UNIT NO:03“Security Controls and Measures

Prepared by
Prof. Shweta G. Lilhare
(Assistant Professor)

CLASS: SY([Link])
SUBJECT: ISF (SEM-II)
UNIT:4 UNIT NO:1 NETWORKING fUNDAMENTLS
 4. Operating System and Application Security

➢Patch Management,
➢ Vulnerability Assessment Tools,
➢ Patch Deployment Strategies,
➢ Automated Patching Systems,
➢Secure Software Development,
➢Secure Coding Principles,
➢Threat Modeling and Risk Assessment,
➢Code Review and Security Testing
Patch management…?
Patch management is the process of applying updates to software, drivers, and
firmware to protect against vulnerabilities. Effective patch management also helps
ensure the best operating performance of systems, boosting productivity.
• A patch is a piece of software code (usually made up of one or more files) written by a programmer to fix
and update an application or file.
• Patches are created to fix problems and improve the functionality of computer applications and operating
systems.
• They can be applied to both the Linux and window platforms, but do not work on Mac computers.
➢ Patches are developed for all types of programs.
➢ Applications for desktops, laptops, smartphones, and tablets are all patched regularly by programmers
when bugs are reported or new features added that require changes to existing code.
➢ In many cases, if you do not install these updates and patches, your device could be vulnerable to malware.

➢ Patches or updates are released by the utility vendors to fix existing bugs and provide new features.

➢ Updating your system with patches is an important part of protecting it from cyberattacks and exploits
 The patch management lifecycle
• 1. Asset management
•
To keep tabs on IT resources, IT and security teams create inventories of network assets like third-party applications, operating systems, mobile
devices, and remote and on-premises endpoints.
• IT teams may also specify which hardware and software versions employees can use.
• This asset standardization can help simplify the patching process by reducing the number of different asset types on the network.
• Standardization can also prevent employees from using unsafe, outdated, or incompatible apps and devices.

• 2. Patch monitoring
•
Once IT and security teams have a complete asset inventory, they can watch for available patches, track the patch status of assets, and identify
assets that are missing patches.

• 3. Patch prioritization
•
Some patches are more important than others, especially when it comes to security patches.
• According to Gartner, 19,093 new vulnerabilities were reported in 2021, but cybercriminals only exploited 1,554 of these in the wild (link resides
outside [Link]).

• IT and security teams use resources like threat intelligence feeds to pinpoint the most critical vulnerabilities in their systems. Patches for these
vulnerabilities are prioritized over less essential updates.

• Prioritization is one of the key ways in which patch management policies aim to cut downtime. By rolling out critical patches first, IT and security
teams can protect the network while shortening the time resources spend offline for patching.

•
• 4. Patch testing
•
New patches can occasionally cause problems, break integrations, or fail to address the vulnerabilities they aim to fix.
• Hackers can even hijack patches in exceptional cases. In 2021, cybercriminals used a flaw in Kaseya's VSA platform (link resides outside
[Link]) to spread ransomware to customers under the guise of a legitimate software update.

• By testing patches before installing them, IT and security teams aim to detect and fix these problems before they impact the entire network.

• 5. Patch deployment
•
"Patch deployment" refers to both when and how patches are deployed.

• Patching windows are usually set for times when few or no employees are working. Vendors' patch releases may also influence patching
schedules.
For example, Microsoft typically releases patches on Tuesdays, a day known as "Patch Tuesday" among some IT professionals.

• IT and security teams may apply patches to batches of assets rather than rolling them out to the entire network at once.
• That way, some employees can continue working while others log off for patching.
• Applying patches in groups also provides one last chance to detect problems before they reach the whole network.

• Patch deployment may also include plans to monitor assets post-patching and undo any changes that cause unanticipated problems.

• 6. Patch documentation
•
To ensure patch compliance, IT and security teams document the patching process, including test results, deployment results, and any assets
that still need to be patched.
• This documentation keeps the asset inventory updated and can prove compliance with cybersecurity regulations in the event of an audit.
Patch Deployment Strategies:
• Patch deployment in networking is the process of applying updates to
networks, such as hotfixes and patches.
• This process is important for IT organizations because it helps to secure
networks from attacks.
• Implementing security patch management helps you address known software
vulnerabilities.
• Patch based deployment options facilitate Network administrators to deploy the
patch on all the vulnerable systems applicable for vulnerability management.
• Security patches
• Security patches are a top priority and should be deployed as soon as possible after testing and
release.
• Automated patch management
• Automated patch management software can help streamline the patch deployment process,
especially for large enterprises.
• Cloud-based patch management
• Cloud-based patch management is a good option for hybrid environments and remote users.
• Regulatory frameworks
• Regulatory frameworks often require prompt patch deployment.
Automated Patching Systems
• Automated patching can help ensure you can quickly address and get ahead of potential software,
operating system, and application vulnerabilities.
• Automated patching can help reduce the risk of unpatched software, systems, and applications leaving
your network vulnerable to malware and cyber threats.
• Automated patch management refers to the process of using software tools to identify, acquire, test, and install
patches or updates on systems and software applications without manual intervention.
• These patches can be related to bug fixes, security vulnerabilities, or performance improvements.

Why is automated patching important?

• Automated patching ensures rapid action and mitigation of vulnerabilities.
• This gives a head start against software vulnerabilities and zero days.
• With an automated patch management process.
• Admins can also bolster the network security against malware and cyber threats, by patching the systems and
applications on time and preventing any loopholes.
• Key Benefits of Automated Patch Management:
• Security: Automatically applying security patches helps to quickly address vulnerabilities, reducing the
risk of attacks or data breaches.
• Time Savings: Automating the process saves IT teams from manually identifying and deploying patches
across multiple systems.
• Consistency: Ensures that all systems are patched uniformly, reducing inconsistencies and errors that
can arise from manual patching.
• Compliance: Automated patch management ensures that systems are updated in compliance with
regulatory and industry standards.
• Minimized Downtime: By scheduling patches during off-hours or low-usage periods, automated
systems can minimize disruptions to business operations.
• Popular Automated Patch Management Tools:
• Microsoft SCCM: A widely used tool for managing updates across Windows-based
environments.
• SolarWinds Patch Manager: Integrates with WSUS and SCCM to offer broader patch
management features.
• Ivanti Patch Management: Offers automated patching across a wide range of operating
systems and applications.
• ManageEngine Patch Manager Plus: Provides an easy-to-use interface for patching across
various platforms.
Secure Software Development
• The Secure Software Development Life Cycle (SSDLC) is a framework for developing secure
software.
• It is a set of processes and activities that organizations follow to ensure that their software is
developed with security in mind.
• The goal of the SSDLC is to identify and mitigate potential security vulnerabilities and threats
in the software development process, so that the final product is as secure as possible.
• The SSDLC typically includes activities such as threat modeling, secure coding practices,
security testing, and security reviews.
Why Is SSDLC Important?

• The SSDLC is important because it helps organizations develop secure software that is resistant to
attacks and can protect sensitive data.
• In today's digital landscape, software security is more important than ever, as software is used to store
and process vast amounts of sensitive information.
• If software is not developed with security in mind, it can be vulnerable to attacks that can compromise
sensitive data and cause harm to individuals and organizations.
• Secure software development typically refers to incorporating security practices and checks throughout
the software development lifecycle (SDLC).

• 1. Threat Modeling
• Identify potential threats and vulnerabilities early in the design phase.
• Create models that predict how an attacker could exploit weaknesses.
• 2. Secure Coding Practices
• Follow coding standards to prevent common vulnerabilities such as SQL injection, cross-site scripting (XSS), and buffer overflows.
• Use static analysis tools to catch insecure code early.
• 3. Security Testing
• Dynamic Analysis (DAST): Testing the software in real-time to discover security vulnerabilities.
• Static Analysis (SAST): Reviewing the codebase for vulnerabilities before execution.
• Penetration Testing: Simulating attacks to discover how the application might be compromised.
• 4. Regular Patch Management
• Integrate automated patch management to ensure that software dependencies are always up-to-date with the latest security
patches.
• 5. Dev SecOps
• Integrating security practices directly into the CI/CD pipeline, so that security testing happens automatically during development
and deployment.
• 6. Data Protection
• Encrypt sensitive data both at rest and in transit.
• Implement proper access controls and data handling mechanisms.
Secure Coding Principles
Why is Secure Coding Important?

• Secure coding demonstrates a changing shift in responsibility by literally naming the developer as
responsible for code security rather than a security team.
• This also paves the way for the Shift-left security concept that is already being widely adopted as part
of the Software Development Life Cycle (SDLC).
• a set of guidelines and best practices that help developers write software with minimal security vulnerabilities.
Following these principles ensures that software is robust and protected against common threats like data breaches,
malware, and unauthorized access.
Here are key secure coding principles:
• 1. Input Validation
• Ensure that all inputs (user, network, or external sources) are validated before processing.
• Prevent attacks like SQL injection and buffer overflows by using proper data validation techniques such as
whitelisting and sanitizing inputs.
• 2. Authentication and Access Control
• Enforce strong authentication mechanisms to verify the identity of users.
• Use proper access control to ensure that users have permission only to the resources they are authorized to access.
Secure Coding Principles

• 3. Least Privilege
• Grant only the necessary permissions to users or processes, minimizing the potential damage from a compromised
account or system.
• Limit the access rights for users to the bare minimum required.
• 4. Fail-Safe Defaults
• Ensure systems are designed to deny access by default, granting access only when explicitly allowed.
• Use secure defaults for system configurations and software installations.
• 5. Separation of Duties
• Divide responsibilities among multiple users or processes to prevent any one person or entity from having
complete control, which can reduce the likelihood of insider threats.
• 6. Defense in Depth
• Implement multiple layers of security controls (firewalls, intrusion detection, encryption) to protect systems and
data.
• 7. Avoid Security by Obscurity
• Don’t rely solely on hiding details to secure a system. Use well-established, thoroughly tested algorithms and
protocols.
• Security should not depend on keeping implementation details secret.
• 8. Secure Error Handling
• Handle errors and exceptions in a way that does not leak information or provide attackers with hints about potential
vulnerabilities.
• Avoid disclosing sensitive information in error messages (such as stack traces).
• 9. Session Management
• Implement secure session handling, such as generating random, unique session IDs and using HTTPS to transmit
session information.
• Ensure sessions are properly terminated and that users cannot reuse old sessions.
• 10. Secure Data Transmission
• Use encryption protocols like SSL/TLS to ensure that data transmitted over a network is protected from
eavesdropping and tampering.
• Secure both data at rest and in transit by employing strong encryption methods.
• 11. Patch and Update Management
• Regularly apply software updates and security patches to keep systems protected from known vulnerabilities.
• Automate and enforce patch management policies to prevent outdated systems from being exploited.
 Threat Modeling and Risk Assessment
➢ Threat modeling and risk assessment are both important cybersecurity activities that help identify, evaluate,
and prioritize potential threats to assets.
➢ They are often used together to help secure systems and data, and can be integrated into the design and
development processes of secure systems.
Threat Modeling: A Proactive Approach to Security:
➢ Threat modeling is a proactive process of identifying and mitigating potential threats and vulnerabilities before the
software development lifecycle,
➢ before any implementation of changes to systems is done.
➢ This activity is carried out purposefully with the aim to understand and assess existing security risks within a specified
application, system, or organization
. These are a few points:
[Link] Assets and Scope: This step involves creating an inventory of the assets or components that
need protection and defining the scope of the analysis.
[Link] Creation: A comprehensive model, such as a data flow diagram, is built to illustrate how data flows
through the identified assets.
This model highlights the interactions between different components.
[Link] and Vulnerabilities Identification: Potential threats and vulnerabilities that could exploit the
system’s weaknesses are identified and documented
• Threat Modeling:
• Threat modeling is a structured approach used to identify, assess, and address security
threats to a system.
• The goal is to understand potential threats and vulnerabilities and take proactive measures
to mitigate them.

• Key Steps in Threat Modeling:

[Link] Assets: Determine what needs to be protected, such as data, systems, or intellectual
property.
[Link] Threats: Analyze the various threats that can affect those assets (e.g., hacking,
malware, insider threats).
[Link] Vulnerabilities: Determine which parts of the system or process are vulnerable to
those threats.
[Link] Impact: Assess the potential damage or impact if a vulnerability is exploited.
[Link] Threats: Rank threats based on their likelihood and potential impact.
[Link] Countermeasures: Implement security controls and measures to mitigate
identified threats.
Risk Assessment
• Risk assessment focuses on evaluating the likelihood and impact of threats to determine
the level of risk.
• It helps organizations understand which threats pose the most significant risks and
prioritize mitigation efforts.

• Key Steps in Risk Assessment:

[Link] Risks: Based on the threats and vulnerabilities identified in threat modeling.
[Link] Risk: Assess the likelihood of a threat occurring and its potential impact.
[Link] Risk: Determine the level of risk, which is often expressed as:
[Link] Risks: Rank risks based on their severity and business impact.

Risk = Likelihood x Impact

Code Review and Security Testing
• Code Review
• Code review is a systematic examination of source code by developers other than the author.
• It is a crucial part of the software development lifecycle aimed at improving code quality and
identifying potential security vulnerabilities early in the process.

• Key Benefits of Code Review:

[Link] Bugs Early: It helps identify and fix bugs, logic errors, and security flaws before code
is deployed.
[Link] Coding Standards: Ensures code adheres to project-specific guidelines, promoting
consistency and maintainability.
[Link] Sharing: Allows developers to learn from one another and improve their skills.
[Link] Security: Identifies potential security risks, such as hardcoded passwords,
insufficient input validation, or SQL injection vulnerabilities.
 Code Review and Security Testing
• Security Testing
• Purpose: To identify vulnerabilities and security flaws in the application before it is deployed, ensuring
that the application is secure against attacks.
• Key Types of Security Testing:
1. Static Application Security Testing (SAST):
1. Definition: Analyzes source code or binaries without executing the program.
2. Tools: Examples include Fortify, Checkmarx, and Veracode.
3. Focus: Identifies vulnerabilities like SQL injection, cross-site scripting (XSS), and buffer overflows
during the coding phase.

[Link] Application Security Testing (DAST):

• Definition: Tests the application while it is running, simulating attacks to find vulnerabilities.
• Tools: Examples include OWASP ZAP, Burp Suite, and Acunetix.
• Focus: Detects runtime vulnerabilities, including server misconfigurations and flaws in the application’s
logic.
• Best Practices for Code Review and Security Testing

[Link] Security Early: Implement security practices throughout the software development lifecycle
(SDLC), often referred to as "shifting left."
[Link]: Provide training for developers on secure coding practices and the importance of security
testing.
[Link] Audits: Conduct regular security audits and code reviews to keep the codebase secure and
maintain high-quality standards.
[Link] Loop: Create a feedback mechanism for developers to learn from security testing results and
code reviews, promoting continuous improvement.
[Link] Culture: Foster a culture of collaboration between developers and security teams to
prioritize security in the development process.