CB3591 – ENGINEERING SECURE SOFTWARE SYSTEMS
UNIT I – NEED OF SOFTWARE SECURITY AND LOW-LEVEL
ATTACKS
[Detailed notes for Unit I included previously]
UNIT II – SECURE SOFTWARE DESIGN
[Detailed notes for Unit II included previously]
UNIT III – SECURITY RISK MANAGEMENT
[Detailed notes for Unit III included previously]
UNIT IV – SECURITY TESTING
1. Traditional Software Testing vs. Security Testing
Traditional Software Testing: - Focuses on functional correctness,
performance, usability, and reliability. - Uses test cases derived from
specifications. - Techniques include unit testing, integration testing, system
testing, regression testing.
Security Testing: - Focuses on verifying the confidentiality, integrity, and
availability of software. - Aims to identify vulnerabilities and security
weaknesses. - Involves negative testing, threat modeling, fuzz testing, and
penetration testing.
Comparison: | Aspect | Traditional Testing | Security Testing | |——–|
———————-|——————| | Objective | Functional correctness |
Vulnerability detection | | Inputs | Requirements/specs | Threat models,
attack surfaces | | Techniques | Unit, regression | Fuzzing, pen-testing | |
Tools | JUnit, Selenium | OWASP ZAP, Metasploit |
2. Secure Software Development Life Cycle (SSDLC)
SSDLC integrates security at each phase of the traditional SDLC:
1. Requirements: Define security requirements alongside functional
ones.
2. Design: Use threat modeling and secure architecture principles.
3. Implementation: Follow secure coding guidelines.
4. Testing: Conduct static and dynamic analysis.
5. Deployment: Ensure secure configuration and monitoring.
6. Maintenance: Regular patching and vulnerability management.
Frameworks: - Microsoft SDL - OWASP SAMM - BSIMM (Building Security In
Maturity Model)
3. Risk-Based Security Testing
Definition: Testing focused on areas with the highest security risks.
Process: - Identify risk assets (data, services) - Perform threat modeling -
Prioritize based on likelihood and impact - Design targeted tests for high-risk
areas
Benefits: - Efficient resource allocation - Maximized vulnerability detection
in critical areas
4. Prioritizing Security Testing with Threat Modeling
Threat Modeling: - Structured approach to identify, enumerate, and
prioritize potential threats
Popular Models: - STRIDE (Spoofing, Tampering, Repudiation, Information
Disclosure, Denial of Service, Elevation of Privilege) - DREAD (Damage,
Reproducibility, Exploitability, Affected users, Discoverability) - Attack Trees
Integration: - Incorporate into design reviews - Drive test case generation
for critical threats
5. Penetration Testing
Definition: Simulated cyber attack on a system to identify exploitable
vulnerabilities.
Types: - Black-box: No prior knowledge of system - White-box: Full
knowledge of system architecture - Gray-box: Partial knowledge
Phases: 1. Planning and Scoping 2. Information Gathering
(Enumeration) 3. Vulnerability Analysis 4. Exploitation 5. Post-
Exploitation 6. Reporting
6. Planning and Scoping
Define rules of engagement (what can and can’t be tested)
Identify goals (e.g., gain admin access, extract data)
Agree on timelines and success criteria
7. Enumeration
Process of extracting detailed system information
Includes user accounts, network shares, open ports
Tools: - Nmap - Netcat - SNMPwalk
8. Remote Exploitation
Attacks initiated from remote machines to exploit networked systems
Examples: - Exploiting buffer overflows in network services - Brute force
attacks against login portals
Tools: - Metasploit - Hydra
9. Web Application Exploitation
Targeting vulnerabilities in web apps (OWASP Top 10)
Common Vulnerabilities: - SQL Injection - Cross Site Scripting (XSS) -
Cross Site Request Forgery (CSRF)
Testing Tools: - OWASP ZAP - Burp Suite - Nikto
10. Exploits and Client-Side Attacks
Client-Side Exploits: - Targeting browser or local software (e.g., Adobe
Flash, PDF Readers) - Delivered via phishing emails, malicious links
Examples: - Drive-by downloads - Malicious JavaScript execution
Defense Techniques: - Browser sandboxing - Disabling unnecessary
plugins
11. Post-Exploitation
Goals: - Escalate privileges - Maintain persistence - Extract sensitive data -
Move laterally within network
Techniques: - Credential harvesting - Creating backdoors - Privilege
escalation
12. Bypassing Firewalls and Avoiding Detection
Evasion Techniques: - Port spoofing and tunneling - Encrypted payloads -
Using stealthy traffic patterns
Detection Avoidance: - Disabling antivirus - Manipulating logs - Using
known trusted processes
13. Tools for Penetration Testing
Tool Purpose
Nmap Network discovery & port
scanning
Metasploit Exploitation framework
Wireshark Packet analysis
Nikto Web vulnerability scanning
OWASP ZAP Web app penetration testing
Hydra Password brute-forcing
Burp Suite Intercepting proxy for web
attacks
John the Ripper Password cracking
UNIT V – SECURE PROJECT MANAGEMENT
[Placeholder for next update]
