Cloud Application Security Flashcards
List Steps in the SDLC
- Initiation and Plan
- Acquisition and Development
- Deployment
- Operations and Maintenance
- Decommissioning
What happens in the Initiation and Plan phase of the SDLC
- Define software and security requirements
- Create Software Requirements Specification (SRS)
- Project Plan and Costs
- Management Approval
What happens in the Acquisition and Development and Plan phase of the SDLC
Analysis and Design and Thread Modeling
SLA/NDA
Programming and testing (code review, unit testing, static analysis)
Documentation
What happens in the Deployment phase of the SDLC
- QA & Security Testing
- User Acceptance Testing
- Certification and Accreditation
- Roll-out Production
What happens in the Operations & Maintenance phase of the SDLC
Auditing/Continuous Monitoring
Change Control/Change Management
Data backups
What happens in the Decommissioning phase of the SDLC
Closing contracts
Data disposal
List SDLC Frameworks
Microsoft’s Security Development Lifecycle
Open Web Application Security Project (OWASP)
NIST 800-64 Special Security Considerations in the System Development Lifecycle
ISO 27034-1 Information technology - Security techniques - Application security ONF/ANF
Certification
AKA
Testing features and safeguards of a system to determine if it meets the organizations requirements
Applies to custom and COTS
AKA - Assessment
Accreditation
AKA
Management’s APPROVAL to DEPLOY the system into production, perhaps with special conditions (e.g managers authorization, seal of approval)
AKA Authorization
Certification and Accreditation AKA
Assessment and Authorization
Security System Development Lifecycle
The SSDLC builds security into each and every phase of the cycle
Even better and more proactive approach to building secure systems and applications
Organization Normative Framework (ONF)
ISO 27034
Used to help establish a framework with a security control library, required to build secure applications
Primary goal is to create seven containers that contain the policies and directions the organization uses during the development of operations of applications
Organization Normative Framework - ONF - Containers
- Business Context - security policy, standards and best practices adopted
- Regulatory Context - standards, laws, and regulations that affect application security
- Technical Context - includes required available technologies that are applicable to application security
- Specification - documenting the organizations IT functional requirements and the solution that are appropriate to address them
- Roles - factors related to IP applications
- Process - for application security
- Application Security Controls (ACS) Library - contains the approved controls that are required to protect an application based on the identified threats, the context, and the targeted level of trust
Application Security Management Process (ASMP)
A component of ONF
Used to create, manage, maintain each Application Normative Framework (ANF)
ONF is used to produce an ANF with ASMP
Created in 5 steps:
- Specify the application requirements and environment
- Accessing application security risks
- Creating and maintaining ANF
- Provisioning and operating the application
- Auditing the security of the application
Application Normative Framework (ANF)
ANF maintains the applicable portions of the ONF that are needed to enable a specific application to achieve the required level of security or the target level of trust
ONF to ANF is a one to many relationship
List common Software Development Methodologies
- Waterfall - one process completes in its entirety before you go the next phase
- Spiral - Cyclical process of Requirements, Risk Analysis, Prototype, and Validation until you get to the achieved goal
- Agile Software Development
List Agile Principles
- Working software delivered frequently (weeks rather that months
- Welcome changing requirements (even late in development)
- Close daily cooperation between business and developers
- Continuous attention to technical excellence and good design
- Emphasizing teamwork
List Agile Values
- Individuals and interactions over processes and tools
- Working software over comprehensive documentation
- Customer collaboration over contract negotiation
- Responding to change over following a plan
Agile vs DevSecOps
Management goal for Agile are focused on completing development units called sprints
Agile divides development and operations teams and doesn’t emphasize automation, while DevSecOps combines development, operations and security and emphasizes automation
DevSecOps implements organizational change - business owners, developers, operators and security/quality assurance collaborate on the project;
DevSecOps implements cultural change - emphasizes training all team members to have wide variety of similar and equal skills
DevSecOps - overall project deadlines and major version release benchmarks have priority and automation is primary goal to maximize efficiency when deploying software
Agile Scrum Roles
- Product Owner - a person with vision for the final product - customer
- Scum Master - manager/facilitator
- Scrum Team - developers
Verification and Validation Model (V-Model)
A model like waterfall but test planning and testing start at the earlier stage
Verification - determining through testing that what was built matches what was designed
Validation - through business analysis, determining that the application fits the needs of the organization. Often called Acceptance testing.
Prototype Model
Before the start of the actual software development, a prototype is created
The prototype is demonstrated to the customer
The customer gives feedback until the prototype is accepted
Iterative/Non-Iterative
Waterfall is not iterative, each phase is discrete and finalized
Spiral, Agile, and SCRUM are all iterative (incremental) models with rounds of development
CI/CD/CD
method of frequently deliver apps to customers by using automation during the stages of application development
Continuous Integration
new code changes to an application are regularly built and merged into a shared repository
solves the problem of too many branches of application development at the same time which may conflict
once integrated into the main body of code static testing is performed
happens between development and testing
Continuous Delivery
once static (automated) testing passes, the merged changes (e.g. updated application) gets automatically uploaded (and deployed) to staging environment, where final, dynamic testing is performed
happens between testing and staging
Continuous Deployment
once software has passed all prior testing stages, it gets automatically deployed to production
happens between staging and production
List and describe configuration management tools
- Puppet - a configuration management system; you define the state of IT infrastructure then Puppet is used to enforce the correct state
- Chef - you automate how you build, deploy and manage the architecture; The Chef server stores “recipes”. A Chef client is installed on each device and checks the Chef server periodically for any new or updated policies
- Ansible - used for software provisioning, application deployment and configuration management
All are used to ensure application configurations are updated as needed and consistency in application versioning
Sandbox
isolates and ensures the internal components will have an appropriate separation from any remaining components or sandboxes
An environment to fully test applications by executing them and observing them for malicious activity
PaaS can be used as a sandbox for developers by placing them in an isolated environment away from production
Software Assurance
encompasses the development implementation of methods and process for ensuring that software functions as intended and mitigating the risks of vulnerabilities, malicious code, and defects that could bring harm to the user
utilizes a concept of testing each module to verify if it was built correctly
Software Assurance Maturity Model (SAMM)
Open framework to help organizations CREATE and IMPLEMENT a STRATEGY for software SECURITY that is TAILORED to the specific RISK facing the organization.
Helps the organization to:
- Evaluating existing software security practices
- Building a software security assurance program
- Demonstrate improvements to your security assurance program
- Define and measure security related activities
Functional Testing
Describe
List steps
Compares how the application performs to the functional description and requirements outlined in the SRS. The internal logic of the system being tested is not known to the tester.
Steps:
- Identify functions the software is expected to perform
- Create input information based on the function’s specification
- Determine the output based on the function’s specification
- Execute the test case
- Compare the actual and expected results
List and describe types of Application Security Testing Tools
Static Application Security Testing (SAST) Tools - Analyzing an application without executing the code. Analyzing the source code looking for vulnerabilities and coding errors. This is white box testing and is useful for XSS, SQL Injection and Backdoors
Dynamic Application Security Testing (DAST) Tools - The application is executed on a system and its behavior is observed for vulnerabilities. This black box testing and is useful to test exposed HTTP and HTML interfaces
STRIDE
STRIDE Threat Model is a threat classification model to classify and categorize security threats against applications
First identify threats to an application and classify them with these SRIDE labels, asking "what would happen if" Spoofing Identity Tampering Repudiation Information Disclosure Denial of Service Elevation of Privilege
Next, categorize them by understanding the criticality of the threats through DREAD:
Damage - how bad would the attack be?
Reproducibility - how easy is it to reproduce the attack?
Exploitability - how much work is it to launch an attack?
Affected users - how many people are impacted?
Discoverability - how easy is it to discover the threat?
Runtime Application Self Protection
An application that possesses self protection controls
Prevents attacks by self protecting or reconfiguring without human intervention
AKA Self Healing
Penetration Testing
A process used to collect information related to system vulnerabilities and exposures and then possibly attempt to actively exploit the vulnerabilities in a system
What is required in order for authorization to perform ANY security testing?
Any form of security testing including penetration testing, written permission must always be obtained prior to undertaking the test and the testing scope must be determined ahead of time.
List and describe Penetration Testing Strategies
- Zero-knowledge - Black-box from the outsider or hacker perspective
- Partial knowledge - Grey-box; Have some knowledge, typically have a user account. From an insider perspective; insider threats tend to have the highest impact
- Full knowledge - White-box; Typically have an admin account. From the system administrator perspective. Also this test equipment much more thoroughly
List Pen Testing Steps In Order
- Discovery (Reconnaissance)
- Enumeration
- Vulnerability Mapping
- Exploitation (execution)
- Document Findings
Describe the Pen Testing Step Discovery (Reconnaissance)
Research and reconnaissance e.g. Google, DNS, WHOIS, job postings, Facebook, Linkedin, dumpster diving to collect information
Describe the Pen Testing Step Enumeration
Investigating or Probing the environment (mapping IPs, platforms, OS’s, ports, users, etc.)
Use tools like Nmap
Describe the Pen Testing Step Vulnerability mapping
Look for vulnerabilities: Open ports, protocols Patches installed Weak passwords Any defenses in place
Use tools like Nessus, SAINT, Retina, etc
CVE - Common Vulnerability and Exposure - Database of all known vulnerabilities; maintained by mitre.org
Describe the Pen Testing Step Exploitation (execution)
Attempt to exploit the vulnerabilities identified
e.g. seizing control of system and exfiltrating data or disabling system or pivot to other network, scorched earth
Use tools like metasploit
Describe the Pen Testing Step Document Findings
Report should include:
- Identified problems and vulnerabilities
- Whether defenses worked. Was anyone aware of the pen-test activities, did they respond, when
- Any recommendations
Open Web Application Security Project (OWASP)
Community driven effort to teach web developers how to make more secure web applications
OWASP Top Ten
- Injection - injecting malicious database commands
- Broken Authentication - poorly implemented Authentication system
- Sensitive Data Exposure - not properly protecting sensitive data
- XML External Entities - XXE - XML problems with un-sanitized input that could lead to an attacker referencing or obtaining sensitive files, info, launching commands
- Broken Access Control - not properly enforcing authorization
- Security Misconfiguration - using default configurations, or making config mistakes
- Cross Site Scripting (XSS) - unauthorized scripts being placed on your website that attacks users
- Insecure Deserialization - malicious variables are added into a string of variables and they go un-noticed on the backend during processing
- Using Components with Known Vulnerabilities - not updating or patching software
- Insufficient logging and monitoring - not reviewing log files means attacks go unnoticed
OWASP Recommendations
Create a testing guide with 11 types of active security testing categories
- Information gathering
- Configuration and deployment management testing
- Identity Management testing
- Authentication testing
- Authorization testing
- Session management testing
- Input validation testing
- Testing for error handling
- Testing for weak cryptography
- Business logic testing
- Client-side testing
API - Application Programming Interface
method for transferring information from one place to another typically between a user and a program or between process to process
Primary method to avoid vendor lock in
Representational State Transfer (REST)
API standard
an architecture style that relies exclusively on transferring data using Internet based UrL addressing scheme
makes use of the HTTP verbs
supports many different formats: JSON, XML, YAML, etc.
encrypts externally with TLS/HTTPS
Good performance and scaling, uses caching
Widely used
Simple Object Access Protocol (SOAP)
API standard
an architectural style that relies exclusively on XML to provide messaging services and makes use of header and an envelop format that encases the message
Supports one message format: XML
Message level cryptography included
Slower performance that REST, scaling is complex, caching is not possible
Used where REST is not possible, provides WS-* features
Containerization
Packing up software and all its dependencies so that it can be run uniformly and consistently on any infrastructure
Makes apps portable, scalable, more secure, and faster to deploy
List the two popular container tools
Docker - a coupled SaaS and PaaS product that uses OS-level virtualization to develop and deliver software containers
Kubernetes - an open source orchestration system for automating application deployment, scaling and management
Microservices
Architecture style where an application is arranged as a loose collection of different services, possibly by different providers across the cloud
Services are fine grained and the protocols are lightweight
Services are owned by small, self contained teams
Makes applications easier to scale and faster to develop
Serverless
Cloud computing model where a cloud provider allocates machine resources on demand, taking care of the servers on behalf of the customer
Developers need not be concerned with capacity planning, configuration management, maintenance or scaling of containers, VMs, or physical servers; this is all handled by the provider
Function as a Service (FaaS)
Focused on the event-driven computing paradigm wherein application code, source code, and containers only run in response to events or requests
Infrastructure as Code (IaC)
Automates the provisioning of infrastructure within data centers
Provides the ability to design, implement, and deploy application infrastructure with greater speed, reduction of cost and automation and avoid human errors
It uses software definition files that are machine readable by software aware networking devices
