Security Threat Identification and Testing
Business applications are more and more collaborative (cross-domains, cross-devices, service composition). Security shall focus on the overall application scenario including the interplay between its entities/devices/services, not only on the isolated systems within it. In this paper we propose the Security Threat Identification And TEsting (STIATE) toolkit to support development teams toward security assessment of their under-development applications focusing on subtle security logic flaws that may go undetected by using current industrial technology. At design-time, STIATE supports the development teams toward threat modeling and analysis by identifying automatically potential threats (via model checking and mutation techniques) on top of sequence diagrams enriched with security annotations (including {whatif} conditions). At run-time, STIATE supports the development teams toward testing by exploiting the identified threats to automatically generate and execute test-cases on the up and running application. We demonstrate the usage of the STIATE toolkit on an application scenario employing the SAML Single Sign-On multi-party protocol, a well-known industrial security standard largely studied in previous literature.
Recommended
More Related Content
Similar to Security Threat Identification and Testing
Similar to Security Threat Identification and Testing (20)
More from Annibale Panichella
More from Annibale Panichella (20)
Recently uploaded
Recently uploaded (20)
Security Threat Identification and Testing
- 1. Roberto Carbone, Security & Trust, FBK Luca Compagna, SAP France Lab Annibale Panichella, Delft University of Technology Serena Elisa Ponta, SAP France Lab Security Threat Identification and Testing
- 2. • Automated security analysis techniques can systematically explore and test the behaviour of the system running in a hostile environment. • Informal specification ! Formal specification • Formal verification ! Test Case Generation • Formal specification ! Real Implementation Goal: Bring them to the market! Motivation and Goals
- 3. Formal Verification Formal Model + Security Property Attack Not Found Model Checker Attack Found Test Execution Engine Adapter Test Case
- 4. Formal Verification Formal Model + Security Property Attack Not Found Model Checker Attack Found Test Execution Engine Adapter Test Case Formal Model vs. Informal Model
- 5. Formal Models: ASLan++ ASLan++ Sequence Diagram • Easy to understand • Few details • Not useful for formal analysis • Input of the model checker (SATMC) • Many details • More complex to write
- 6. STIATE toolkit: Architecture Front-end: add-in for Enterprise Modelling Tools (Power Designer). Sequence Diagram (Informal Model) Security Annotations (XMI files) SATMC: model checker for the formal analysis XMI Translator: converts XMI files in formal Models (ASLan) Test Case Execution Mutation: mutation testing for formal models
- 7. Scenario: SAML-SSO SAML 2.0 Web Browser Single Sign-On Profile: - SAML-based SSO for Google App - Novell Access Manager - SimpleSAMLphp by UNINETT
- 8. Scenario: SAML-SSO SAML 2.0 Web Browser Single Sign-On Profile: - SAML-based SSO for Google App - Novell Access Manager - SimpleSAMLphp by UNINETT Vulnerabilities due to wrong design choice A. Armando, R. Carbone, L. Compagna, “LTL Model Chencking for Security Protocols” Computer Security Foundation , 2007 Design vs. Implementation A. Armando, R. Carbone, L. Compagna, J. Cueller, F. Pellegrino, , “An authentication flaw in browser-based Single Sign-On protocols: Impact and remediations” Computer & Security, 2013
- 10. • SATMC reduces the security problem to propositional satisfiability problem (SAT) • Why SAT? Dramatic speed-up of SAT solvers: problems with thousands of variables are now solved routinely in milliseconds. STIATE toolkit: SATMC Satisfiable formula Unsatisfiable formula
- 12. STIATE toolkit: SATMC ASLan++ v. 1ASLan++ v. 0 SATMC SATMC Attack Not Found Attack Found
- 13. STIATE toolkit: SATMC ASLan++ v. 1 SATMC Attack Found Vulnerabilities due to wrong design choice A. Armando, R. Carbone, L. Compagna, “LTL Model Chencking for Security Protocols” Computer Security Foundation , 2007
- 14. STIATE toolkit: SATMC ASLan++ v. 0 SATMC Attack Not Found Let us to suppose that the model checker does not found any attack trace, i.e., the model is secure Can we guarantee that its implementation is still secure?
- 15. Specification vs. Implementation Specification Real Implementation The implementation may deviate from the specification. Thus, even if the theoretical specification is secure, its corresponding implementation may be not secure because of implementation mistakes.
- 16. Specification vs. Implementation There are many widespread and critical errors that can lead to serious vulnerabilities in software. A classification of the top most common errors can be found in http://cwe.mitre.org/top25/index.html#Listing
- 17. STIATE toolkit: Mutation Injecting vulnerabilities in the model to see if such vulnerabilities could lead to an attack that violates one security properties. Mutating the ASLan++ specification by injecting vulnerabilities that mirror common implementation flaws.
- 19. STIATE toolkit: MutationSTIATE toolkit: Mutation Original Model
- 20. STIATE toolkit: MutationSTIATE toolkit: Mutation Original Model Mutated Model
- 21. STIATE toolkit: Mutation Mutated Model SATMC Attack Found Design vs. Implementation A. Armando, R. Carbone, L. Compagna, J. Cueller, F. Pellegrino, , “An authentication flaw in browser-based Single Sign-On protocols: Impact and remediations” Computer & Security, 2013
- 22. Summary
- 23. Summary
- 24. Summary
- 25. Summary
- 26. Summary
- 27. Summary