Official (ISC)2 Guide to the CSSLP ((ISC)2 Press)

Contents......Page 6
Foreword......Page 18
About the Author......Page 20
Introduction......Page 22
1.2 Objectives......Page 26
1.3 Holistic Security......Page 27
1.4.1 Iron Triangle Constraints......Page 28
1.4.3 Security versus Usability......Page 29
1.5 Quality and Security......Page 30
1.6 Security Profile: What Makes a Software Secure?......Page 31
1.6.1 Core Security Concepts......Page 32
1.6.2 General Security Concepts......Page 33
1.6.3 Design Security Concepts......Page 38
1.8 Risk Management......Page 40
1.8.1 Terminology and Definitions......Page 41
1.8.2 Calculation of Risk......Page 45
1.8.3 Risk Management for Software......Page 46
1.8.4 Handling Risk......Page 47
1.8.5 Risk Management Concepts: Summary......Page 50
1.9.1 Scope of the Security Policies......Page 51
1.9.2 Prerequisites for Security Policy Development......Page 52
1.10.1 Types of Security Standards......Page 53
1.10.2 Benefits of Security Standards......Page 68
1.11.1 Open Web Application Security Project (OWASP)......Page 69
1.12 Information Technology Infrastructure Library (ITIL)......Page 71
1.13.1 Socratic Methodology......Page 72
1.13.2 Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE®)......Page 73
1.13.3 STRIDE and DREAD......Page 74
1.13.4 Open Source Security Testing Methodology Manual (OSSTMM)......Page 75
1.13.6 Six Sigma (6σ)......Page 76
1.13.7 Capability Maturity Model Integration (CMMI)......Page 77
1.14.2 Control Objectives for Information and Related Technology (COBIT®)......Page 78
1.15 Regulations, Privacy, and Compliance......Page 79
1.15.1 Significant Regulations and Acts......Page 80
1.15.3 Privacy and Software Development......Page 83
1.16 Security Models......Page 84
1.16.1 BLP Confidentiality Model......Page 85
1.16.2 Biba Integrity Model......Page 86
1.16.3 Clark and Wilson Model (Access Triple Model)......Page 87
1.16.4 Brewer and Nash Model (Chinese Wall Model)......Page 88
1.17.1 Ring Protection......Page 90
1.17.3 Trusted Computing Base (TCB)......Page 91
1.17.5 Rootkits......Page 94
1.18 Trusted Platform Module (TPM)......Page 95
1.19 Acquisitions......Page 96
1.20 Summary......Page 97
1.21 Review Questions......Page 98
References......Page 101
2.1 Introduction......Page 104
2.2 Objectives......Page 105
2.3 Sources for Security Requirements......Page 106
2.4 Types of Security Requirements......Page 107
2.4.1 Confidentiality Requirements......Page 109
2.4.2 Integrity Requirements......Page 112
2.4.3 Availability Requirements......Page 113
2.4.4 Authentication Requirements......Page 115
2.4.5 Authorization Requirements......Page 121
2.4.6 Auditing/Logging Requirements......Page 127
2.4.7 Session Management Requirements......Page 128
2.4.10 Sequencing and Timing Requirements......Page 129
2.4.11 Archiving Requirements......Page 131
2.4.12 International Requirements......Page 132
2.4.14 Procurement Requirements......Page 134
2.5 Protection Needs Elicitation......Page 135
2.5.2 Surveys (Questionnaires and Interviews)......Page 136
2.5.3 Policy Decomposition......Page 137
2.5.4 Data Classification......Page 139
2.5.5 Use and Misuse Case Modeling......Page 142
2.5.7 Templates and Tools......Page 144
2.7 Summary......Page 145
2.8 Review Questions......Page 146
References......Page 150
3.1 Introduction......Page 152
3.3 The Need for Secure Design......Page 153
3.4 Flaws versus Bugs......Page 154
3.5.1 Core Software Security Design Considerations......Page 155
3.5.2 Integrity Design......Page 163
3.5.3 Availability Design......Page 169
3.5.5 Authorization Design......Page 170
3.5.6 Auditing/Logging Design......Page 171
3.6 Information Technology Security Principles and Secure Design......Page 172
3.7 Designing Secure Design Principles......Page 173
3.7.1 Least Privilege......Page 174
3.7.3 Defense in Depth......Page 175
3.7.4 Fail Secure......Page 176
3.7.5 Economy of Mechanisms......Page 177
3.7.6 Complete Mediation......Page 178
3.7.7 Open Design......Page 179
3.7.9 Psychological Acceptability......Page 181
3.7.10 Leveraging Existing Components......Page 182
3.9 Other Design Considerations......Page 183
3.9.1 Programming Language......Page 184
3.9.2 Data Type, Format, Range, and Length......Page 185
3.9.3 Database Security......Page 187
3.9.4 Interface......Page 196
3.9.5 Interconnectivity......Page 197
3.10.1 Attack Surface Evaluation......Page 198
3.10.2 Threat Modeling......Page 201
3.11 Architectures......Page 217
3.11.1 Mainframe Architecture......Page 220
3.11.2 Distributed Computing......Page 221
3.11.3 Service Oriented Architecture......Page 223
3.11.4 Rich Internet Applications......Page 226
3.11.5 Pervasive Computing......Page 227
3.11.6 Software as a Service (SaaS)......Page 229
3.11.7 Integration with Existing Architectures......Page 231
3.12.1 Authentication......Page 232
3.12.2 Identity Management......Page 233
3.12.4 Password Management......Page 236
3.12.5 Certificate Management......Page 237
3.12.6 Single Sign-On (SSO)......Page 240
3.12.7 Flow Control......Page 241
3.12.8 Auditing/Logging......Page 243
3.12.9 Data Loss Prevention......Page 246
3.12.10 Virtualization......Page 247
3.12.11 Digital Rights Management......Page 249
3.13 Secure Design and Architecture Review......Page 251
3.15 Review Questions......Page 252
References......Page 255
4.1 Introduction......Page 258
4.4 Fundamental Concepts of Programming......Page 259
4.4.1 Computer Architecture......Page 260
4.4.2 Programming Languages......Page 263
4.5.1 Waterfall Model......Page 267
4.5.2 Iterative Model......Page 268
4.5.3 Spiral Model......Page 269
4.5.4 Agile Development Methodologies......Page 270
4.6 Common Software Vulnerabilities and Controls......Page 272
4.6.1 Injection Flaws......Page 273
4.6.2 Cross-Site Scripting (XSS)......Page 286
4.6.3 Buffer Overflow......Page 289
4.6.4 Broken Authentication and Session Management......Page 293
4.6.5 Insecure Direct Object References......Page 296
4.6.6 Cross-Site Request Forgery (CSRF)......Page 298
4.6.7 Security Misconfiguration......Page 301
4.6.8 Failure to Restrict URL Access......Page 302
4.6.9 Unvalidated Redirects and Forwards......Page 303
4.6.10 Insecure Cryptographic Storage......Page 305
4.6.11 Insufficient Transport Layer Protection......Page 308
4.6.12 Information Leakage and Improper Error Handling......Page 310
4.6.13 File Attacks......Page 314
4.6.14 Race Condition......Page 318
4.6.15 Side Channel Attacks......Page 319
4.7 Defensive Coding Practices—Concepts and Techniques......Page 321
4.7.2 Input Validation......Page 322
4.7.3 Canonicalization......Page 323
4.7.4 Code Access Security......Page 324
4.7.5 Container (Declarative) versus Component (Programmatic) Security......Page 326
4.7.6 Cryptographic Agility......Page 327
4.7.7 Memory Management......Page 329
4.7.8 Exception Management......Page 331
4.7.9 Anti-Tampering......Page 332
4.7.11 Embedded Systems......Page 333
4.8.1 Versioning......Page 335
4.8.3 Code/Peer Review......Page 336
4.9 Build Environment and Tools Security......Page 340
4.10 Summary......Page 341
4.11 Review Questions......Page 342
References......Page 345
5.1 Introduction......Page 348
5.3 Quality Assurance......Page 349
5.4.1 Reliability Testing (Functional Testing)......Page 350
5.4.2 Recoverability Testing......Page 355
5.4.3 Resiliency Testing (Security Testing)......Page 356
5.5.1 White Box Testing......Page 358
5.5.3 Fuzzing......Page 360
5.5.4 Scanning......Page 361
5.5.5 Penetration Testing (Pen-Testing)......Page 364
5.5.6 White Box Testing versus Black Box Testing......Page 366
5.6.1 Testing for Input Validation......Page 369
5.6.3 Testing for Nonrepudiation......Page 370
5.6.5 Failure Testing......Page 372
5.6.7 Testing for Buffer Overflow Defenses......Page 374
5.6.9 Anti-Reversing Protection Testing......Page 375
5.7.1 Environment Testing......Page 376
5.7.3 User Acceptance Testing......Page 378
5.8.1 Reporting Defects......Page 379
5.8.2 Tracking Defects......Page 383
5.9 Impact Assessment and Corrective Action......Page 384
5.10 Tools for Security Testing......Page 385
5.12 Review Questions......Page 386
References......Page 389
6.1 Introduction......Page 392
6.3 Guidelines for Software Acceptance......Page 393
6.5 Software Acceptance Considerations......Page 395
6.5.1 Considerations When Building Software......Page 396
6.5.2 When Buying Software......Page 402
6.6 Legal Protection Mechanisms......Page 408
6.6.1 IP Protection......Page 409
6.6.3 Validity Periods......Page 412
6.6.4 Contracts and Agreements......Page 413
6.7 Software Escrow......Page 417
6.8 Verification and Validation (V&V)......Page 419
6.8.1 Reviews......Page 420
6.8.2 Testing......Page 421
6.8.4 Checklists and Tools......Page 422
6.10 Summary......Page 423
6.11 Review Questions......Page 424
References......Page 427
7.1 Introduction......Page 428
7.3 Installation and Deployment......Page 429
7.3.1 Hardening......Page 430
7.3.3 Environment Configuration......Page 431
7.3.4 Bootstrapping and Secure Startup......Page 433
7.4 Operations and Maintenance......Page 434
7.4.1 Monitoring......Page 437
7.4.2 Incident Management......Page 444
7.4.3 Problem Management......Page 454
7.4.4 Patching and Vulnerability Management......Page 456
7.5.1 End-of-Life Policies......Page 460
7.5.3 Sunsetting Processes......Page 461
7.5.4 Information Disposal and Media Sanitization......Page 462
7.6 Summary......Page 465
7.7 Review Questions......Page 466
References......Page 470
Appendix A: Answers to Practice Questions......Page 472
Appendix B: Threat Modeling-Zion, Inc.......Page 524
Appendix C: Commonly Used Opcodes in Assembey......Page 538
Appendix D: HTTP/1.1 Status Codes and Reason Phrases (IETF RFC 2616)......Page 542
Appendix E: Security Testing Tools......Page 546
A......Page 560
C......Page 561
D......Page 562
E......Page 563
I......Page 564
M......Page 565
P......Page 566
R......Page 567
S......Page 568
T......Page 571
V......Page 572
Z......Page 573