The CLASP Application Security Process Secure Software, Inc. Copyright (c) 2005, Secure Software, Inc. The CLASP Application Security Process The CLASP Application Security Process TABLE OF CONTENTS CHAPTER 1 Introduction 1 CLASP Status 4 An Activity-Centric Approach 4 The CLASP Implementation Guide 5 The Root-Cause Database 6 Supporting Material 7 CHAPTER 2 Implementation Guide 9 The CLASP Activities 11 Institute security awareness program 11 Monitor security metrics 12 Specify operational environment 13 Identify global security policy 14 Identify resources and trust boundaries 15 Identify user roles and resource capabilities 16 Document security-relevant requirements 17 Detail misuse cases 18 Identify attack surface 19 Apply security principles to design 20 Research and assess security posture of technology solutions 21 Annotate class designs with security properties 22 Specify database security configuration 23 Perform security analysis of system requirements and design (threat modeling) 24 Integrate security analysis into source management process 25 Implement interface contracts 26 Implement and elaborate resource policies and security technologies 27 Address reported security issues 28 Perform source-level security review 29 Identify, implement and perform security tests 30 The CLASP Application Security Process i Verify security attributes of resources 31 Perform code signing 32 Build operational security guide 33 Manage security issue disclosure process 34 Developing a Process Engineering Plan 35 Business objectives 35 Process milestones 35 Process evaluation criteria 35 Form the Process Engineering Team 36 Sample Roadmaps 38 “Green Field” Roadmap 39 Legacy Roadmap 40 CHAPTER 3 Role-based Overviews 41 Project Manager 41 Requirements Specifier 42 Architect 43 Designer 43 Implementor 44 Test Analyst 45 Security Auditor 45 CHAPTER 4 Activities 47 Institute security awareness program 47 Provide security training to all team members 47 Promote awareness of the local security setting 48 Institute accountability for security issues 48 Appoint a project security officer 49 Institute rewards for handling of security issues 50 Monitor security metrics 50 Identify metrics to collect 50 Identify how metrics will be used 53 Institute data collection and reporting strategy 54 Periodically collect and evaluate metrics 55 Specify operational environment 55 ii The CLASP Application Security Process Identify requirements and assumptions related to individual hosts 56 Identify requirements and assumptions related to network architecture 57 Identify global security policy 57 Build a global project security policy, if necessary 57 Determine suitability of global requirements to project 58 Identify resources and trust boundaries 59 Identify network-level design 59 Identify data resources 60 Identify user roles and resource capabilities 61 Identify distinct capabilities 61 Map system roles to capabilities 61 Identify the attacker profile (attacker roles and resources) 62 Document security-relevant requirements 63 Document explicit business requirements 64 Develop functional security requirements 64 Explicitly label requirements that denote dependencies 66 Determine risk mitigations (compensating controls) for each resource 67 Resolve deficiencies and conflicts between requirement sets 68 Detail misuse cases 69 Identify misuse cases 69 Describe misuse cases 70 Identify defense mechanisms for misuse cases 70 Evaluate results with stakeholders 70 Identify attack surface 71 Identify system entry points 71 Map roles to entry points 72 Map resources to entry points 72 Apply security principles to design 72 Refine existing application security profile 72 Determine implementation strategy for security services 73 Build hardened protocol specifications 74 Design hardened interfaces 75 Research and assess security posture of technology solutions 75 Get structured technology assessment from vendor 75 Perform security risk assessment 76 The CLASP Application Security Process iii Receive permission to perform security testing of software 76 Perform security testing 77 Annotate class designs with security properties 77 Map data elements to resources and capabilities 77 Annotate fields with policy information 78 Annotate methods with policy data 78 Specify database security configuration 79 Identify candidate configuration 79 Validate configuration 79 Perform security analysis of system requirements and design (threat modeling) 80 Develop an understanding of the system 80 Determine and validate security-relevant assumptions 80 Identify threats on assets/capabilities 82 Determine level of risk 83 Identify compensating controls 85 Evaluate findings 85 Integrate security analysis into source management process 86 Select analysis technology or technologies 86 Determine analysis integration point 86 Integrate analysis technology 87 Implement interface contracts 88 Implement validation and error handling on function or method inputs 88 Implement validation on function or method outputs 89 Implement and elaborate resource policies and security technologies 89 Review specified behavior 89 Implement specification 89 Address reported security issues 90 Assign issue to investigator 90 Assess likely exposure and impact 90 Determine and execute remediation strategies 91 Validation of remediation 91 Perform source-level security review 92 Scope the engagement 92 Run automated analysis tools 93 Evaluate tool results 93 iv The CLASP Application Security Process Identify additional risks 93 Identify, implement and perform security tests 94 Identify security tests for individual requirements 94 Identify resource-driven security tests 95 Identify other relevant security tests 95 Implement test plan 95 Execute security tests 95 Verify security attributes of resources 96 Check permissions on all static resources 96 Profile resource usage in the operational context 96 Perform code signing 97 Obtain code signing credentials 97 Identify signing targets 97 Sign identified targets 97 Build operational security guide 98 Document pre-install configuration requirements 98 Document application activity 98 Document the security architecture 98 Document security configuration mechanisms 98 Document significant risks and known compensating controls 99 Manage security issue disclosure process 99 Provide means of communication for security issues 99 Acknowledge receipt of vulnerability disclosures 100 Address the issue internally 101 Communicate relevant information to the researcher 101 Provide a security advisory and customer access to remediation 102 CHAPTER 5 Vulnerability Root-Causes 103 Preliminaries 105 Problem types 105 Consequences 106 Exposure period 106 Other recorded information 107 Range and type errors 108 Buffer overflow 108 “Write-what-where” condition 110 Stack overflow 113 The CLASP Application Security Process v Heap overflow 115 Buffer underwrite 117 Wrap-around error 118 Integer overflow 120 Integer coercion error 122 Truncation error 124 Sign extension error 126 Signed to unsigned conversion error 127 Unsigned to signed conversion error 130 Unchecked array indexing 132 Miscalculated null termination 133 Improper string length checking 135 Covert storage channel 138 Failure to account for default case in switch 139 Null-pointer dereference 141 Using freed memory 143 Doubly freeing memory 145 Invoking untrusted mobile code 147 Cross-site scripting 148 Format string problem 149 Injection problem (‘data’ used as something else) 151 Command injection 153 SQL injection 155 Deserialization of untrusted data 158 Environmental problems 160 Reliance on data layout 160 Relative path library search 161 Relying on package-level scope 163 Insufficient entropy in PRNG 164 Failure of TRNG 165 Publicizing of private data when using inner classes 167 Trust of system event data 168 Resource exhaustion (file descriptor, disk space, sockets, ...) 169 Information leak through class cloning 172 Information leak through serialization 174 Overflow of static internal buffer 175 Synchronization and timing errors 176 State synchronization error 176 Covert timing channel 178 Symbolic name not mapping to correct object 180 Time of check, time of use race condition 181 vi The CLASP Application Security Process Comparing classes by name 183 Race condition in switch 184 Race condition in signal handler 186 Unsafe function call from a signal handler 188 Failure to drop privileges when reasonable 190 Race condition in checking for certificate revocation 192 Mutable objects passed by reference 193 Passing mutable objects to an untrusted method 195 Accidental leaking of sensitive information through error messages 196 Accidental leaking of sensitive information through sent data 198 Accidental leaking of sensitive information through data queries 199 Race condition within a thread 200 Reflection attack in an auth protocol 202 Capture-replay 204 Protocol errors 206 Failure to follow chain of trust in certificate validation 206 Key exchange without entity authentication 208 Failure to validate host-specific certificate data 209 Failure to validate certificate expiration 211 Failure to check for certificate revocation 212 Failure to encrypt data 213 Failure to add integrity check value 215 Failure to check integrity check value 217 Use of hard-coded password 219 Use of hard-coded cryptographic key 221 Storing passwords in a recoverable format 223 Trusting self-reported IP address 225 Trusting self-reported DNS name 226 Using referrer field for authentication 228 Using a broken or risky cryptographic