Chapter 6 Secure Coding Flashcards
Software Development Phases
- Feasibility - should the effort be conducted?
- Analysis and requirements definition - what is the desired functionality?
- Design
- Development - actual coding of application, may include unit testing
- Testing and Integration Phase - formal testing, user acceptance test (UAT)
- Training and Transition Phase - acceptance, installation and deployment
- Ongoing Operations and Maintenance - patching, updates, modification
- Disposition/End-of-life
Code Deployment Environments
Development - where developers actually work
Testing - testing without impact on production environment, pre production and quality assurance
Staging - transition for code that tested successfully and is waiting to deploy
Production - live system
Waterfall (software development model)
Sequential software development, phases to NOT overlap, logically lead to next phase
relatively inflexible, still in use for complex systems
recommended for fixed scope, known timeframe or for stable tech platforms
Spiral (software development model)
Linear software development model, but with iterative process that revisits 4 phases for expansion significant emphasis on risk assessment 1. Identification 2. Design 3. Build 4 Evaluate
- round 2 requirements
- update design
- second build
- test and reassess risks
Agile (software development model)
Iterative and incremental process rather than linear, Agile focuses on creating working software that is flexible and adaptable rather than hard and fast rules with comprehensive documents and contracts.
- Individuals and interactions are more important than processes and tools
- working software is preferable to comprehensive documents
- customer collaboration replaces contract negotiation
- responding to change is key rather than following a plan
Continuous Integration v. Continuous Deployment
Cont. Integration is a developmental practice that checks code into a shared repository on a consistent ongoing basis
Cont. Deployment rolls out changes into production automatically as soon as they’ve been tested
OWASP secure coding practices
- define security requirements
- leverage security frameworks/libraries
- secure database access
- encode and escape data
- validate all inputs
- implement digital identity
- enforce access control lists
- protect data everywhere
- implement security logging and monitoring
- handle all errors and exceptions
API security
Application Programming Interfaces are interfaces between clients and servers or apps and OS that define how the client should ask for information from the server and how the server should respond.
- useful but must be secured
- programs in any language can implement API
Code review
Pair Programming - agile technique where one developer writes while one reviews as they write it. Adds cost and quality.
Over the Shoulder - requires the developer who wrote the code to explain it to the other developer.
Pass around Code Reviews - flexible but peers can’t learn about code from the developer
Tool Assisted Code Review - software based code review Atlassians Crucible, Codacy’s static code review, Phabricators Differential Code Review
Formal Code Review is in depth an time consuming, Fagan Inspection is the formal code review product
Manual code review is the process of reading the source code line by line to identify potential vulnerabilities
Static Code Analysis
Static Code Analysis can be seen as white box testing where testers have full visibility, focuses on understanding how the program is written and what its intended to do.
Dynamic Code Analysis runs the code while providing input to test the software
What is Fuzzing
Fuzz testing sends invalid or random data to an application to test its ability to handle unexpected data.
- This only identifies simple problems
Injection Vulnerabilities
Injection allows attackers to supply code to a web application and trick the web server into either executing the code or passing it to another server
Allows an attacker to relay malicious code through a web app to the supporting OS or other system
SQL injection
modifying SQL requests attackers provide input into web app, then monitor for the result.
-Blind SQL injection is when an attacker cannot review the results.
best defense is to validate data
Blind Content Based v. Blind Timing Based SQL injections
Blind Content Based - attacker sends input to the web app that tests whether the app is interpreting injected code before attempting an attack.
Blind Timing Based - attackers use the amount of time required to process a query as an attack vector. sometimes programmers insert a delay before the next action. If an attacker probes such a system and it returns immediately, its probably not vulnerable.
SQLmap and Metasploit automate blind timing based attacks
LDAP and DLL
DLL is a windows library containing code and data.
Command Injection
In some cases, app code may reach back to the OS to execute a command. This is especially dangerous because attackers can exploit a flaw in the app and gain direct access to the OS.
Session Hijacking
This occurs when an attacker commandeers an existing authenticated session. Usually done using cookies.
Session Replay Attack
Replay attacks are network attacks that repeat or delay a valid data transmission. A hacker can steal the users Unique Session ID stored as a cookie, URL or form field and gain authorization.
How to protect against cookie theft?
secure cookies, which are never transmitted over unencrypted HTTP connections.
what is a NTLM Pass the hash attack?
Replay attack against the OS rather than an app. the attacker begins by gaining access to windows system then harvest stored NTLM password hashes
What is insecure direct object reference?
Sometimes apps pull data directly from database. if the app doesn’t validate checks, this attack can occur.
Remember link with student ID on the end of the URL, the user can change the student ID and see data.
What is directory traversal?
type of HTTP exploit used to gain access to restricted directories or files
/../../etc/psswrd
What is file inclusion?
File inclusion takes directory traversal to the next level, instead of simply retrieving a file from the local OS, file inclusion attacks actually execute the code within a file allowing the attacker to fool the web server into executing arbitrary code.
What is privilege escalation?
Shifting from initial access to more advanced privileges such as root access.
Privilege escalation specifically seeks to increase the level of access an attacker has to a target system
