Application Security: Chapter 1 - Secure SDLC

8 / 31

SDLC Phases(1)

Requirements gathering and analysis

In this phase, we gather business requirements through Meetings with

project managers, stake holders and users.

Some questions to ask: Who is going to use the system? How will

they use it(Functions/services)? What data should be input/output

into the system?

Theses requirements are analyzed for their validity and feasability.

A Requirement Specification document is created to serve for the next

phase of SDLC.

Design

In this phase, a software design is extracted from the requirement

specifications.

Software Design helps defining overall system architecture.

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

9 / 31

SDLC Phases(2)

Implementation/Coding

Once software design documents ready, modules/units/teams are created and

coding phase is started.

The main focus of this longest phase is for the developer.

Testing

Once the coding phase is finished, the code is tested against the requirements

(Conformance test).

During this phase, we can use all types of functional testing like unit testing,

integration testing, system testing, acceptance testing and also non-functional

testing.

Deployement/Maintenance

Once testing phase successful, the Beta version of the product is delivered for use.

If any changes are required or any bugs are caught, a report is given to the

engineering team to fix them.

When the customers start using the final version of the product, some problems

arise and need to be solved from time to time (maintenance)

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

10 / 31

S-SDLC (Secure SDLC)

Software security flaws can be introduced at any stage of SDLC,

including: Not identifying security requirements up front, Creating conceptual

designs that have logic errors, using poor coding practices that introduce technical

vulnerabilities,Deploying the software improperly, Introducing flaws during

maintenance or updating.

A Secure SDLC process introduces security practices as early in the Software

Development Life Cycle (SDLC) as possible. S-SDLC ensures that security

assurance activities such as penetration testing, code review, and architecture

analysis are an integral part of the development effort.

SSDLC starts by integrating Security Requirements in the First Planing phase.

Source: www.blackducksoftware.com

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

11 / 31

Security requirements

Application Security requirements is the foundation of secure development.

The company may engage experienced security professional for performing

a software security requirements analysis:

Conducting interviews with stakeholders (questionnaire/checklist) to

understand their business or functional needs but also to map software

security requirements (including privacy and intellectual property

protection).

Identifying applicable policies and standards to functional specifications

Mapping laws, standards and regulations. For example, if a software

uses or manages european Personal Data, it should follow

requirements of GDPR(General Data Protection Regulation)

Conducting initial risk assessment

Developing a Data classification and confidentiality, integrity and

availability (CIA) matrix that help to define the basis of security

controls

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

12 / 31

Security requirements

OWASP(Open Web Application Security Projects) is a free and open

software security community.

OWASP ASVS (Application Security Verification Standard) is a

community-effort to establish a framework of security requirements and

controls that focus on normalising the functional and non-functional

security controls required when designing, developing and testing modern

web applications.

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

13 / 31

Figure: Source: www.OWASP.org

Secure Architecture&Design

Software Architecture flaws can be discovered and fixed in the design

(Weak Secret management, Authentication and Authorization missing in

entry points...). To evaluate Architecture security, one commonly uses

"Threat Modelling".

"Threat modeling is a process by which potential threats, such as

structural vulnerabilities, can be identified, enumerated, and prioritized – all

from a hypothetical attacker’s point of view. Wikipedia".

Threat modelling is based on Data/Control flow diagrams. We should

identify:

Components (Servers, Databases, Client Browser, Login Process,

reporting services, web services...)

components interactions (HTTP,FTP,REST/HTTP over

TLS,SMTP...)

Data assets (Public, confidential, critical) the components manage

Threat actors (Optional)

Existing Security Controls

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

14 / 31

Secure Architecture&Design

There are various ways and methodologies of going threat models (PASTA,

TRIKE,VAST), one of which is a process proposed by Microsoft, called

STRIDE.

Figure: Source: ResearchGate (T.McDonald)

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

15 / 31

Microsoft STRIDE Threat Model

Spoofing refers to the act of posing as someone else (i.e. spoofing a

user) or claiming a false identity (i.e. spoofing a process). For

example, can an API Key of web service predictible?

Tampering refers to malicious modification of data (at rest/in

transit) or processes.For example, can the user inject a custom

malicious request to a service?

Repudiation refers to the ability of denying that an action or an event

has occurred. For examples, A user denies deleting all records from a

database.

Information Disclosure refers to data leaks or data breaches. This

could occur on data in transit, data at rest, or even to a process. For

example, a user is able to eavesdrop, sniff, or read traffic in clear-text.

Denial of Service refers to causing a service or a network resource to

be unavailable to its intended users.

Elevation of Privileges refers to gaining access that one should not

have. For example, a user takes advantage of a Buffer Overflow to

gain root-level privileges on a system

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

16 / 31

Microsoft Threat Modelling Tool (TMT)

Create Model-Designing the application architecture

(Process,storage,flow,boundaries...)

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

17 / 31

Microsoft Threat Modelling Tool (TMT)

Analyse and Manage Threats

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

18 / 31

Microsoft Threat Modelling Tool (TMT)

Threat Mitigation

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

19 / 31

Secure Coding

Secure coding is the practice of developping applications in a way that

protects introduction of security vulnerabilities....Most vulnerabilities

stem from a relatively small number of common software programming

errors[McGraw, Building secure software].

Developers should be trained on secure coding. Taking such proactive

steps help significantly reduce or even eliminate vulnerabilities before

deployment phase.

It is recommanded to establish secure coding policy to maintaining

consistency across organisation and helps in scaling of usage of standards

for web development projects.

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

20 / 31

OWASP TOP 10 Project

WASP...

OWASP TOP 10 Project

is the de facto application

security standard. The goal

is to raise awareness amongst

developers

and managers.

Since 2003, OWASP publish

at regular intervals, The Ten

Most Critical Web Applica-

tion Security Risks.

Source:https://www.owasp.org/images/

7/72/OWASP_Top_10-

2017.pdf

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

21 / 31

OWASP SCP (Secure Coding Practices)

a

OWASP SCP is

guide

that focuses on the technical

security

controls

specific

to mitigating the occurrence

of common software vul-

nerabilities in any software

deployment platform.

validate all

For example, we can find in

SCP checklist:

in-

put against a "white" list of allowed

characters, whenever possible, San-

itizeall output of un-trusted data

to operating system commands, If

your application manages a creden-

tial store,

it should ensure that

only cryptographically strongone-

way salted hashes of passwords...

Source:https://www.owasp.org/index.php/

OWASP_Secure_Coding_Practices_Checklist

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

22 / 31

Security Testing

Security testing aims to identify potential vulnerabilities that could be

exploited by hackers for malicious causes. There are some types of

complementary security testing:

Secure Code Review(Manual SAST)

SAST(Static Application Security Testing)

DAST(Dynamic Application Security Testing)

Penetration Testing

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

23 / 31

Secure Code Review

Secure code review is an effective technique for identifying security flaws

early in the software Code. When used together with automated and

manual penetration testing, secure code review can significantly increase

the cost effectiveness of an application security verification effort.

Manual secure code review is a contextual, white-box approach, provides

insight into the “real risk” associated with insecure code. The human

reviewer can understand the relevance of a bug or vulnerability in code.

The secure code review is not only the task of a security or risk-analysis

team member, all developers need to understand the exposure points

and threats existing in their applications and what threats exist for their

applications.

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

24 / 31

OWASP Code Review Guide

(https://www.owasp.org/OWASP_Code_Review_Guide_v2.pdf)

Example: Injection Vulnerability in Java Code

The OWASP CRG provides Sample Vulnerable Codes in multiple

plateforms (JAVA, PHP,...), discussing a secure code review and proposes

mitigations according to OWASP references.

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

25 / 31

SAST(Static application security testing)

Open Source SAST Tools

"Static application security test-

ing (SAST) is a set of technolo-

gies designed to analyze application

source code, byte code and binaries

for coding and design conditions that

are indicative of security vulnerabili-

ties. SAST solutions analyze an appli-

cation from the “inside out” in a non-

running state".Gartner.

SonarQube

Projects

for more than 25

OWASP

SAST tools

programming languages)

OWASP Orizon is a source code

for J2EE web

security scanner

applications

OWASP WAP(Web Application

Protection) is a security tool to

detect and remove input validation

vulnerabilities in PHP web applica-

tions

Other

Security

(Python),

Rails),FlawFinder(C/C++),

VCG(C++, C#, VB, PHP, Java

and PL/SQL)

automated

Review:

Brakeman(Ruby

Code

Bandit

on

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

26 / 31

FlawFinder: A SAST tool for C/C++ Code

"FlawFinder is simple program that examines C/C++ source code and

reports possible security weaknesses (“flaws”) sorted by risk level."

https://dwheeler.com/flawfinder/

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

27 / 31

DAST(Dynamic Application Security Testing)

are

(web

generally

DAST tools

vulnerability

scanners.

Among DAST open source

tools

vulnerabilities

scanners): OWASP ZAP (Zed

Attack Proxy), Graber, Vega,

Wapiti,

SkipFish, OWASP

WebScarab, RATproxy,...

"Dynamic application secu-

rity testing (DAST) is a pro-

cess of testing an application

or software product in an op-

erating state... DAST may be

called "behavioral testing" in

that testers often find prob-

lems that are not specifically

linked to a code module, but

happened during use".

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

28 / 31

Penetration Testing

Source:https://www.owasp.org/images/1/19/

OTGv4.pdf.

Web Application Pene-

tration Testing

attempts

common hacking techniques

and exploits application’s vul-

nerabilities with the owner’s

permission (Ethical Hacking).

OWASP Testing Guide

Project

to

(OTG)

understand what, why, when,

where, and how of pentesting

web applications.

Some

be

involved: Kali VM, sqlmap,

burp-

metasploit,

ollydbg,sslyze,xss-

suite,

proxy,paros,

wfuzz,

arachni, ...

sqlninja,

w3af,

helps

tools

that

can

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

29 / 31

Purposefully vulnerable applications

DVWA (Damn Vulnerable Web

Application) is PHP/MySQL vulner-

able web application. The goal is to

provide a legal environment helping

web developers better understand the

processes of securing web applica-

tions and aid teachers/students to

teach/learn web application security

in a class room environment.

OWASP WebGoat is deliber-

ately insecure JAVA web appli-

cation maintained by OWASP

designed to teach web applica-

tion security lessons.

Source:http://www.dvwa.co.uk/

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

30 / 31

Source:https://github.com

/WebGoat/WebGoat/releases

Secure modern SDLC methodologies

Modern applications and softwares are built via modern software

developpement processes (like Agile and DevOps) to focus on adaptability

and response time to changing requirements. As mentionned earlier

Security should be considered in each phase of the lifecycle.

Secure Agile SDLC (Security User Stories, Security in Agile Product

Management, Security in Scrum Control Points...)

DevSecOps (Continous Security, Container security, Vulnerability

management, security in/of CI/CD pipeline, Security Automation...)

Dr. Nihel Ben Youssef

Application Security Chap1- Secure SDLC (Secure Software Developpement LifeCycle)

31 / 31