10/25/2023
Outline
• Introduction to Security
SOFTWARE SECURITY • Software Security
• Why Software Security?
CHAPTER 1 - INTRODUCTION • Software Problem
• Why is Software Security Hard?
• Software Security Methods and Technologies
Computer Security Terminologies Computer Security Terminologies
Vulnerability - A weakness or flaw in a system’s design or an
implementation error that could be exploited to compromise the Threat – A circumstance or an event that has the potential to
security of the system compromise or violate security and cause harm
Examples • The possible danger that could compromise the confidentiality,
– A door with a broken lock integrity and availability of a computer system or service
– An OS library that grants administrative access • A threat is an event that can take advantage of vulnerability
– A week password • May be malicious (intentional) or Accidental
• Doesn't mean your system has been breached Intentional threat - an attack by an intelligent entity (e.g., an
– Someone has to know about the vulnerability individual attacker a criminal organization)
The vulnerabilities could be weaknesses in – May be external (an attacker from the internet) or internal (an
Technology employee)
TCP/IP protocol weaknesses, operating system weaknesses, network Accidental threat
equipment weaknesses, etc. – Unintended equipment malfunction (e.g., hard disk failure)
Configuration
– Natural disaster (e.g., fire, flood, earthquake, windstorm, People using
Misconfigured network equipment (misconfigured routing protocols) the system are a threat/weak link
Security policy
1
10/25/2023
Computer Security Terminologies Computer Security Terminologies
Attack - Any action derived from intelligent threats to expose, alter, Attack Surfaces – consist of the reachable and exploitable vulnerabilities
disable, destroy, steal or gain unauthorized access to or make in a system
unauthorized use of an computer systems asset and violate the
security of the system
• Examples
Passive Attack Active Attack
• Attempts to learn or make use of • Attempts to alter system resources – Open ports on outward facing Web and other servers, and code
information from the system but or affect their operation listening on those ports
does not affect system resources • Involve some modification of the
– Code that processes incoming data, email, XML, office documents,
• Eavesdropping or monitoring data or the creation of a false data
of transmissions • Four categories: and industry-specific custom data exchange formats
• Goal of attacker is to obtain Replay
– An employee with access to sensitive information vulnerable to a
information that is being Masquerade
transmitted Modification of messages social engineering attack
• Two types: Denial of service
Release of message contents
Traffic analysis
Computer Security Terminologies Computer Security Terminologies
Attacker/Cracker – a person or process that attempts to break into
computer systems in order to steal, change, or destroy information Attacker/Cracker – a person or process that attempts to break into
computer systems in order to steal, change, or destroy information
• Attacker attempts to access computer systems without authorization
Types of attackers
• A hacker is someone who uses his/her skills and knowledge to find
vulnerabilities in computer systems and helps improve and patch those – Cybercriminals: are individual or group of people who use
vulnerabilities technology to commit cybercrime with the intention of stealing
– White hat or Ethical hacker sensitive company information or personal data and generating
• Attackers are often malicious, as opposed to hackers, and have profits
many means at their disposal for breaking into a system – Hacktivists: are individuals or groups of hackers who carry out
• Crackers are also called black hats malicious activity to promote a political agenda, religious belief, or
social ideology
– They look for backdoors in programs and systems, exploit those
backdoors, and steal private information for use in a malicious way – State-sponsored: have particular objectives aligned with either the
political, commercial or military interests of their country of origin
2
10/25/2023
Computer Security Terminologies
Computer Security Terminologies
Countermeasure - an action, device, procedure, or technique that Countermeasure - an action, device, procedure, or technique that
reduces a threat, a vulnerability, or an attack by eliminating or preventing reduces a threat, a vulnerability, or an attack by eliminating or
it, by discovering and reporting it so that corrective action can be taken preventing it, by discovering and reporting it so that corrective
action can be taken
• Any means taken to deal with security attack
• Preventing a particular type of attack from succeeding • Detection: detect an ongoing or past attack
– If an attempted breach occurs, make sure it is detected
– Prevention: stop an attack by system design and using security
technologies and defenses • Response: respond to attacks
– When prevention is not possible or fails, the goal is to – In case of security breach occurs, have a recovery plan
detect the attack then recover from the effects of the attack
– Responses range from restoring from backups or claiming on
insurance, through to informing stakeholders and law enforcement
agencies
Computer Security Terminologies Computer Security Terminologies
Vulnerabilities, Threat, Attack, and Countermeasures • To get more information on security issues, vulnerabilities,
and exploits, have a look at
• Most systems have one or more vulnerabilities, but this does – CWE (Common Weakness Enumeration)
not mean that the systems are too flawed to use [Link]
– US-CERT bulletins [Link]
– Vulnerability is not a risk without a threat exploiting it
– US-CERT Technical Cyber Security Alerts
• Not every threat results in an attack [Link]
– Threat is not a risk without a vulnerability to be exploited – CVE (Common Vulnerability Enumeration)
• Not every attack succeeds [Link]
[Link]
– Success depends on the degree of vulnerability, the strength of
– NIST’s vulnerability database
attacks, and the effectiveness of any countermeasures in use
[Link]
• A countermeasure may itself introduce new vulnerabilities – Application vulnerabilities: OWASP [Link]
3
10/25/2023
Computer Security Terminologies Computer Security Terminologies
Trust and Trustworthiness
Trust and Trustworthiness
• Trustworthiness is the measure in which a component or
• Every system must trust something
system, meets a set of properties
• The degree of trust placed by A on B is expressed by the set of
properties that A trusts in B • Common cause of insecurity: a component can be trusted
without being trustworthy
• Trust is an underlying assumption
– To understand a system we must know what it trusts – If A trusts B, then A accepts that a violation in those properties of B
might compromise the correct operation of A
• Typical examples of trusted entities:
– We trust the system administrator
– We trust the hardware to behave as expected
• Minimizing the need for trust is a good idea
Computer Security Terminologies Computer Security Terminologies
Trust and Trustworthiness Trust and Trustworthiness
• Software and its users trust many things
• Trust is transitive – Hardware and software from other vendors,...
– A system provided a menu that allows reading email – Did a programmer left a backdoor in the system?
– Did the download site introduced a Trojan?
– Email program called vi to edit messages
– Shall a foreign government trust hardware and software made in
– vi allows arbitrary execution of Unix commands a vulnerability US (or whatever)?
– The program should allow reading email, not executing commands • Are they trustworthy? Supply chain problem…
• Trust is transitive:
– The system trusted the email program
– The email program trusted the editor (vi) just to edit files
– The editor was not trustworthy (it did something else)
4
10/25/2023
Software Security Software Security
Software security • Software provides functionality or service
• “idea of engineering software so that it continues – Example: on-line banking
to function correctly under malicious attack” – This functionality comes with certain risks
– Protect software against malicious attack so that the • Example: what are risks of on-line banking?
software continues to function correctly under such – Software security is about managing these risks
potential malicious attacks
• Software security does not get much attention
• Existing software is riddled with design flaws and
– Most system developers are concerned with correctness of
implementation bugs
software systems, achieving desired behavior
– 70% related to design flaws
• Correctness: - the system behaves as specified under expected
• “any program, no matter how innocuous it seems,
circumstances
can harbor security holes”
– An attacker could maliciously change the behavior of software
systems
J. Viega & G. McGraw. Building Secure Software, 2002
Software Security Software Security
Undesirable behaviors • There is often a trade-off between
• Stealing information: Confidentiality – Security
– Corporate secrets – Functionality & Convenience
– Personal information (credit card numbers, SSNs, …)
• Modifying information or functionality: Integrity
– Installing unwanted software (spyware, botnet client, …)
– Destroying records (accounts, logs, plans, …)
• Denying access: Availability
– Unable to access banking information
• Software security is about preventing such undesirable
behaviors under wide range of circumstances
5
10/25/2023
Why Software Security? Software Security
• Software is everywhere • Many security breaches begin by exploiting a vulnerability
– Runs your car
– Controls your cell phone
– A security-relevant software defect that can be exploited to effect an
– Keeps your dishwasher going undesired behavior
– The lifeblood of your bank and the nation's
power grid • Defects occur in the software’s design and its implementation
• Businesses and society come to – A flaw is a defect in the design
depend more heavily on software
– A bug is a defect in the implementation
– So, we have to make it better
• Software increasingly become • To build secure software, we must
connected to each other – Eliminate bugs and design flaws or
– Software security is no longer a luxury—
it's a necessity – Make them harder to be exploited
J. Viega & G. McGraw. Building Secure Software, 2002
Software Problem Software Problem
• A central and critical aspect of the computer security problem Bad software is everywhere
is a software problem
• NASA Mars Climate Orbiter
• Most computer systems get hacked/compromised by attacking – Crashed due to a units conversion bug ($165 million)
Software • NASA Mars Pathfinder
– Why can websites, servers, browsers, laptops, smartphones, wifi access – Stopped for several hours due to a priority inversion bug ($265 million)
points, network routers, mobile phones, cars, pacemakers, uranium • The Ariane Rocket Disaster (1996)
enrichment facilities, ... be hacked? – Caused due to numeric overflow error
– Because they contain Software – Attempt to fit 64-bit format data in 16-bit space
• … and many others!
“Behind every computer security problem and malicious attack
lies a common enemy --- Bad software”
[J. Viega & G. McGraw. Building Secure Software, 2002]
6
10/25/2023
Software Problem Software Problem
• The current state of security in commercial software is rather
• No need to spend so much on network security if we didn’t
distasteful
have such bad software
– Marked by public reports of vulnerabilities and actual attacks – Windows XP -
• Think about the most recent security vulnerability you’ve read Ransomware
– Scrambling among developers to fix and release patches
– Maybe it is one of the buffer overflows that allow an attacker to take – Continual exhortations to customers to perform rudimentary checks and
control of a computer maintenance
– Maybe it is an encryption vulnerability that allows an attacker to read • Software buyers are literally crash test dummies
an encrypted message – For any harm, damages or loss that should occur because of manufacturing
• The security of computer systems and networks has become defects or weaknesses
increasingly limited by the quality and security of the software running • Allow cyber attackers to break into and hijack our computer systems
on the machines
• Internet-enabled software, especially custom applications that use the
Web, are a common target for attack
J. Viega & G. McGraw, Building Secure Software, 2002 Jim Routh, Forcing Firms to Focus: Is Secure Software in Your Future, in Beautiful Security, O'Reilly, 2010
[David Rice. “Geekonomics: The Real Cost of Insecure Software”, Addison-Wesley, 2007]
Why the Software Problem is Growing? Complexity
• Attacks exploit bugs - vulnerabilities
• Three trends in modern computing systems makes them more
– Estimated 5-50 bugs per Klines of code (5 if rigorous quality assurance)
susceptible to security problems, and makes it harder to – Examples (number of lines of code):
secure them • Solaris 7500K
• Windows 95 <5M
• The trinity of trouble
• Windows XP 45M
– Complexity • Windows Server 2003 50M
– Extensibility • Linux kernel 2.6.0 5.2M
– Connectivity • Linux kernel 3.6 15.9M
• The code base could grow (in executable space) even when the
source code base appears to be small
– Consider what happens when you target the .NET or J2EE platforms
• Adopt large base of code underneath your application
[J. Viega & G. McGraw. Building Secure Software, 2002]
7
10/25/2023
Extensibility Connectivity
• Current Software is inherently extensible • Internet is becoming a dangerous place for all organizations and
• An extensible software system accepts updates, extensions that individuals to protect their sensitive data
increment on the functionality of systems – PCs, smartphones, tablets,….
– For example, the plug-in of web browsers makes it easy to install viewer – More and more computers, ranging from home PCs to systems that
extensions for new document types as needed control critical infrastructure, such as data acquisition (SCADA) systems
that run the power grid, are being connected to enterprise networks
– OSs support extensibility through dynamically loadable device drivers and
modules and to the Internet
– People, businesses, and governments are increasingly dependent on
• Hard to prevent software vulnerabilities from slipping in as
network-enabled communication
unwanted extensions
Connectivity Security Methods and Technologies
• An attacker no longer needs physical access to a system to exploit
vulnerable software • What are the methods and technologies to provide security?
– Allows automated attacks, as access through a network does not – Security technologies
require human intervention – Security in the software development lifecycle
• Melissa, ILOVEYOU, Code Red, Sircam, SQL Hammer, Blaster, Sobig,
Mydoom, Sasser, Witty
– Economic risk
• SWIFT net connects 10000+ financial institutions and moves zillions of
dollars daily; targeted attacks at banks
8
10/25/2023
Security Methods and Technologies Security Methods and Technologies
Security Technologies Security Technologies
• Cryptography • These technologies may be provided by the infrastructure/platform
an application builds on
– For threats related to insecure communication and storage
• Access control – Networking infrastructure
– For threats related to misbehaving users • which may e.g. use SSL
– Example: role-based access control
– Operating system or database system
• Language-based security
• Providing e.g. access control
– For threats related to misbehaving programs
– Typing, memory-safety – Programming platform
– Sandboxing • For instance Java or .NET sandboxing
– Example: Java, .NET/C#
• Of course, software in such infrastructures implementing security
has to be secure
Security Methods and Technologies
Security Technologies
• Software/Applications are built on top of "infrastructure"
consisting of
– Operating system
– Programming language/platform/middleware
• Programming language itself
– Interface to CPU & RAM
– Libraries and APIs
• Interface to peripherals (socket, interrupt…)
– Other applications & utilities
• E.g., database
• This infrastructure provides security mechanisms, but is also a
source of insecurity