methods to add funds, deduct funds, close the account, and transfer ownership. There can be subclasses or other objects, like savings accounts.
From a security POV, OOP provides a black box approach to abstraction. users need to know the details of an object’s interface but don’t need to know the inner workings of the object to use it effectively.
Common terms:
–Message; Communication to or input of an object
–Method: Internal code that defines the actions an object performs in response to a message
–Behavior: Results or output exhibited by an object. The results of a message being processed through a method
–Class: A collection of the common methods from a set of objects that contain their methods
–Instance: Objects that are examples of classes that contain their methods
–Inheritancce: Occurs when methods from a class (parent or superclass) are inherited by another subclass (child) or object
–Delegation: Forwarding of a request by an object to another object or delegate. Happens when an object does not have a method to handle a message
–Polymorphism: Characteristic of an object that allows it to respond with different behaviors to the same message or method because of varying external conditions
–Cohesion: Strength of the relationship between the purposes of the methods within the same class. When all methods have similar purposes, there is high cohesion.
–Coupling: Level of interaction between objects. Lower coupling means less interaction.
What is the systems development lifecycle?
All systems development processes should have several activities in common.
–Conceptual definition
–Functional requirements definition
–Control specifications development
–Design review
–Coding
–Coding review walk-through
–System test review
–Maintenance and change management
What is the conceptual definition?
Creating the basic concept statement. Agreed on by all stakeholders (developers, customers, and management) that states the purpose of the project as well as the general requirements. very high level, not longer than two paragraphs. Security requirements are also high level; you might identify the classification of the data and the applicable handling requirements.
What is the functional requirements definition?
Specific system requirements are listed, and developers begin to think about how parts of the system work together to meet the functional requirements. The deliverable is a functional requirements document that lists specific requirements. Three major characteristics:
–Input: data provided to a function
–Behavior: what actions the system should take in response to the input
–Output: the data provided
What is the control specifications definition?
Controls should be designed into the earliest stages of development. useful to have a specifications development phase. comes after the functional development; continues as design and design review happen.
–need adequate access controls
–Maintain confidentiality through encryption and data protection
–Provide an audit trail to enforce individual accountability and a detective mechanism
–Address availability and fault tolerance as appropriate
Describe design review.
After the functional and control specifications are done, let the developers do their thing. They will determine how the various parts of the system will work together. Design management team sets specific tasks for varoius times and establishes initial timelines. Once the formal design documents are ready, a review meeting should happen to ensure everyone is in agreement.
What is the waterfall model?
Traditionally has seven stages of development. as each stage is completed, you move to the next one. The feedback loop characteristic is that, as you find defects, you go backward.
–System requirements
–Software requirements
–Preliminary design
–Detailed design
–Code and debug
–Testing
–O&M
Each phase should have validation and verifiation. Verfication evaluates based on specifications, while validations evaluates based on real-world requirements.
The iterative waterfall process allows you to go one step back to address defects discovered.
What is the spiral model?
Allows for multiple iterations of a waterfall-style process. It is a metamodel, aka model of models. each loop of the spiral results in a new system prototype. Theoretically, the entire waterfall process is repeated in each cycle. The idea is that developers return to the planning stages as changing technical demands and customer requirements necessitate the evolution of a system. The waterfall model focuses on large-scale efforts to deliver a finished system, whereas the spiral model involves iterating through a series of increasingly ““finished”” prototypes.
Describe the Agile software development process.
Has been gaining popularity. Developers prefers something that does not rely on rigid models but instead emphasizes the needs of customers and quickly developing new functionality.
Core philosophy:
–individuals and interactions over processes and tools
–working software ovver comprehensive documentation
–customer collaboration over contract negotiation
–responding to change over following a plan
12 principles that support the philosophy:
–Highest priority is to satisfy the customer through early and continuous delivery of valuable software
–Welcome changing requirements, even late in development. Agile processes harness change for the customer’s competitive advantage
–Deliver working software frequently, from a couple of weeks to a couple of months, with a preference to the shorter timescale
–Business people and developers must work together daily throughout the project
–Build projects around motivated individuals. Give them the environment and support they need, and trust them to get the job done
–The most efficient and effective way to convey information is face-to-face
–Working software is the primary measure of progress
–Agile processes promote sustainable development. The sponsors, developers, and users should be able to maintain a constant pace indefinitely
–Continuous attention to technical excellence and good design enhances agility
–Simplicity (art of maximizing work not done) is essential
–Best architectures, requirements, and designs emerge from self-organizing teams
–At regular intervals, the team reflects on how to become more effective, and adjusts accordingly
Agile is a philosophy and not a methodology. Specific methodologies include Scrum, Kanban, Rapid Application Development, Agile Unified Process, Dynamic Systems Development Model, and Extreme Program. Scrum is most popular. Scrum has daily syncs where the team gets together so each member can say what they did, what they plan to do next, and any obstacles. The scrum master runs these meetings; he or she is responsible for helping the team move forward. Work is organized into short sprints, usually between 1 and 4 weeks. There are short-term objectives for each sprint. At the beginning, the team gathers to plan the work that will be done. At the end, there should be.a fully functioning product. Subsequent sprints bring more functionality.
What is the capability maturity model?
CMU SEI introduced. Idea is that the quality of software depends on the quality of the development process. Does not explicitly mention security.
Level 1: Initial. Little or no defined software development process
Level 2: Repeatable. Basic lifecycle management processes introduced. Repeatable results are expected. Key process areas are requirements management, software project planning, software project tracking and oversight, software subcontract management, software quality assurance, and software configuration management
Level 3: Defined. Developers act based on formal, documented processes. All projects take place within these confines. Key areas are organizational process focus, organizational process definition, training, integrated software management, product engineering, intergroup coordination, and peer reviews.
Level 4: Managed. Quantitative measures are introduced. Quantitative process management and software quality management are the key areas.
Level 5: Optimizing. Process for continuous improvement. Key areas are defect prevention, technology change management, and process change management.
CMM has been superseded by the Capability Maturity Model Integration (CMMI). Same 5 stages, Level 4 is qualitatively managed. CMM focuses on isolated processes, while CMMI focuses on the integration of processes.
What is the software assurance maturity model?
Open source project maintained by OWASP. It seeks to provide a framework for integrating security services into the software development and maintenance process. It divides the proces into five business functions:
–Governance. Activities to manage the software development process. Includes practices for strategy, metrics, policy, compliance, education, and guidance.
–Design. Processes to define software requirements and create software. Includes threat modeling, threat assessment, security requirements, and security architecture.
–Implementation. Building and deploying software components and managing flaws in those components. Includes the secure build, secure deployment, and defect management practices.
–Verification. Set of activities that confirm code meets business and security requirements. Includes architecture assessment, requirements-driven testing, and security testing.
–Operations. Actions to maintain security after code is released. Includes incident management, environment management, and operational management.
What is the IDEAL model?
SEI also developed IDEAL, which implements many of the SW-CMM attributes. Has five phases.
–Initiating. Business reasons behind changes are outlined, support is built for the initiative, and the appropriate infrastructure is put in place.
–Diagnosing. Engineers analyze the current state of the organization and make general recommendations for change.
–Establishing. Organization takes the general recommendatins from the diagnosing phase and develops a specific plan of action to achieve those changes.
–Acting. Organiztion develops soluations and tests, refines, and implements them.
–Learning. Continuous assessment to determine whether the desired goals have been achieved and propose new actions as needed.
