Application 2 Developing Security Functional Requirements

Question: #651

In 1974, Jerome Saltzer and Michael Schroeder wrote a paper that has shaped how we think about threats to computers. This seminal publication outlines a set of basic principles that define a logical way to classify and respond to threat. It also describes the critical things you should consider while building software. These underlying principles dictate the conditions and requirements of application security and define the goals of application security process.

Supplementing Saltzer's and Schroeder's principles are the Common Weakness Enumeration (CWE), the Common Attack Patterns Enumeration and Classification (CAPEC), and the Common Body of Knowledge (CBK). These resources provide the most up-to-date and detailed way of thinking about threats and provide detailed information about the ways that those threats can be exploited.

The CWE is an industry-supported document that catalogues all of the known vulnerabilities that appear in software and the ways that attackers exploit these vulnerabilities. It also itemizes the common types of attacks and attackers as well as their motivations, the specific methods that they employ, and the attack surfaces that are most vulnerable. This is extremely valuable knowledge because it tells you what to look for when you are checking your code. It also allows you to classify common types of errors into categories, which makes it easier to prioritize those errors by the level of risk they represent.

By combining the IEEE 12207 standard with the high-level principles of Saltzer and Schroeder and the practical advice of the CBK, the CWE and CAPEC, developers have a roadmap for planning and implementing an application security process that will ensure against the occurrence of exploitable defects in their products and services.

For this Application, you will use some of these resources to examine security weaknesses and the methods of exploiting those weaknesses.

To begin the assignment:

•Choose one of the application security weaknesses listed in the CWE Top 25 Most Dangerous Software Errors.

•Choose one method of exploiting that security weakness as listed in the Common Attack Pattern Enumeration and Classification: CAPEC List Release 1.6.

Then, in a 2- to 3-page paper address the following:

•Briefly summarize the weakness and method of attack you chose. In your description, summarize how that weakness operates in practice, how it might be created in software, and how it can be exploited by your chosen method of attack.

•Assess which of Saltzer's and Schroeder's principles would be involved with causing or mitigating that particular attack. For example, where does "economy of mechanism" fit into command injection attacks? Why?

•Assess which IEEE 12207 processes and practices would be affected by or implicated in such an attack. Why?

•Analyze what would happen to those IEEE 12207 processes and practices if that attack was successful. Relate those effects to a business or day-to-day operational problem it could cause.

Remember to properly cite your sources according to APA guidelines.

Application 2.docx 12 KB

Solution: #660

Developing Security Functional Requirements Application 2 Scored

From the complete risk and threat assessment of AAG Revenue Process Manager, We have come to the decision that, since this application will be implemented on the server of the organization and complete data transfer will be done via online internet network.
Therefore, in order to mitigate the associated risks and threats of breach of data and confidentiality following functional imple...