Security

Contents 
13.1 Security and dependability 
13.2 Security and organizations 
13.3 Security requirements 
13.4 Secure systems design 
13.5 Security testing and assurance

Confidentiality
Integrity
Availability

Application
Infrastructure
Operational security

Permissions
Upgrade to fix security issues
Monitor attacks, detect and recover

13.1
Truly safe: do not connect to internet
(But there were security issues before the Internet)
Encryption
Passwords
Permissions

Interception
Interruption
Modification
Fabricate/falsify

Vulnerability avoidance
Attack detection and neutralization
Exposure limitation and recovery

Interactions with reliability, availability, safety, resilience

13.2
Security and Organizations
	Security policy
	Assets to be protected
	Level of protection
	Responsibility (users, managers, organization)
	Existing procedure to maintain security
Risk assessment
	Preliminary
	Design risk assessment
	Operational risk assessment
13.3
Security requirements
	Safety is usually not about an attack
	Security attacks are deliberate
	Attackers can probe, and learn, cover tracks, share
	Shutting down the system to avoid a breach means (Denial of Service)
Identification
Authorization
Immunity
Integrity
Intrusion detection
Non-repudiation
Privacy
Auditing
Maintenance security

Risk avoidance requirements
Risk detection requirements
Risk mitigation requirements

Asset ID
Value assessment
Exposure assessment
Threat identification
Attack assessment
Control identification
Feasibility
Security requirements definition

Misuse cases

13.4
Secure system design
	Architecture—how affect security?
	Good practice—what is good?
	Redundancy and diversity
	Balance security performance usability
	Password checker
	Reject weak password
	Limit web browser
	Limit physical or internet address
Design and assessment of risks interleaved
	
Protection
Distribution

Guidelines for design (raise awareness, review checklist)
	Base decisions on explicit security policy
	Defense in depth
	Fail securely
	Balance security and usability
	Log user actions
	Redundancy and diversity
Specify format
	Compartmentalize
	Deployment
		See configuration
		Minimize default privileges
		Localize configuration settings
		Provide ways to fix vulnerabilities
		Design for recovery
		Backup authentication
Secure system programming
	1988 worm
	No array bound checking
	SQL injection attack
	Vulnerabilities language/system specific
13.5
Security testing and assurance
	What should not happen
	Protect against known attacks
	(cannot protect against unknown attacks)
	Attackers look for vulnerabilities
	And share information

Experience based testing
Penetration testing
Tool based analysis
	Password checker
	Static analysis
Formal verification

Security testing can take time, effort, money
	And still not find vulnerabilities
Focus on most significant risks