Title: Secure Software Development
Course: IN 2001 Principle of Information Assurance > Section: Module 2: Chapter Two

Secure Software Development

Many of the information security issues discussed in this chapter have their root cause in the software elements of the system.

Many organizations recognize the need to include planning for security objectives in the SDLC they use to create a system and they have put in place procedures to create software that is more able to be deployed in a secure fashion.  This approach to software development is known as software assurance or SA.

Software Assurance and the SA Common Body of Knowledge

A national effort is underway to create a common body of knowledge focused on secure software development.

The US Department of Defense (DoD) launched a Software Assurance Initiative in 2003.  This initial process was endorsed and supported by the Department of Homeland Security (DHS), which joined the program in 2004.  This program initiative resulted in the publication of the Secure Software Assurance (SwA) Common Body of Knowledge (CBK).

The SwA CBK was developed and published to serve as a guideline.  While this work has not yet been adopted as a standard or even a policy requirement of government agencies, it serves as a strongly recommended guide to developing more secure applications.

The findings thus far of this work-in-progress are quite diverse and include: Nature of Dangers, Fundamental Concepts and Principles, Ethics, Law and Governance, Secure Software Requirements, Secure Software Design, Secure Software Construction, Secure Software Verification, Validation and Evaluation, Secure Software Tools and Methods, Secure Software Processes, Secure Software Project Management, Acquisition of Secure Software and Secure Software Sustainment.

Software Design Principles

Good software development should result in a finished product that meets all of its design specifications. The information security considerations in those specification are now considered a critical factor, which has not always been true.

Following are some now commonplace security principles:

- Economy of mechanism: Keep the design as simple and small as possible.
- Fail-safe defaults: Base access decisions on permission rather than exclusion.
- Complete mediation: Every access to every object must be checked for authority.
- Open design: The design should not be secret, but rather depend on the possession of keys or passwords.
- Separation of privilege: Where feasible, a protection mechanism should require two keys to unlock, rather than one.
- Least privilege: Every program and every user of the system should operate using the least set of privileges necessary to complete the job.
- Least common mechanism: Minimize mechanisms (or shared variables) common to more than one user and depended on by all users.
- Psychological acceptability: It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly.

Software Development Security Problems

1. Some software development problems result in software that is difficult or impossible to deploy in a secure fashion.  There are 19 problem areas or categories in software development (which is also called software engineering).
2. Buffers are used when there is a mismatch in the processing rates between two entities involved in a communication process.  A buffer overrun (or buffer overflow) is an application error that occurs when more data is sent to a program buffer than it is designed to handle. During a buffer overrun, an attacker can make the target system execute instructions or the attacker can take advantage of some other unintended consequence of the failure.
3. Command injection problems occur when user input is passed directly to a compiler or interpreter.  The underlying issue is the developer’s failure to ensure that command input is validated before it is used in the program.
4. Cross-site scripting (or XSS) occurs when an application running on a Web server gathers data from a user in order to steal it.  An attacker can use weaknesses of the Web server environment to insert commands into a user’s browser session so that users ostensibly connected to a friendly Web server are, in fact, sending information to a hostile server.
5. Failure to handle errors can cause a variety of unexpected system behaviors.  Programmers are expected to anticipate problems and prepare their application code to handle them.
6. With the growing popularity of wireless networking comes a corresponding increase in the risk that wirelessly transmitted data will be intercepted.  Most wireless networks are installed and operated with little or no protection for the information that is broadcast between the client and the network wireless access point.  Without appropriate encryption (such as that afforded by WPA), attackers can intercept and view your data.  Traffic on a wired network is also vulnerable to interception in some situations.
7. Programmers are responsible for integrating access controls into, and keeping secret information out of, programs.  Access controls regulate who, what, when, where and how individuals and systems interact with data.
8. Failure to properly implement sufficiently strong access controls makes the data vulnerable, while overly strict access controls hinder business users in the performance of their duties.  The integration of secret information—such as the “hard coding” of passwords, encryption keys or other sensitive information—can put that information at risk of disclosure.
9. Many computer systems use random number generators.  These “random” number generators use a mathematical algorithm, based on a seed value and another system component (such as the computer clock) to simulate a random number.  Those who understand the workings of such a “random” number generator can predict particular values at particular times.
10. Computer languages are often equipped with built-in capabilities to reformat data while they’re outputting it.  The formatting instructions are usually written as a “format string.”  An attacker may embed characters meaningful as formatting directives into malicious input.  If this input is then interpreted by the program as formatting directives, the attacker may be able to access information or overwrite very targeted portions of the program’s stack with data of the attacker’s choosing.
11. Developers use a process known as change control to ensure that the working system delivered to users represents the intent of the developers.  Change control processes ensure that developers do not work at cross purposes by altering the same programs or parts of programs at the same time.  They also ensure that only authorized changes are introduced and that all changes are adequately tested before being released.
12. If attackers change the expected location of a file, by intercepting and modifying a program code call, they can force a program to use their own files rather than the files the program is supposed to use.  The potential for damage or disclosure is extreme, so it is critical to protect the location of the files, as well as the method and communications channels by which these files are accessed.
13. Programmers use Secure Socket Layer (SSL) to transfer sensitive data such as credit card numbers and other personal information between a client and server.  SSL and its successor, Transport Layer Security (TLS), both need certificate validation to be truly secure. Failure to use secure HTTP, to validate the Certificate Authority and then validate the certificate itself or to validate the information against a Certificate Revocation list (CRL), can compromise the security of SSL traffic.
14. One of the most common methods of obtaining inside and classified information is directly or indirectly from an individual, usually an employee.  By warning employees against disclosing information, organizations can protect the secrecy of their operation.
15. Integer bugs (Overflows/Underflows).  Although paper-and-pencil can deal with arbitrary numbers of digits, the binary representations used by computers are of a particular fixed length.  “Integer bugs fall into four broad classes: overflows, underflows, truncations, and signedness errors. Integer bugs are usually exploited indirectly—that is, triggering an integer bug enables an attacker to corrupt other areas of memory, gaining control of an application.”
16. A race condition is the failure of a program that occurs when an unexpected ordering of events in the execution of the program results in a conflict over access to the same system resource.
17. SQL injection occurs when developers fail to properly validate user input before using it to query a relational database.  The possible effects of the ability to “inject” SQL of the attacker’s choosing into the program are not just limited to improper access to information, but could potentially allow an attacker to drop tables or even shut down the database.
18. Trusting network address resolution.

- The Domain Name Service (DNS) is a function of the World Wide Web that converts a URL into the IP address of the Web server host.
- DNS cache poisoning involves compromising a DNS server and then changing the valid IP address associated with a domain name to one which the attacker chooses, usually a fake Web site designed to obtain personal information or one that accrues some sort of benefit to the attacker—for example, redirecting shoppers from a competitor’s Web site.
- Most DNS attacks are made against organizational primary and secondary domain name servers, local to the organization and part of the distributed DNS system.  Other attacks attempt to compromise the DNS servers further up the DNS distribution mode—those of Internet Service Providers or backbone connectivity providers.
- The DNS system relies on a process of automated updates that can be exploited.  Attackers most commonly compromise segments of the DNS by either attacking the name of the name server and substituting their own DNS primary name server or by responding before an actual DNS can.

1. One of the biggest challenges in private key systems, which involve two users sharing the same key, is the need to get the key to the other party securely.  An attacker can physically intercept a key in transit or intercept it digitally. Interception online can be accomplished by writing a variant of a public key system and placing it out as “freeware” or by corrupting or intercepting the function of someone else’s public key encryption system, perhaps by posing as a public key repository.
2. Use of Magic URLs and Hidden Forms

- Because HTTP is a stateless protocol and computer programs on either end of the communication channel cannot rely on guaranteed delivery of any message, it is difficult for software developers to track a user’s exchanges with a Web site over multiple interactions.
- Too often, sensitive state information is simply included in a “magic” URL (e.g., the authentication ID is passed as a parameter in the URL for the exchanges that will follow) or included in hidden form fields on the HTML page.
- If this information is stored as plain text, an attacker can harvest the information from a magic URL as it travels across the network or use scripts on the client to modify information in hidden form fields.

1. Failure to require sufficient password strength and to control incorrect password entry is another severe security issue.  Password policy can specify the number and type of characters, frequency of mandatory changes and reusability of old passwords.  The number of incorrect entries that can be submitted by a user can also be regulated to further improve the level of protection.  The strength of a password directly impacts its ability to withstand a brute force attack. Using nonstandard password components (like the 8.3 rule—at least eight characters, with at least one letter, number and nonalphanumeric character) can greatly enhance the strength of the password.
2. Employees prefer doing things the easy way, regardless of whether the easy way is the “official way” or an “unofficial way.”  The only way to address this issue is to only provide one way—the secure way. Integrating security and usability, adding training and awareness, and ensuring solid controls all contribute to the security of information. Allowing users to default to easier, more usable solutions, will inevitably lead to loss.