Software Security Assurance
Software is itself a resource and thus must be afforded appropriate security. Software also contains and controls data and other resources. Therefore, it must be designed and implemented to protect those resources. Software Security Assurance is a process that helps achieve that goal.
What is Software Security Assurance?
Software Security Assurance (SSA) is the process of ensuring that
softwareis designed to operate at a level of security that is consistent with the potential harm that could result from the loss, inaccuracy, alteration, unavailability, or misuse of the data and resources that it uses, controls, and protects.
Software Security Assuranceprocess begins by identifying and categorizing the information that is to be contained in, or used by, the software. The information should be categorized according to its sensitivity. For example, in the lowest category, the impact of a security violation is minimal (i.e. the impact on the software owner's mission, functions, or reputation is negligible). For a top category, however, the impact may pose a threat to human life; may have an irreparable impact on software owner's missions, functions, image, or reputation; or may result in the loss of significant assetsor resources.
Once the information is categorized, security requirements can be developed. The security requirements should address access control, including network access and physicalaccess; data management and data access; environmental controls (power, air conditioning, etc.) and off-line storage; human resource security; and audit trails and usage records.kabseung.
What Causes Software Security Problems?
All security vulnerabilities in software are the result of
Security bugs, or defects, within the software. In most cases, these defects are created by two primary causes:
#Non-conformance, or a failure to satisfy requirements
#An error or omission in the
Non-conformance, or Failure to Satisfy Requirements
A non-conformance may be simple; the most common is a coding error or defect, or more complex (i.e., a subtle timing error or input validation error). The important point about non-conformances is that verification and
validationtechniques are designed to detect them and security assurance techniques are designed to prevent them. Improvements in these methods through a software security assurance program can improve the security of software.
Errors or Omissions in Requirements
The most serious security problems with software-based systems are those that develop when the software requirements are incorrect, inappropriate, or incomplete for the system situation. Unfortunately, errors or omissions in requirements are more difficult to identify. For example, the software may perform exactly as required, but the requirements do not correctly deal with some system state. When the system enters the undefined state, unexpected and undesirable behavior may result. This type of problem cannot be handled within the software discipline; it results from a failure of the system and software engineering processes which developed and allocated the system requirements to the software.
Software Security Assurance Activities
There are two basic types of Software Security Assurance activities.
1. Software Security Assurance activities that focus on ensuring information being (or to be) processed by an information system is assigned a proper sensitivity category and that the appropriate protection requirements have been developed and met in the system being developed or maintained.
2. Software Security Assurance activities that are focused on ensuring the control and protection of the software being developed and/or maintained, and of software support tools and data.
At a minimum, a Software Security Assurance program should ensure that:
#A security evaluation has been performed for the software.
#Security requirements have been established for the software.
#Security requirements have been established for the software development and/or operations and maintenance (O&M) process.
#Each software review, or
audit, includes the evaluation of the security requirements.
#A configuration management and corrective action process is in place to provide security for the existing software and to ensure any proposed changes do not inadvertently create security violations or vulnerabilities.
#Physical security for the software is adequate.
Building Security In
Improving the software development process and building better software are ways to improve software security, i.e. byproducing software with fewer defects and vulnerabilities. A first order approach is to identify the critical software components that control security-related functions and pay special attention to them throughout the development and testing process. This approach helps focus scarce security resources on the most critical areas.
Tools and Techniques
There are many Commercial-Off-the-shelf (COTS) software packages that are available to support software security assurance activities. However, before they are used, these tools must be carefully evaluated and their effectiveness must be assured.
Common Weaknesses Enumeration
One way to improve software security is to gain a better understanding of the most common weaknesses that can affect software security. With that in mind, there is a current community-based program called the Common Weaknesses Enumeration project [http://www.cve.mitre.org/cwe/index.html#dictionary] , which is sponsored by The
Mitre Corporationto identify and describe such weaknesses. The list, which is currently in a very preliminary form, contains descriptions of software weaknesses, faults, and flaws.
ecurity Architecture/Design Analysis
Security Architecture/Design Analysis verifies that the software design correctly implements security requirements. Generally speaking, there are four basic techniques that are used for security architecture/design analysis.
1. Logic Analysis
Logic analysis evaluates the
equations, algorithms, and control logic of the software design.
2. Data Analysis
Data analysis evaluates the description and intended usage of each data item used in design of the software component. The use of interrupts and their effect on data should receive special attention to ensure interrupt handling routines do not alter critical data used by other routines.
3. Interface Analysis
Interface analysis verifies the proper design of a software component's interfaces with other components of the system, including hardware, software, and end-users.
4. Constraint Analysis
Constraint analysis evaluates the design of a software component against restrictions imposed by requirements and real-world limitations. The design must be responsive to all known or anticipated restrictions on the software component. These restrictions may include timing, sizing, and throughput constraints, input and output data limitations, equation and algorithm limitations, and other design limitations.
ecure Code Reviews, Inspections, and Walkthroughs
Code analysis verifies that the software
source codeis written correctly, implements the desired design, and does not violate any security requirements. Generally speaking, the techniques used in the performance of code analysis mirror those used in design analysis.
Secure Code Reviews are conducted during and at the end of the development phase to determine whether established security requirements, security design concepts, and security-related specifications have been satisfied. These reviews typically consist of the presentation of material to a review group. Secure Code Reviews are most effective when conducted by personnel who have not been directly involved in the development of the software being reviewed.
Informal secure code reviews can be conducted on an as-needed basis. To conduct an informal review The developer simply selects one or more reviewer(s) and provides and/or presents the material to be reviewed. The material may be as informal as pseudo-code or hand-written documentation.
Formal secure code reviews are conducted at the end of the development phase for each software component. The acquirer of the software appoints the formal review group, who may make or affect a "go/no-go" decision to proceed to the next step of the
software development life cycle.
Inspections and Walkthroughs
A secure code inspection or walkthrough is a detailed examination of a product on a step-by-step or line-of-code by line-of-code basis. The purpose of conducting secure code inspections or walkthroughs is to find errors. Typically, the group that does an inspection or walkthrough is composed of peers from development,
security engineeringand quality assurance.
security testing, which includes penetration testing, confirms the results of design and code analysis, investigates software behavior, and verifies that the software complies with security requirements. Special security testing, conducted in accordance with a security test plan and procedures, establishes the compliance of the software with the security requirements. Security testing focuses on locating software weaknesses and identifying extreme or unexpected situations that could cause the software to fail in ways that would cause a violation of security requirements. Security testing efforts are often limited to the software requirements that are classified as "critical" security items.
Secure by design
* [http://www.hbarel.com/Threads PracticalSecurity Threads] -- A collection of discussions by information security professionals about security considerations in software (and hardware) development.
* [http://www.hbarel.com/Blog/entry0009.html The toughest part of designing secure products] -- An essay pinpointing the difficulty in designing security-aware applications.
* [http://tylerhannan.blogspot.com/2008/08/wells-fargo-data-breach-what-have-we.html Wells Fargo Data Breach: What have we learned?] Post about security being incorporated into the software development process
Wikimedia Foundation. 2010.
Look at other dictionaries:
Open source software security — is the measure of assurance or guarantee in the freedom from danger and risk inherent to an open source software system. Contents 1 The debate 1.1 Benefits of open source security 1.2 Drawbacks of open source security … Wikipedia
Software Assurance — (SwA) is defined as “the level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at anytime during its lifecycle, and that the software functions in the intended… … Wikipedia
Security engineering — is a specialized field of engineering that focuses on the security aspects in the design of systems that need to be able to deal robustly with possible sources of disruption, ranging from natural disasters to malicious acts. It is similar to… … Wikipedia
Security bug — A security bug is a software bug that benefits someone other than intended beneficiaries in the intended ways. Security bugs introduce security vulnerabilities by compromising one or more of: * Authentication of users and other entities *… … Wikipedia
Software testing — is an empirical investigation conducted to provide stakeholders with information about the quality of the product or service under test [ [http://www.kaner.com/pdfs/ETatQAI.pdf Exploratory Testing] , Cem Kaner, Florida Institute of Technology,… … Wikipedia
Software engineering — (SE) is the application of a systematic, disciplined, quantifiable approach to the development, operation, and maintenance of software, and the study of these approaches; that is, the application of engineering to software. It is the… … Wikipedia
Software documentation — or source code documentation is written text that accompanies computer software. It either explains how it operates or how to use it, and may mean different things to people in different roles. Contents 1 Role of documentation in software… … Wikipedia
Software quality — Contents 1 Motivation for Defining Software Quality 2 Definition 3 Alternative Approaches to Software Quality Defin … Wikipedia
Security Audit — Als IT Sicherheitsaudit (englisch IT Security Audit; von lateinisch audit: „er/sie hört“; sinngemäß: „er/sie überprüft“) werden in der Informationstechnik (IT) Maßnahmen zur Risiko und Schwachstellenanalyse (engl. Vulnerability Scan) eines IT… … Deutsch Wikipedia
Security Scan — Als IT Sicherheitsaudit (englisch IT Security Audit; von lateinisch audit: „er/sie hört“; sinngemäß: „er/sie überprüft“) werden in der Informationstechnik (IT) Maßnahmen zur Risiko und Schwachstellenanalyse (engl. Vulnerability Scan) eines IT… … Deutsch Wikipedia