Secure Software

Engineering
BITS Pilani Dr Sunil Dhore
Pilani Campus
 BITS Pilani
Pilani Campus

Course :
Secure Software Engineering
Lecture No. 5
IMP Note to Self

3
 Disclaimers

❖ The slides presented here are obtained from various authors of books, online

articles, relevant standards, community developed online resources

❖ The content is suitably modified for this sake of conducting this course

❖ Relevant references, citations will be provided wherever applicable

❖ I acknowledge, appreciate and thank all the authors of the content am reusing

4
 Evaluation Scheme
Legend: EC = Evaluation Component
Note - Evaluation components can be tailored depending on the proposed model.

No Name Type Weight Start Date End Date

EC1 Quiz-1 20 questions, MCQ 10%

4/01/2025 06/01/2025

Quiz-2 20 questions, MCQ 10%

8/3/2025 9/3/2025
Assignment Five Questions will be 10%
given

8/2/2025 15/03/2025
EC2 Mid Semester 30%
Test
02/02/2025
EC3 After M5 – 40%
Comprehensive 4/5/2025
Examination
M1: Overview of Secure Software Engineering
• Why Secure Software Engineering ?
• Popular Cyber attacks on Software, Hardware and Cloud
delivered products.
• Core definitions, concepts, examples.
• Differences Product Security versus Security Products

BITS Pilani, Pilani Campus

M2: Product Security Programs

• Establishing a Security Program

• Secure Software Engineering in legacy and
agile SDLC models
• Shift Left versus Shift Right
• Maturity Models - OpenSAMM , BSIMM
• Metrics and Success Criteria

BITS Pilani, Pilani Campus

M3: Product Security Requirements

• Software Requirements - Functional and Nonfunctional

• What are Product Security Baselines ?
• Security Requirements for Applications such as Web and Mobile
• Security Requirements for IOT/Hardware/SCADA Products

BITS Pilani, Pilani Campus

M4: Secure Design & Architecture

• Security Perimeter & Attack Surface

• Risk Assessments
• Threat Modelling
• Security Constructs - Authentication,
Authorization, Encryption, Logging
• Secure By Design & Trustworthiness Principles

BITS Pilani, Pilani Campus

CS5: Secure Design & Architecture

Contact List of Topic Title Text/Ref Book/external

Sessions(#) (from content structure in Course Handout) resource
5 M4: Secure Design & Architecture T2, Chapter 4, 5; R3

● Security Constructs - Authentication,

Authorization, Encryption, Logging
● Secure By Design & Trustworthiness
Principles

Text Book(s)
T1 Secure, Resilient, and Agile Software Development By Mark Merkow · 2019
T2 Core Software Security Security at the Source By James Ransome, Anmol Misra · 2018
T3 Secure and Resilient Software Requirements, Test Cases, and Testing Methods
By Mark S. Merkow, Lakshmikanth Raghavan · 2011
BITS Pilani, Pilani Campus
 BITS Pilani
Pilani Campus

Security Constructs
 BITS Pilani
Pilani Campus

Authentication
What is Authentication ?

• Authentication is the process of verifying the identity of a

user or device.
• This is done to ensure that only authorized users have
access to a system or resource.
• Authentication is typically done through the use of
credentials, such as a username and password, or a
security token.

BITS Pilani, Pilani Campus

Types of Authentication

• Single-factor authentication (SFA):

This is the most basic form of authentication and requires only one piece of
information to verify a user's identity. The most common form of SFA is a username
and password combination.

• Multi-factor authentication (MFA):

This is a more secure form of authentication that requires two or more pieces of
information to verify a user's identity. MFA can be implemented using a variety of
factors, such as:
– Something you know, such as a password or PIN
– Something you have, such as a security token or smartphone
– Something you are, such as a fingerprint or facial recognition

• Passwordless Authentication
• Behavioral Biometrics
• Magic Links
• Possession Factors ( OTP, Mobile App, Push Notifications, Tokens, Hardware)

BITS Pilani, Pilani Campus

Advanced Authentication

• Risk-based authentication uses a set of predetermined

factors to assess the risk of a login attempt, such as the
user's location, device, and time of day.
If the risk is determined to be high, the user may be required to provide additional
authentication factors, such as multi-factor authentication (MFA) or biometrics.

• Adaptive authentication is a more dynamic form of risk-

based authentication that takes into account the user's
behavior and context, as well as the risk of the login
attempt.
For example, a user who is logging in from a known IP address and device may be
able to log in with a username and password, while a user who is logging in from an
unknown IP address or device may be required to provide MFA

BITS Pilani, Pilani Campus

Advanced Authentication

BITS Pilani, Pilani Campus

Federated Identity - SSO

Google Sign In – Open ID Connect

[Link] BITS Pilani, Pilani Campus
Federated Identity

• OpenID Connect (OIDC): OIDC is an open standard that

is based on OAuth 2.0.
• It is a popular choice for SSO because it is well-documented and widely
supported.
• OIDC allows users to authenticate with a single identity provider (IdP) and
access multiple applications without having to re-authenticate for each
application.

• SAML 2.0: SAML 2.0 is another open standard that is

often used for SSO.
• It is a more complex protocol than OIDC, but it offers some additional features,
such as support for single sign-off (SSO).
• SAML 2.0 is a good choice for organizations that need to integrate with a variety
of different applications.

BITS Pilani, Pilani Campus

Federated Identity

• Active Directory, :
• a Microsoft service that allows administrators to manage access to network
resources and permissions. It stores data as objects, such as users, groups,
devices, or applications. AD runs on Windows Server and is a hierarchical, multi-
master enabled database that can store millions of objects

• Kerberos :
• a computer network authentication protocol that uses a key distribution center
(KDC) and symmetric key cryptography to verify user identities. It's a widely used
service that's integrated into many operating systems and software applications.

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Authorization
What is Authorization ?

Authorization is the process of determining what a user

or system is allowed to do once they have been
authenticated.

This is typically done through the use of role-based

access control (RBAC), which assigns different
permissions to different users based on their job role or
function within the organization.

BITS Pilani, Pilani Campus

Type of Authorization

• Role-based access control (RBAC):

This is the most common type of authorization. It assigns different permissions to
different users based on their job role or function within the organization.

• Attribute-based access control (ABAC):

This type of authorization is more flexible than RBAC.
It allows permissions to be assigned to users based on their attributes, such as their
department, location, or security clearance.

• Context-based access control (CBAC):

This type of authorization is the most flexible type of authorization.
It allows permissions to be assigned to users based on the context of the request,
such as the time of day, the source IP address, or the device being used

BITS Pilani, Pilani Campus

Challenges

• Complexity of authorization models: Authorization models, such as role-

based access control (RBAC) and attribute-based access control (ABAC),
can be complex to define and implement. These models often involve a
large number of rules and relationships, which can be difficult to manage
and maintain.
• Evolving business requirements: As businesses evolve and their
requirements change, authorization policies need to be updated
accordingly. This can be a time-consuming and error-prone process,
especially if the authorization system is not well-designed.
• Integration with existing systems: Authorization systems often need to be
integrated with existing systems, such as identity and access management
(IAM) systems and resource management systems. This can be challenging
due to differences in data formats, protocols, and authentication
mechanisms.

BITS Pilani, Pilani Campus

Challenges

• Performance and scalability: Authorization checks need to be

performed efficiently, especially in high-traffic environments.
Authorization systems also need to be scalable to accommodate
increasing numbers of users and resources.
• Security considerations: Authorization systems must be designed
and implemented securely to prevent unauthorized access to
resources. This includes protecting against common attacks, such as
SQL injection and cross-site scripting.

BITS Pilani, Pilani Campus

Challenges

• Context-aware authorization: Authorization decisions may need to

be based on the context of the request, such as the user's location,
device, or time of day. This can add complexity to the authorization
process.
• Granular access control: In some cases, it is necessary to define
very granular access control rules, such as allowing a user to read
but not modify a specific record in a database. This can be difficult
to implement and manage.
• Continuous authorization: Authorization decisions may need to be
made continuously, even after the user has been authenticated.
This can be challenging due to the need for real-time access to user
and resource information.

BITS Pilani, Pilani Campus

Reference Tools

• Cloud Authorization - [Link]

• Authorization as Code
• [Link]
• [Link]
• Others :
• [Link]

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Cryptography – 101
Cryptography

Cryptography is the practice and study

of techniques for secure
communication in the presence of
adversarial behavior.

More generally, cryptography is about

constructing and analyzing protocols
that prevent third parties or the public
from reading private messages. [Link]

BITS Pilani, Pilani Campus

Cryptography Applications

• Security of communications: Cryptography is used to protect the

confidentiality of communications, including email, text messages,
and phone calls.
• Data security: Cryptography is used to protect the confidentiality
and integrity of data stored on computers and other devices.
• Financial transactions: Cryptography is used to protect the
security of financial transactions, such as credit card payments and
online banking.
• Digital signatures: Cryptography can be used to create digital
signatures, which can be used to verify the authenticity of electronic
documents.
• Digital currencies: Cryptography is used to secure digital
currencies, such as Bitcoin and Ethereum.

BITS Pilani, Pilani Campus

Types of Cryptography

• Symmetric cryptography: Symmetric cryptography uses the same

key to encrypt and decrypt data.
• This type of cryptography is relatively fast and efficient, but it
requires both parties to have the same secret key.
• Asymmetric cryptography: Asymmetric cryptography uses two
different keys to encrypt and decrypt data: a public key and a private
key.
• The public key can be shared with anyone, but the private key
must be kept secret.
• Homomorphic encryption is a type of encryption that allows
computations to be performed on encrypted data without first
decrypting it.
• This means that sensitive data can be processed securely in the
cloud or by other third parties, without the need to share the data
itself.
BITS Pilani, Pilani Campus
Symmetric Key Cryptography

Examples : Advanced Encryption Standard (AES), Data Encryption Standard

(DES), Triple DES (3DES), Blowfish, RC4

BITS Pilani, Pilani Campus

Asymmetric Key Cryptography

[Link]

Rivest–Shamir–Adleman (RSA), Digital Signature Algorithm (DSA), Elliptic

Curve Cryptography (ECC), Diffie–Hellman key exchange
BITS Pilani, Pilani Campus
Homomorphic Encryption

[Link]

Paillier cryptosystem, ElGamal cryptosystem, BGV cryptosystem, FHEW

cryptosystem
BITS Pilani, Pilani Campus
Cryptanalysis
Cryptanalysis is the study of cryptographic algorithms and systems in order to
find weaknesses and break them.
Cryptanalysts use a variety of techniques to try to decrypt encrypted data,
including:
• Frequency analysis: This technique involves looking at the frequency of
letters and other characters in the ciphertext to try to identify patterns that
can be used to decrypt the data.
• Known-plaintext attack: This type of attack involves using a known piece
of plaintext and its corresponding ciphertext to try to determine the
encryption key.
• Chosen-ciphertext attack: This type of attack involves choosing a piece of
plaintext and obtaining its corresponding ciphertext in order to try to learn
more about the encryption algorithm or key.
• Side-channel attack: This type of attack involves exploiting weaknesses in
the implementation of a cryptographic algorithm or system to obtain
information about the encryption key or plaintext.

BITS Pilani, Pilani Campus

Common Bugs

Weak key generation: This is a common bug that can occur when a
cryptographic algorithm uses a weak or predictable key. This can
make it easier for attackers to crack the encryption and steal data.
Incorrect implementation of cryptographic algorithms: This can
happen when developers do not fully understand how a
cryptographic algorithm works or when they make mistakes in the
code. This can also make it easier for attackers to crack the
encryption.
Incorrect use of cryptographic libraries: This can happen when
developers do not use cryptographic libraries correctly or when they
use outdated or insecure libraries. This can also make it easier for
attackers to exploit vulnerabilities in the code.

BITS Pilani, Pilani Campus

Common Bugs

Buffer overflows: This is a common programming error that can

occur when a program writes more data to a buffer than the
buffer can hold. This can overwrite other data in memory,
including cryptographic keys and other sensitive information.
Race conditions: This is a programming error that can occur
when two threads or processes try to access the same data at
the same time. This can lead to data corruption, including
cryptographic keys and other sensitive information.

BITS Pilani, Pilani Campus

Popular Vulnerabilities

Heartbleed: In 2014, a bug was discovered in the OpenSSL

cryptography library that could be exploited to steal sensitive data,
such as passwords and credit card numbers, from servers. The bug
affected millions of servers around the world, and it took months to
patch.
Freak: In 2015, a bug was discovered in the way that TLS (Transport
Layer Security) encrypts data. The bug could be exploited to force
TLS to use weaker encryption algorithms, which could then be
broken by attackers. The bug affected millions of websites and
servers around the world.

BITS Pilani, Pilani Campus

Popular Vulnerabilities

Logjam: In 2015, a bug was discovered in the way that Diffie-Hellman

key exchange is implemented in many cryptographic libraries. The
bug could be exploited to reduce the key size used by Diffie-
Hellman, making it easier for attackers to break the encryption. The
bug affected millions of servers and devices around the world.
DROWN: In 2016, a bug was discovered in the way that TLS encrypts
data. The bug could be exploited to force TLS to use SSL (Secure
Sockets Layer) 3.0, which is a deprecated and insecure encryption
protocol. The bug affected millions of websites and servers around
the world.
Poodle: In 2014, a bug was discovered in the way that TLS encrypts
data. The bug could be exploited to reduce the key size used by
TLS, making it easier for attackers to break the encryption. The bug
affected millions of websites and servers around the world.

BITS Pilani, Pilani Campus

More Vulnerabilities

• OpenSSL "goto fail" bug: In 2014, a bug was discovered in the

OpenSSL cryptography library that could be exploited to crash
servers. The bug was caused by a misuse of the goto statement.
• TLS "downgrade attack": This attack exploits the way that TLS
clients and servers negotiate encryption protocols. The attacker can
trick the client into using a weaker encryption protocol, which can
then be broken to steal data.
• "BREACH" attack: This attack exploits a vulnerability in the way
that HTTP compression works. The attacker can inject malicious
code into a compressed HTTP response, which can then be
executed by the victim's browser.
• "CRIME" attack: This attack exploits a vulnerability in the way that
TLS handles padding. The attacker can inject malicious code into a
TLS packet, which can then be executed by the victim's browser.

BITS Pilani, Pilani Campus

Folklore

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Logging
Logging

• Logging in cybersecurity is the process of recording events

that occur within an IT network.

• Log files are a crucial part of cybersecurity because they:

• Provide a digital fingerprint of intrusion attempts
• Help identify patterns of activity on networks
• Provide information about the source and extent of a compromise
• Help detect and respond to security incidents in real-time
• Help identify potential vulnerabilities
• Ensure compliance with regulatory requirements

[Link]

BITS Pilani, Pilani Campus

 Logging

• Log files contain information such as:

• IP address of the system
• Network address
• Computer name
• Login data, including username, date and time of login, and current login status
• Time and date of the event
• Device or application where the event originated
• User associated with the activity
• Action the user or process performed
• Whether the action was successful or failed
• Network address and protocol
• Location when possible

BITS Pilani, Pilani Campus

Logging

• Some best practices for logging in cybersecurity include:

• Monitoring devices as part of an organization's wider approach to logging and
monitoring
• Collecting information on the state of devices, their compliance with
established policy, and device events
• Monitoring activity related to user accounts and user access
• Performing regular network security audits

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Secure By Design & Trustworthiness Principles

[Link]
 Secure By Design
Some principles for secure design include:
• Least privilege :This principle ensures that users only have the access they need
to do their job.
• Defense in depth :This principle involves implementing multiple layers of security
to create a resilient environment that can detect and respond to security incidents.
• Separation of duties :This principle aims to prevent conflict of interest, fraud,
abuse, and errors.
• Minimize attack surface :This principle aims to reduce the overall risk to an
application by reducing its attack surface area.
• Fail securely :This principle states that applications should fail in a secure way, and
that failure should not give the user additional privileges.
• Principle of open design :This principle suggests that the security of a system
should not depend on keeping its internal workings secret.
• Complete mediation :This principle states that every access to every object must
be checked for authority.
• Principle of fail-safe defaults :This principle involves configuring security settings
to prevent unauthorized access or use of resources.
BITS Pilani, Pilani Campus
 Secure By Design

Other principles of SbD include:

• Ubiquitous encryption
• Automated system-specific security controls
• Standardization of security design specifications
• Operationalized use-case specific security processes
• Security ownership
• Continuous and real-time auditing

BITS Pilani, Pilani Campus

 Trustworthiness Principles
• Trustworthiness principles in security are a set of guidelines that help ensure that a system is
reliable and can be trusted to protect digital assets:
• Self-reliance : A system should be trustworthy on its own, with minimal reliance on other
systems. This makes the system less vulnerable to attack if it's isolated.
• Substantiated trust :Trustworthiness should be based on measurable, observable, and
testable criteria. No component should be implicitly trusted without a substantiated
evaluation.
• Trustworthy system control :Generalized validation mechanisms, such as reference
monitors, should be designed to accurately determine the trustworthiness of the system.
• Authentic and reliable sources :Ensure that the source and methods used to obtain
cybersecurity systems and antivirus software are authentic and reliable.
• Regular updates :Software should be regularly updated to address new threats and
challenges.
• Trustworthy vendors :Use vendors who regularly update their security suites to target new
threats.
• Classification levels :Use a simple classification system with categories like "public,"
"internal," "sensitive," "proprietary," "highly confidential," and "restricted".
Trustworthiness is a measure of how worthy a system is to be trusted to meet critical requirements,
such as security, reliability, and resource availability.
BITS Pilani, Pilani Campus
IMP Note to Self

49
 BITS Pilani
Pilani | Dubai | Goa | Hyderabad

Thank You !!