CISSP Domain 8

Domain 8 Application Security

A. Software Development Models:
Waterfall
Spiral (four quadrants: requirements, objective, planning, risk analysis)

B. Maintenance phase: request control, change control, and release control. C. Configuration Management: British Standards Institute 7799: tracking and issue of new versions 1. A configuration item is a component whose state is to be recorded and against which changes are to be progressed 2. Configuration control controls changes to the configuration items and issues versions of the items from the software library 3. Two goals: (1) ensuring changes to system do not effect security (2) ensuring changes to system are reflected in documentation D. Software cycle: 1. Verification: evaluate product in development against the specification. 2. Validation: Evaluate against real-world requirements and concepts. E. Software Capability Maturity Model (CMM): Quality software is a function of the quality of its associated software development and maintenance process — level 3 requires ISO 9001 F. Software Development Life Cycle: Initiaion Acquisition/Development Implementation Operation/Maintenance Disposition G. Database: manage information from many different sources, a view is an access control mechanism used in databases to ensure that only authorized subjects can access sensitive information. H. Database Management System (DBMS): manages large structured sets of data, provides multiple users access, security, and controls, enforces the integrity of the data, provides for fault tolerance 1. Models a. Hierarchical - database uses a tree-like structure to define relationships between data elements, using a parent/child relationship.
b. Network - flexible way of representing objects and their relationships. Its distinguishing feature is that the schema, viewed as a graph in which object types are nodes and relationship types are arcs, is not restricted to being a hierarchy or lattice.

c. Relational Database Models
(i) The purpose of the relational model is to provide a declarative method for specifying data and queries: we directly state what information the database contains and what information we want from it, and let the database management system software take care of describing data structures for storing the data and retrieval procedures for getting queries answered. (ii) Fundamental entity is the relation (table or set of columns in table) (iii) A relational database uses two-dimensional tables with rows (tuples) and columns (attributes).

With “attributes” (columns), having permissible values, specific attribute is “key” with unique values, occurring in “instances” or tuples (iv) Cardinality = No rows in table (Tuple) Degree = No of columns in table (v) Security is provided through views (vi) Primary key is unique identifier in table that points to tuples; subset of candidate keys (vii) Candidate key is an attribute that is a unique identifier within a given table
(viii) If attribute in one relation has values that match primary key in another relation, this attribute is called a foreign key (ix) Primary key is chosen from set of candidate keys
(x) Description of the database is called a schema, which is defined by the Data Description Language (DDL), a Data Manipulation Language (DML), a Query Language (QL), and a report generator.

(xi) A domain of a relation is the set of allowable values that an attribute can take on 2. Object-Oriented Data Base (OODB) in which information is represented in the form of objects as used in object-oriented programming. Advantages An integrated repository of information that is shared by multiple users, products, applications, platforms. It also solves the following problems: The semantic gap: The real world and the Conceptual model is very similar. Impedance mismatch: Programming languages and database systems must be interfaced to solve application problems. But the language style, data structures, of a programming language (such as C) and the DBMS (such as Oracle) are different. The OODB supports general purpose programming in the OODB framework. New application requirements: object-orientation is the most natural and most convenient.
3. Hybrid Model also called the Object-Relational DB 4. Integrity a. Entity integrity — primary key is unique and no null keys b. Referential integrity — foreign key is a primary key in another table and no null foreign keys

I. Object Oriented Systems: more reliable and capable of reducing propagation of change errors — Dynamic objects are created during program execution 1. Objects are encapsulated – only access through messages sent to them to request performance of their desired operations 2. Substitution property: objects with compatible operations can be substituted for each other 3. Message is a communication to an object 4. Behavior is the results exhibited by an object on receipt of a message 5. Class is collection of common objects 6. Method is the code that defines the actions an object performs in response to a message 7. Inheritance – methods from a class are inherited by members of its subclasses 8. Delegation is forwarding a request from one object to another 9. Polymorphism is objects of many different classes that are related by some common superclass; thus any object denoted by this name is able to respond to some common set of operations in a different way
10. Polyinstantiation is development of a new version of an object from another object replacing variables with other values
a. It tallow same version of information to exist at diferent classification level b. User at lower classification level will not aware of data that exists at a highier classification level. c. Prevents inference violations

J. Jargon 1. Open Database Connectivity (ODBC) - provides a standard software interface for accessing database management systems (DBMS). The designers of ODBC aimed to make it independent of programming languages, database systems, and operating systems. Thus, any application can use ODBC to query data from a database, regardless of the platform it is on or DBMS it uses. This is accomplished by using an ODBC driver as a translation layer between the application and the DBMS. The application thus only needs to know ODBC syntax, and the driver can then pass the query to the DBMS in its native format, returning the data in a format the application can understand. 2. Object Link and Embedding DB (OLE DB) - is an API designed by Microsoft for accessing data from a variety of sources in a uniform manner. It is a set of interfaces implemented using the Component Object Model (COM); it is otherwise unrelated to OLE. It was designed as a higher-level replacement for, and successor to, ODBC, extending its feature set to support a wider variety of non-relational databases, such as object databases and spreadsheets that do not necessarily implement SQL. 3. Active-X Data Objects (ADO) - is a set of Component Object Model (COM) objects for accessing data sources. A part of MDAC, it provideyer between programming languages and OLE DB (a means of accessing data stores, whether they be databases or otherwise, in a uniform manner). ADO allows a developer to write programs that access data without knowing how the database is implemented. You must be aware of your database for connection only. No knowledge of SQL is required to access a database when using ADO, although one can use ADO to execute SQL commands. The disadvantage of this (i.e. using SQL directly) is that it introduces a dependency upon the type of database used. 4. Java Database Connectivity (JDBC) - is an API for the Java programming language that defines how a client may access a database. It provides methods for querying and updating data in a database. JDBC is oriented towards relational databases. A JDBC-to-ODBC bridge enables connections to any ODBC-accessible data source in the JVM host environment. 5. Distributed Component Object Model (DCOM) - is a proprietary Microsoft technology for communication among software components distributed across networked computers. DCOM, which originally was called

"Network OLE", extends Microsoft's COM, and provides the communication substrate under Microsoft's COM+ application server infrastructure. It has been deprecated in favor of the Microsoft .NET Framework. 6. Standard Query Language (SQL) - ANSI standard, root language for interaction with data, database design or schema K. Object Request Brokers (ORBs) — is a piece of middleware software that allows programmers to make program calls from one computer to another via a network. ORBs promote interoperability of distributed object systems because they enable users to build systems by piecing together objects from different vendors, so that they communicate with each other via the ORB. L. Common Object Request Broker Architecture (CORBA) defines standard that enables programs written in different languages and using different platforms and operating systems to interface and communicate. M. Artificial Intelligence (AI): 1. Expert Systems: acts like a human expert — Builds knowledge base (in the form of If-Then statements) of the domain to be addressed in the form of rules and an inference mechanism to determine if the rules have been satisfied by system input — Inference engine + knowledge base = expert system — Fuzzy logic used to address uncertainty. 2. Neural Networks: Neurons, signals are exchanged among neurons through electrical pulses traveling along an axon — Electrical pulse arrives at a neuron at points called synapses — Output = Input1*Weight1 + Input2*Weight2 — Summation of inputs with dynamic weights assigned to them — One summing node is called a single-layer network — Multiple summing nodes is a multi-layer network — Training develops the weights N. Database Security Issues 1. Granularity of the access to objects in DB refers to fineness with which access can be controlled or limited 2. Aggregation is act of obtaining info of a higher sensitivity and combining it with lower levels of sensitivity 3. Inference is ability of users to infer or deduce info about data at sensitivity levels for which they do not have access — A link that enables an inference to occur is called an inference channel O. DBMS Controls 1. Atomicity — either all changes take effect or none 2. Consistency — a transaction is allowed only if it follows owner or system-defined integrity constraints 3. Isolation — the results of a transaction are not visible until the transaction is complete 4. Durability — the results of a complete transaction are permanent 5.Concurrency controls — ensure that two users cannot simultaneously change the same data 6. Knowledge Discovery in Databases (KDD) — a method of identifying valid and useful patterns in data a. Probabilistic approach interdependencies — based on probability and data
b. Statistical approach — based on data relationships

c. Classification approach — based on grouping data according to similarities d. Deviation and Trend Analysis — uses filtering techniques to detect patterns e. Neural Networks — organizes data into nodes that are arranged in layers — links between nodes have specific weighting classifications f. Expert system approach — uses knowledge base and algorithms and/or rules that infer new facts from knowledge and incoming data g. Hybrid approach — combines two or more approaches P. Data Warehouse and mining: 1. Data warehouse is a repository of info from heterogeneous databases 2. Objective is to find relationships that were unknown up until now among data in warehouse — called data mining 3. Correlations or data about data is called metadata — Metadata not stored in data warehouse, instead stored in a highly protected “data mart.” 4. Data warehouse and mining can be applied to audit logs and other info to find system anomalies Q. Data Dictionary: database for developers, records all the data structures used in an application R. Accreditation: Formal acceptance of security adequacy, authorization for operation and acceptance of existing risk S. Certification: Formal testing of security safeguards T. Operational assurance: verification system is operating to its security requirements — Look at policies, audits, and system monitoring U. Distributed environments permit agents — Agents are surrogate programs or process performing services in one environment on behalf of a principal in another environment — Not a proxy, which hides identity V. Distributed systems should include: 1. Interoperability 2. Portability — Software at source code level can be moved from system to system with different vendors 3. Transparency — Ability to keep application and its processes invisible to the end user 4. Extensibility — System must be able to adapt to various management policies and allow introduction of new resources to manage W. Single state machines can only process one security level at a time Multi-State Machines can process two or more security levels at the same time X. Interpreted language executes each instruction in real-time, called run-time binding Compiled language, binding occurs at compile time Compiled code poses greater security risk since it may contain destructive code that can’t easily be detected Y. Applets in Web browsers called mobile code — Java runs in constrained memory space (sandbox) for security

Z. Security measures: configure firewalls to screen applets; configure browsers to restrict or prevent downloading applets; permit applets only from trusted parties, provide training to users re mobile code
Application & Database Security Key Notes
? Database Integrity is provided by concurrency mechanisms. One concurrency control is locking, which prevents users from accessing and modifying data being used by someone else. Entity Integrity makes sure that a row, or tuple, is uniquely identified by a primary key Referential Integrity ensures that every foreign key refers to an existing primary key. Rollback cancels changes and returns the database to its previous state. This takes place if there is a problem during a transaction. Commit Statement terminates a transaction and saves all changes to the database. Checkpoint is used if there is a system failure or problem during a transaction. The user is then returned to the state of the last checkpoint. Aggregation can happen if a user does not have access to a group of elements, but has access to some of the individual elements within the group. Aggregation happens if the user combines the information of these individual elements and figures out the information of the group of data elements, which is at a higher sensitivity level. Inference is the capability to derive information that is not explicitly available. Common attempts to prevent inference attacks are partitioning the database, cell suppression, and adding noise to the database. Security should be addressed in each phase of system development. Risk Management and assessments should start at the beginning of a project and continue throughout the lifetime of the product. Separation of duties should be practiced in roles, environments, and functionality pertaining to the development of a product.
? ? ? ? ? ?
?
? ? ? ? ?

? ?
Change Control needs to be put in place at the beginning of a project and must be enforced through each phase. Changes must be authorized, tested, and recorded. The changes must not affect the security level of the system or its capability to enforce the security policy. Iterative development is a software development method that follows a cyclic approach to software development.
?
?
Prototypes, and Simulations at different phases of the development cycle periodically revisits previous stages to update and verify design requirements. Security Testing is a comprehensive analysis technique that tests programs under artificially created attack scenarios. High-Level Programming Languages are translated languages for the system and its processor to understand. into machine
? ?

?
Source Code is translated into machine code, or object code, by compilers, assemblers, and interpreters.
?
Assemblers use the basic building blocks of the command processor code to write programs and is the language closest to the binary on which all computers operate, although it is difficult to use it does work well for things like networking and communication protocols.
?
Interpreters are just what they say, they translate the code in real time as you operate the program, then process it, and are therefore the slowest.
?
Compilers translate the code into a format the computer understands prior to the execution (or distribution) of the code and is therefore the easiest to use as it combines the better attributes of both programming methods into one easy to use package.

? ? ? ? ? ? ? ?
Object-Oriented Programming provides modularity, reusability, and more granular control within the programs themselves. Objects are member or instances, of classes. The classes dictate the objects’ data types, structure, and acceptable actions. Objects communicate with each other through messages. A method is functionality that an object can carry out. Data Hiding. Each object encapsulates its data and processes. Objects can communicate properly because they use standard interfaces. Low Coupling if an object does not require much interaction with other modules. The best programming design enables objects to be as independent and modular as possible; therefore, the higher the cohesion and the lower the coupling, the better. Dynamic Data Exchange (DDE) enables applications to work in a client/server model by providing the interprocess communication (IPC) mechanism.
?
?
Distributed Computing Environment (DCE) provides much of the same functionality as DCOM, which enables different objects to communicate in a networked environment.

?
Java Security employs a Sandbox so the applet is restricted from accessing the user’s hard drive or system resources. Programmers have figured out how to write applets that escape the sandbox.
?
ActiveX uses a security scheme that includes digital signatures. The browser security settings determine how ActiveX controls are dealt with.

?
SOAP allows programs created with different programming languages and running on different operating systems to interact without compatibility issues.
?
Software Configuration Managment (SCM) process of controlling software by managing the versions of all components and the relation between them.
System Engineering Vs Systems Security Engineering
?

?
Application Control
? Secure Development : Physcial Protect Source Code I. II. III. IV. ? Tampering Pirating Accidental Loss Protect against attack
Secure Development : Personnel Securirty I. II. III. Hiring Controls Change In Employment Privacy Impact By Employee
?
Seperation of Test Data from Production I. II. Never use on a production system Never use real data
Application Threat
Threats / Attacks Buffer overflow; cross-site scripting; SQL injection; Input Validation canonicalization Network eavesdropping ; Brute force attack; dictionary attacks; Authentication cookie replay; credential theft Elevation of privilege; disclosure of confidential data; data Authorization tampering; luring attacks Unauthorized access to administration interfaces; unauthorized Configuration access to configuration stores; retrieval of clear text configuration management data; lack of individual accountability; over-privileged process and service accounts Sensitive Access sensitive data in storage; network eavesdropping; data information tampering Session Session hijacking; session replay; man in the middle management Poor key generation or key management; weak or custom Cryptography encryption Parameter Query string manipulation; form field manipulation; cookie manipulation manipulation; HTTP header manipulation Exception Information disclosure; denial of service management Auditing and User denies performing an operation; attacker exploits an logging application without trace; attacker covers his or her tracks
Category

? ? ? ? ? ? ? ? ? ? ?
A virus is an application that requires a host application for replication. Macro viruses are common because the languages used to develop macros are easy to use and they infect Office products, which are everywhere. A boot sector virus overwrites data in the boot sector and can contain the rest of the virus in a sector it marks as “bad.” A stealth virus hides its tracks and its actions. A polymorphic virus tries to escape detection by making copies of itself and modifying the code and attributes of those copies. Multipart viruses can have one part of the virus in the boot sector and another part of the virus on the hard drive. A self-garbling virus tries to escape detection by changing, or garbling, its own code. A worm does not require a host application to replicate. A logic bomb executes a program when a predefined event takes place, or a date and time are met. A Trojan horse is a program that performs useful functionality and malicious functionally without the user knowing it. Smurf and Fraggle are two examples of DoS attacks that take advantage of protocol flaws and use amplifying networks.
?
Secure Coding Issues
Buffer Overflow SQL Injection Cross-Site Scripting XSS Dangling Pointer Invalid Hyperlink Secure Web Applications Javascript Attacks Vs Sandbox Application Programming Inteface (API) Open Source
?
Application Security Principles
Validate all input and output = only valid allow Failed Secured (Closed) = should anything fail close all Fail Safe = no single point of failure Make it simple = password write down cause too complex Defense In Depth = if system A fai lto catch B will Only as secure as your weakest link attackers attempt to find
?
Malware and Attacktype
Injection Flaws = user data send to interpreter as part of command attacker can access and modify data > SQL Injection Input Manipulation / Malicious File Execution = code is vulnerable