Lecture 8 - Legacy systems Flashcards
What is a legacy system?
Definition is subjective & there are many viewpoints.
“a system that was developed sometime in the past and is critical to the business in which the system operates. “ (RANSOM ET AL)
Could be a server, application etc
Typically, legacy systems were developed before the widespread use of modern software engineering methods and have been maintained to accommodate changing requirements.
Why are legacy systems important?
They contain business-critical information that represent considerable business knowledge & processes.
What are the challenges with legacy systems
The following make legacy systems susceptible to cyber security concerns:
- unpatched software
- outdated
- difficult to understand (trained staff retired/poor documentation)
- expensive to maintain
- inefficent
- Software typically poor & does not respond to change easily.
What dilemma do enterprises face with legacy systems (Alex Heid)
Critical to the performance of daily business operations (ie., in the banking industry/healthcare)
But they run on outdated software which poses a serious security threat to organisations.
Therefore, they need to be segregated from other public networks/devices to try and reduce this threat.
What dilemma do enterprises face with legacy systems
Need to weigh up the costs & benefits
Crucial to business processes, but are complex, poorly understood & require a significant investment to maintain & manage the systems.
What is a legacy system from the Mainframe Era?
SABRE (Semi-Automatic-Business-Research-Environment) by American Airlines & IBM
What are the strengths of legacy systems from the Mainframe Era?
- They only used dumb terminals (no sophisticated processes/capabilities), so developers/architects were forced to restrict complexity to the mainframe and there was a limited user interface.
- easier to secure because the attack surface
Although these strengths provided some relief, there are still problems.
What are the concerns about legacy systems from the Mainframe Era?
- Architects/systems/programmers/app developers did not consider cyber security concerns, the physcial connection (ie. wires) and building the system
- They assumed everything was secure (no malicious insiders etc)
How can you address issues with Mainframe legacy systems
Addressing cyber concerns with Mainframe legacy systems (IBA)
- Improve Access control logic in the operating system
- Authentication is handled by the mainframe (rather than the dumb terminal)
- No encryption, files can be accessed based on user id, serious risk if maintained by a malicious insider - Be prepared for unexpected input validation
- Design decisions from years ago mean that there are no built in any input validation checks (eg., SQL injection!)
- Extreme, expected & unexpected cases must be handled properly. - Add a screen scrapper
- Provide Internet access to legacy applications without making any changes to the underlying platform.
- Can be delivered fast because its non-intrusive.
- But there are scalability issues (compared to modern systems) & might make the system more vulnerable by adding an additional attack layer
Explain the SABRE system.
Semi-Automatic-Business-Research-Environment.
- Airline Reservation system IBM & American Airlines
- (SAGE) which was originally designed to defend against Soviet attacks was used to reserve seats.
Explain legacy systems from the Client-Server Era?
- Clients are sophisticated & support more functionality between elements.
- Encryption is possible on the client (affords more secure communication between client & service)
- More done on the client itself, reducing the demands on the network.
- Insecure communication* p1 sends message to p2 but p3 (a malicious outsider observes in the cloud), BUT if it is pushed through an encryption function over cyber space they will only be able to see gibberish, so p2 will need to push it through the decryption function to consume it.
What are the concerns with legacy systems in the client-server era?
- Complex
- Expensive to maintain.
- Ideally, attack should gain no real insight by gaining access to a client.
- Poor visibility of what is happening on the client side
- Network-level connection
- Gain access beyond the perimeter of the enterprise
- Clients shouldn’t contain sensitive/specialised data (for any long period of time)
Describe how attackers can get access to client software during the client-server era?
Clients not up to date with the most recent software increases vulnerability.
Explain a legacy system from the Networked Era?
- Focus on logical isolation (physical constraints limited)
- Attackers use an anonymous proxy so they can use the system uninterrupted.
- Inputs must be validated to reduce the likelikhood of SQL injection & other suck attacks.
- Vulnerabilities depend on the implementation of the server-side technology (ie. Framework or bespoke)
Why is SABRE a good example of an evolving legacy system?
- Prioritized seat availability, but over time more people wanted to fly & want to choose aspects such as meal upgrades etc. and it became very slow.
- Sold-off legacy assets for $778 million so important
- Cyber security is not the primary concern, it is rebel business units loosing indepedence.
