Residency ResearchISOL 536 Security Architecture and Design.docx

Residency Research
ISOL 536
Security Architecture and Design
Using Resources to Promote
Critical Thinking
Critical thinking is an integral part of any educational program
At UC, we encourage and provide applicable resources for the
promotion of critical thinking
In order to properly research and complete course papers,
proper resources must be utilized
Critical Thinking helps us to:
Understand the links between ideas.
Determine the importance and relevance of arguments and
ideas.
Recognize, build and appraise arguments.
Identify inconsistencies and errors in reasoning.
Approach problems in a consistent and systematic way.
Reflect on the justification of their own assumptions, beliefs
and values.
http://www.skillsyouneed.com/learn/critical-thinking.html
Researching Using the Critical Questions
When using research resources, it is imperative to review the

six critical questions and implement that data into your
writings.
Proper Resources for Research
When asked to completed a research paper in the UC School for
Computer and Information Sciences, you must use scholarly,
peer-reviewed articles.
A peer-reviewed article is one that has “been evaluated by
several researchers or subject specialist in the academic
community prior to accepting it for publication” and is “also
known as scholarly or refereed.”
Your professor or the UC Librarian team can help you
determine whether or not an article is peer-reviewed.
Proper Resources for Research
Examples of sites with peer-reviewed resources
UC Library Site
EBSCOhost
JSTOR
Google Scholar
Examples of sites with unacceptable resources
PC Magazine
Cisco
Ars Technica
Reddit
Proper Format is Important
All papers written for courses within the School for Computer
and Information Sciences must follow the American
Psychological Association (APA) writing style.

University Resources
The UC Library provides a myriad of online resources to assist
students with proper research
Resources referring to Information Security can be found inside
the UC Library site
www.ucumberlands.edu/library
Groups
Group 1
Group Topic: Meltdown
[email protected][email protected][email protected][email prote
cted][email protected][email protected]
Group 2
Group Topic: Spectre
Group 3
Group Topic: ZombieLoad

Group 4
Group Topic: RIDL
cted][email protected]
Group 5
Group Topic: Fallout
cted][email protected]
Research Topic
Security researchers have discovered major vulnerabilities with
the design of Intel chips
The vulnerabilities stem from several issues and their
immediate remediations create severe loss of performance
Each vulnerability is similar but different
Research Topic
DO
Provide a working knowledge of your assigned vulnerability
Compare and contrast your assigned vulnerability with others
Deeply research the use of threat modeling and secure
architecture
Tie your research back to recommendations for remediation of
the vulnerability
DO NOT
Dive deep into the mathematics of the vulnerability
Disassociate your peer-reviewed scholarly research from the

vulnerability
Plagiarize and copy/paste from sites
Forget the topics of our course (e.g. STRIDE)
Research Paper
10-15 pages
Double spaced APA style
At least 10 references
At least 5 of your references must be scholarly peer-reviewed
articles
Research Paper
Find and review peer-reviewed scholarly articles concerning
security architecture, secure design, and threat modeling
Find and review other information that associates with your
topic area
Apply research from articles on chosen topic area to create
research paper
Research Presentation
Goal is to summarize your research and recommendations
Must present for at least 25 minutes but no more than 30
minutes
Your group will be randomly selected for presentation
All group members need to participate in the presentation

ISOL536 | Security Architecture and Design
Dr. Justin O. Hensley
School of Computer and Information Sciences
1
Overview and stride review
2
Ways to Find Security Issues
Static analysis of code
Fuzzing or other dynamic testing
Pen test/red team
Wait for bug reports after release
All of these are fine, but as you go down the list, you’re going
later and later in the development process. So when you find

bugs, you may have a hard time fixing them, because you might
have dependencies on behavior such as taking large complex
input from an untrusted party, or your libraries may not handle
issues like sql injection well, or you might be using an untyped
language like C.
3
Ways to Find Security Issues
Threat modeling!
Think about security issues early
Understand your requirements better
Don’t write bugs into the code
And the subject of this course
4
Definitions
What is a threat?
How is it different from a
vulnerability,
risk,
or just a problem?
What is a model?
Many people get stuck on these. Definitions matter. Many

people don’t understand the definition of a threat and how it’s
different from a vulnerability, a risk, or a problem.
“Threat” means the bad thing that might happen. “Threat” can
also refer to a person, or a piece of malware, but we don’t use
those definitions here.
“Vulnerability” is a term of art for code that can be
automatically exploited, or more generally, a weakness that can
be exploited.
MODEL: a system or thing used as an example to follow or
imitate.
5
How to Threat Model
What are you building?
What can go wrong?
What are you going to do about it?
Did you complete a good analysis?
The course will teach you practical skills for each of these
6
Addressing the Threat

7
Mitigate
Eliminate
Transfer
Accept
Validation of the Model
8
Check the model
Check each threat
Check the tests
STRIDEThreatProperty
ViolatedDefinitionExampleSpoofingAuthenticationImpersonatin

g something or someone else.Pretending to be any of Bill Gates,
Paypal.com or ntdll.dllTamperingIntegrityModifying data or
codeModifying a DLL on disk or DVD, or a packet as it
traverses the networkRepudiationNon-repudiationClaiming to
have not performed an action.“I didn’t send that email,” “I
didn’t modify that file,” “I certainly didn’t visit that web site,
dear!”Information DisclosureConfidentialityExposing
information to someone not authorized to see itAllowing
someone to read the Windows source code; publishing a list of
customers to a web site.Denial of ServiceAvailabilityDeny or
degrade service to usersCrashing Windows or a web site,
sending a packet and absorbing seconds of CPU time, or routing
packets into a black hole.Elevation of
PrivilegeAuthorizationGain capabilities without proper
authorizationAllowing a remote Internet user to run commands
is the classic example, but going from a limited user to admin is
also EoP.
9
What Can Go Wrong?
Track issues as you find them
“attacker could pretend to be a client & connect”
Track assumptions
“I think that connection is always over SSL”
Both lists are inputs to “what are you going to do about it?”

10
Spoofing On the Local MachineThreat ExampleWhat the
Attacker DoesNotes/ExamplesSpoofing a process
Creates a file before the real processThen your process relies on
itAbuses namesCreate a version of “sudo” and alter
PATHSpoofing a filenameCreates a file in the local
directoryLibrary, executable or config fileCreates a link,
changes itAlso called ‘race condition’ or TOCTOUCreates many
files in a target directoryCode can easily create all possible
/tmp/foo.random
11
Tampering with MemoryThreat ExampleWhat the Attacker
DoesNotes/ExamplesModifying codeChanges your code to suit
themselvesHard to defend against if the attacker is running code
inside the trust boundariesModifying data they’ve
suppliedSupplies data to a pass by reference API, then changes
itWorks because of TOCTOU issuesSupplies data into a shared
memory segment, then changes it
12
RepudiationThreat ExampleWhat the Attacker

DoesNotes/examplesRepudiating an actionClaims to have not
clickedMaybe they did, maybe they didn’t, maybe they’re
honestly confusedClaims to not have received1. Electronic or
physical
2. Receipt is strange; does a client downloading email mean
you’ve seen it? Did a network proxy pre-fetch images? Was a
package left on a porch?Claims to be a fraud victimUses
someone else’s account
13
Information Disclosure (Processes)Threat ExampleWhat the
Attacker DoesNotes/ExamplesExtracts user dataExploits bugs
like SQL injection to read db tablesCan find this by looking to
data stores, but here the issue is the process returning data it
shouldn’tReads error messages Extracts machine secretsReads
error messagesCannot connect to database ‘foo’ as user ‘sql’
with password ‘&IO*(^&’Exploits bugs“Heartbleed”
14
Information Disclosure (Data Stores)Sub-categoryWhat the
Attacker DoesPermissionsTake advantage of missing or
inappropriate ACLsTake advantage of bad database
permissionsFile files protected by obscuritySecurityFind crypto
keys on disk or in memoryGet data from logs/temp filesGet data

from swap filesSee interesting information in
filenames/directory namesNetworkSee data traversing a
networkMiscObtain device, boot in new OS
15
Information Disclosure (Data Flow)Sub-categoryWhat the
Attacker DoesNetworkRead data on a networkRedirects traffics
to enable reading data on the networkMetadataLearns secrets by
analyzing trafficLearns who talks to whom by watching the
DNSLearns who talks to whom by analyzing social network
information
16
Denial of ServiceThreat ExampleWhat the Attacker
DoesNotes/ExamplesAgainst a processAbsorb memory (ram or
disk)Absorb CPUUses a process as an amplifierAgainst business
logic“Too many login attempts”Against a data storeFills the
data storeMakes enough requests to slow the systemAgainst a
data flowConsumes network resources
Can be temporary (as the attack continues; fill the network) or
persist beyond that (fill a disk)

17
Elevation of Privilege (“EoP”)Threat ExampleWhat the Attacker
DoesNotes/ExamplesEoP Against process via corruptionSends
inputs the code doesn’t handle properlyVery common, usually
high impactGains read/write access to memoryWriting memory
more obviously badEoP via misused authorization checksEoP
via buggy authorization checksCentralizing checking makes
consistency, correctness easierEoP via data tamperingModify
bits on disk
18
19

1
Introduction
and expectations
2
Introduce yourself

3
Goals for Residency
Successfully complete part of course requirements
Strengthen research skills
Make professional connections
Increase social and soft skills
Have fun!
4
Expectations for Residency
Come early
Give attention
Respect colleagues
Participate equally
Produce exceptional work
5
Review schedule

6
7

Residency ResearchISOL 536 Security Architecture and Design.docx

Recommended

Recommended

More Related Content

Similar to Residency ResearchISOL 536 Security Architecture and Design.docx

Similar to Residency ResearchISOL 536 Security Architecture and Design.docx (20)

More from brittneyj3

More from brittneyj3 (20)

Recently uploaded

Recently uploaded (20)

Residency ResearchISOL 536 Security Architecture and Design.docx