DOCSLIB.ORG

Sifu - a Cybersecurity Awareness Platform with Challenge Assessment and Intelligent Coach Tiago Espinha Gasiba1* , Ulrike Lechner2 and Maria Pinto-Albuquerque3

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Sifu - a Cybersecurity Awareness Platform with Challenge Assessment and Intelligent Coach Tiago Espinha Gasiba1* , Ulrike Lechner2 and Maria Pinto-Albuquerque3 Espinha Gasiba et al. Cybersecurity (2020) 3:24 Cybersecurity https://doi.org/10.1186/s42400-020-00064-4 RESEARCH Open Access Sifu - a cybersecurity awareness platform with challenge assessment and intelligent coach Tiago Espinha Gasiba1* , Ulrike Lechner2 and Maria Pinto-Albuquerque3 Abstract Software vulnerabilities, when actively exploited by malicious parties, can lead to catastrophic consequences. Proper handling of software vulnerabilities is essential in the industrial context, particularly when the software is deployed in critical infrastructures. Therefore, several industrial standards mandate secure coding guidelines and industrial software developers’ training, as software quality is a significant contributor to secure software. CyberSecurity Challenges (CSC) form a method that combines serious game techniques with cybersecurity and secure coding guidelines to raise secure coding awareness of software developers in the industry. These cybersecurity awareness events have been used with success in industrial environments. However, until now, these coached events took place on-site. In the present work, we briefly introduce cybersecurity challenges and propose a novel platform that allows these events to take place online. The introduced cybersecurity awareness platform, which the authors call Sifu, performs automatic assessment of challenges in compliance to secure coding guidelines, and uses an artificial intelligence method to provide players with solution-guiding hints. Furthermore, due to its characteristics, the Sifu platform allows for remote (online) learning, in times of social distancing. The CyberSecurity Challenges events based on the Sifu platform were evaluated during four online real-life CSC events. We report on three surveys showing that the Sifu platform’s CSC events are adequate to raise industry software developers awareness on secure coding. Keywords: Cybersecurity, Awareness, Training, Artificial intelligence, Serious games, Secure coding, Static application security testing, Capture-the-flag, Software development in industry Introduction was uncovered attacking the petrochemical industry in Over the last years, several attacks that target indus- Saudi Arabia. The industry’s financial impact due to these trial control systems and cyberphysical systems have been and other forms of malware has already exceeded 10 identified. In 2010 Stuxnet, which attacks Programmable billion USD and affected more than 140 countries (Apex- Logic Controllers, was uncovered; in 2014, the Havex mal- techservices 2017). ware, a Remote Access Trojan that contains code targeting The Industrial Control System - Computer Emergency industrial devices communicating over Open Platform Response Team (ICS-CERT (Department of Homeland Communications, was discovered. In the same year, Black- Security 2020a)) has been tasked with issuing ICS-specific Energy V3 attacked the Ukrainian power grid and energy alerts and advisories. Industrial Control Systems (ICS) distribution. More recently, in 2017, the Triton malware, alerts are information put out by the ICS-CERT with which was coined “the world’s most murderous malware”, the intention to provide timely notification to critical infrastructure owners and operators concerning threats or *Correspondence: [email protected] activity with the potential to impact critical infrastructure 1Siemens AG Corporate Technology, Otto-Hahn-Rin 6, 81379 Munich, Bavaria, computing networks.Figure1)showsthenumberofICS Germany alerts and advisories issued per year by the ICS-CERT. Full list of author information is available at the end of the article © The Author(s). 2020 Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. Espinha Gasiba et al. Cybersecurity (2020) 3:24 Page 2 of 23 Fig. 1 ICS-CERT Over the last decade, the number of security advisories Addressing code defects during software development issued per year has been steadily growing. Before 2014 According to Mead et al. (2004), addressing security less than 100 advisories per year have been issued, while vulnerabilities in source code early in the software from 2017 to 2019 more than 200 advisories per year development life-cycle can save many costs. Their work have been issued. These numbers of security advisories presents an empirical model that shows the incurred correlate well with the observed increase in the number costs of fixing software vulnerabilities at the following and sophistication of cyber-attacks to industrial control phases: requirements engineering, architecture, design, systems. implementation, testing, deployment, and operations. According to an estimation by the United States Depart- The validity of this model is corroborated by Black (2004), ment of Homeland Security (DHS), about 90% of the which describes how addressing software defects early in reported security incidents result from exploits against the software development stages (in particular, by early defects in the design or code of software (Department of involvement of the software testing team) can also lead to Homeland Security 2020b). Related to this, a recent large- cost savings. scalestudybyPatelelal.2020 has shown that more than In an industrial setting, due to the requirements 50% of software developers cannot spot vulnerabilities in imposed by standards (e.g. ISO27k 2013, IEC 62443 2018, source code (Schneier 2020). These two factors consid- PCI/DSS 2015, BSI5.21 2014), the requirements engineer- ered together mean that: 1) special care must be exer- ing, architecture and design phases are typically well cov- cised during software development, software developers, ered. The compliance to these standards is checked during and 2) software developers lack awareness about secure industry audits. Recent data (Department of Homeland coding. Security 2020b;Patel2020), however, suggests that soft- Exploitation of low quality software can result in severe ware defects (and vulnerabilities) are being introduced consequences for both customers, companies that pro- when the software is being developed - by software devel- duce the software (or product), and even unrelated third opers - in the implementation stage. In this early software parties. The negative consequences are especially acute development stage, we would like to address the software when the vulnerable software is deployed in critical infras- implementation stage in our work. tructures. In this scenario, the negative consequences can One possible method that can be used to reduce the range from monetary losses to loss-of-life. number of introduced software vulnerabilities is Static The work present aims to improve the current situ- Application Security Testing Tools (SAST) at the software ation utilizing a serious game -that we coined Cyber- implementation stage. However, these have been shown to Security Challenges (CSC)- designed to raise awareness not perform well in detecting security vulnerabilities in the on secure coding, secure coding guidelines, and software source code (Goseva-Popstojanova and Perhinschi 2015), development best practices of software developers in the and consequently, additional mechanisms must be used. industry. This work also presents the Sifu platform, a In our work, we concentrate on the human factor, the soft- software tool developed to implement the CSC serious ware developer, since the software developer ultimately game. writes the software by hand. Espinha Gasiba et al. Cybersecurity (2020) 3:24 Page 3 of 23 For the implementation, there is a vast number of pos- to address a specific need such as learning or improv- sible programming languages. We have decided to focus ing a given skill. Serious games are a well-established our work on the C and C++ programming languages. instrument in information security. They are discussed Our motivation to choose this programming language is in de-facto standards as in the German Federal Office twofold: 1) because this programming language is being for Information Security - IT Baseline Protection (BSI actively (and highly) used in the industry where the first Grundschutzkatalog) (Bundesamt für Sicherheit in der author works as a consultant and 2) a recent study by Informationstechnik 2019; Bundesamt für Sicherheit in WhiteSource (2019) shown that C and C++ are among der Informationstechnik 2020)asameantoraiseIT the most vulnerable programming languages in terms of security awareness and increase the overall level of IT cybersecurity vulnerabilities. security. A Capture-the-Flag (CTF) game is one possible instance Industrial standards and guidelines of a serious game. CTF games were initially developed in In recognition of the importance of secure products and the penetration testing community and are mostly used by a consequence
Load more

Recommended publications
  • Vulnerability Assessment and Secure Coding Practices for Middleware Part 1
    Vulnerability Assessment and Secure Coding Practices for Middleware Part 1 James A. Kupsch Computer Sciences Department University of Wisconsin © 2007-2008, James A. K1upsch. All rights reserved. Tutorial Objectives • Show how to perform the basics of a vulnerability assessment • Create more people doing vulnerability assessments • Show how different types of vulnerabilities arise in a system • Teach coding techniques that can prevent certain types of vulnerabilities • Make your software more secure 2 Roadmap • Part 1: Vulnerability Assessment Process – Introduction – Evaluation process – Architectural analysis – Computer process – Communication channels – Resource analysis – Privilege analysis – Data Flow Diagrams – Component analysis – Vulnerability Discovery Activities • Part 2: Secure Coding Practices 3 Security Problems Are Real Everyone with a computer knows this. If you’re not seeing vulnerability reports and fixes for a piece of software, it doesn’t mean that it is secure. It probably means the opposite; they aren’t looking or aren’t telling. The grid community has been largely lucky (security through obscurity). 4 Many Avenues of Attack We’re looking for attacks that exploit inherent weakness in your system. Internet Firewall: www server Attack web using www protocols Compromised host Internal bad guy 5 Impact of Vulnerabilities FBI estimates computer security incidents cost U.S. businesses $67 billion in 2005 [CNETnews.com] Number of reported vulnerabilities each year is increasing [CERT stats] 8000 6000 4000 2000 0 1994 1998
    [Show full text]
  • Rogue Automation: Vulnerable and Malicious Code in Industrial
    In partnership with Rogue Automation Vulnerable and Malicious Code in Industrial Programming Federico Maggi Marcello Pogliani Trend Micro Research Politecnico di Milano Rogue Automation Vulnerable and Malicious Code in Industrial Programming Published by TREND MICRO LEGAL DISCLAIMER Trend Micro Research The information provided herein is for general information and educational purposes only. It is not intended and should not be construed to constitute legal advice. The information contained herein may not be applicable to all situations and may not reflect the most Written by current situation. Nothing contained herein should be relied on or acted upon without the benefit of legal advice based on the particular facts and circumstances presented and Federico Maggi nothing herein should be construed otherwise. Trend Micro reserves the right to modify Trend Micro Research the contents of this document at any time without prior notice. Marcello Pogliani Translations of any material into other languages are intended solely as a convenience. Politecnico di Milano Translation accuracy is not guaranteed nor implied. If any questions arise related to the accuracy of a translation, please refer to the original language official version of the document. Any discrepancies or differences created in the translation are not binding and With contributions from have no legal effect for compliance or enforcement purposes. Martino Vittone, Although Trend Micro uses reasonable efforts to include accurate and up-to-date Davide Quarta, information herein, Trend Micro makes no warranties or representations of any kind as to Stefano Zanero its accuracy, currency, or completeness. You agree that access to and use of and reliance Politecnico di Milano on this document and the content thereof is at your own risk.
    [Show full text]
  • Web Application Vulnerabilities and Insecure Software Root Causes: the OWASP Top 10
    Vulnerability Analysis, Secure Development and Risk Management of Web 2.0 Applications Marco Morana OWASP OWASP Cincinnati Chapter, November 2010 Meeting Copyright © 2010 - The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License. The OWASP Foundation http://www.owasp.org What is OWASP? OWASP 2 Agenda For Today’s Presentation 1. The Evolution of Web 2.0 2. Web 2.0 Vulnerability Analysis 3. Building Secure Web 2.0 Applications 4. Web 2.0 Risk Management OWASP 3 The Evolution of the Internet to Web 2.0 OWASP 4 General Web 2.0 Background Can be defined as: “Web applications that facilitate interactive information sharing and collaboration, interoperability, and user-centered design on the World Wide Web” … the main characteristics of web 2.0 are: 1. Encourage user’s participation and collaboration through a virtual community of social networks/sites. Users can and add and update their own content, examples include Twitter and social networks such as Facebook, Myspace, LinkedIn, YouTube 2. Transcend from the technology/frameworks used AJAX, Adobe AIR, Flash, Flex, Dojo, Google Gears and others 3. Combine and aggregate data and functionality from different applications and systems, example include “mashups” as aggregators of client functionality provided by different in-house developed and/or third party services (e.g. web services, SaaS) OWASP 5 Web 2.0 As Evolution of Human Knowledge Source http://digigogy.blogspot.com/2009/02/digital-blooms-visual.html
    [Show full text]
  • Write Your Own Rules and Enforce Them Continuously
    Ultimate Architecture Enforcement Write Your Own Rules and Enforce Them Continuously SATURN May 2017 Paulo Merson Brazilian Federal Court of Accounts Agenda Architecture conformance Custom checks lab Sonarqube Custom checks at TCU Lessons learned 2 Exercise 0 – setup Open www.dontpad.com/saturn17 Follow the steps for “Exercise 0” Pre-requisites for all exercises: • JDK 1.7+ • Java IDE of your choice • maven 3 Consequences of lack of conformance Lower maintainability, mainly because of undesired dependencies • Code becomes brittle, hard to understand and change Possible negative effect • on reliability, portability, performance, interoperability, security, and other qualities • caused by deviation from design decisions that addressed these quality requirements 4 Factors that influence architecture conformance How effective the architecture documentation is Turnover among developers Haste to fix bugs or implement features Size of the system Distributed teams (outsourcing, offshoring) Accountability for violating design constraints 5 How to avoid code and architecture disparity? 1) Communicate the architecture to developers • Create multiple views • Structural diagrams + behavior diagrams • Capture rationale Not the focus of this tutorial 6 How to avoid code and architecture disparity? 2) Automate architecture conformance analysis • Often done with static analysis tools 7 Built-in checks and custom checks Static analysis tools come with many built-in checks • They are useful to spot bugs and improve your overall code quality • But they’re
    [Show full text]
  • From Secure Coding to Secure Software
    From Secure Coding to Secure Software Table of Contents From Secure Coding to Secure Software ........................................................................................ 4 Why Software Security? .................................................................................................................. 6 Software and security failures are rampant ................................................................................... 7 Software and security failures are expensive ................................................................................. 8 Polling Question 2 ........................................................................................................................... 9 Engineering and Development ..................................................................................................... 10 Most Vulnerabilities Are Caused by Programming Errors ............................................................ 11 Secure Software Development ..................................................................................................... 12 Sources of Software Insecurity ..................................................................................................... 13 Polling Question 3 ......................................................................................................................... 15 Coding rules – 2016 Edition .......................................................................................................... 17 CWE Guidance ..............................................................................................................................
    [Show full text]
  • Empirical Study of Vulnerability Scanning Tools for Javascript Work in Progress
    Empirical Study of Vulnerability Scanning Tools for JavaScript Work In Progress Tiago Brito, Nuno Santos, José Fragoso INESC-ID Lisbon 2020 Tiago Brito, GSD Meeting - 30/07/2020 Purpose of this WIP presentation ● Current work is to be submitted this year ● Goal: gather feedback on work so far ● Focus on presenting the approach and preliminary results Tiago Brito, GSD Meeting - 30/07/2020 2 Motivation ● JavaScript is hugely popular for web development ○ For both client and server-side (NodeJS) development ● There are many critical vulnerabilities reported for software developed using NodeJS ○ Remote Code Executions (Staicu NDSS’18) ○ Denial of Service (Staicu Sec’18) ○ Small number of packages, big impact (Zimmermann Sec’19) ● Developers need tools to help them detect problems ○ They are pressured to focus on delivering features Tiago Brito, GSD Meeting - 30/07/2020 3 Problem Previous work focused on: ● Tools for vulnerability analysis in Java or PHP code (e.g. Alhuzali Sec’18) ● Studying very specific vulnerabilities in Server-side JavaScript ○ ReDos, Command Injections (Staicu NDSS’18 and Staicu Sec’18) ● Studying vulnerability reports on the NodeJS ecosystem (Zimmermann Sec’19) So, it is still unknown which, and how many, of these tools can effectively detect vulnerabilities in modern JavaScript. Tiago Brito, GSD Meeting - 30/07/2020 4 Goal Our goal is to assess the effectiveness of state-of-the-art vulnerability detection tools for JavaScript code by performing a comprehensive empirical study. Tiago Brito, GSD Meeting - 30/07/2020 5 Research Questions 1. [Tools] Which tools exist for JavaScript vulnerability detection? 2. [Approach] What’s the approach these tools use and their main challenges for detecting vulnerabilities? 3.
    [Show full text]
  • Vulnerabilities, Threats, and Secure Coding Practices
    Vulnerabilities, Threats, and Secure Coding Practices Barton P. Miller Elisa Heymann Computer Sciences Department Computer Sciences Department University of Wisconsin University of Wisconsin [email protected] & Universitat Autònoma de Barcelona [email protected] NSF CyberSecurity Summit 2015 Arlington, August 17 2015 1 What do we do • Assess Middleware: Make cloud/grid software more secure • Train: We teach tutorials for users, developers, sys admins, and managers • Research: Make in-depth assessments more automated and improve quality of automated code analysis http://www.cs.wisc.edu/mist/papers/VAshort.pdf 2 Our History 2001: “Playing Inside the Black Box” paper, first demonstration of hijacking processes in the Cloud. 2004: First formal funding from US NSF. 2004: First assessment activity, based on Condor, and started development of our methodology (FPVA). 2006: Start of joint effort between UW and UAB. 2006: Taught first tutorial at San Diego Supercomputer Center. 2007: First NATO funding, jointly to UAB, UW, and Ben Gurion University. 2008: First authoritative study of automated code analysis tools. 2009: Published detailed report on our FPVA methodology. 2009: U.S. Dept. of Homeland Security funding support. 2012: DHS Software Assurance Marketplace (SWAMP) research center. 3 Our experience includes Condor, University of Wisconsin Batch queuing workload management system 15 vulnerabilities 600 KLOC of C and C++ Google Chrome, Google Web browser 1 vulnerability 2396 KLOC of C and C++ MyProxy, NCSA Credential Management System 5 vulnerabilities
    [Show full text]
  • Software Analysis for Security
    Software Analysis for Security Spiros Mancoridis Department of Computer Science College of Engineering Drexel University Philadelphia, PA 19147, USA E-mail: [email protected] Abstract ware architecture to assure the system’s security. The qual- ity of a security architecture, however, also depends on the This is a survey of the processes, practices, and technolo- security of the applications that constitute the system. In gies that can help software maintenance engineers improve low security operating environments, such as most commer- the security of software systems. A particular emphasis is cial operating systems, it is assumed, albeit optimistically, placed on validating security architectures, verifying that that these applications are trustworthy. Therefore, it is im- the implementation of an architecture’s constituent appli- portant to articulate the practices to support the secure cod- cations adhere to secure coding practices, and protecting ing of applications and the tools for detecting malware. Se- software systems against malicious software. In addition to cure coding involves programming practices and run-time surveying the state-of-the-art, research challenges pertain- mechanisms that can be used to limit the vulnerabilityof ap- ing to software security are posed to the software mainte- plications to dangerous malware that exploit, for example, nance research community. buffer overflows, format string vulnerabilities, and integer vulnerabilities to attack computer systems. One approach to software security is to verify that (a) the security mechanisms used are trustworthy; (b) the security 1. Introduction architecture has been validated against the security policy; and (c) the software applications that constitute the system The goal of computer security is to protect computer as- are trustworthy (e.g., they have been developed using secure sets (e.g., servers, applications, web pages, data) from cor- coding practices, or they are not malware).
    [Show full text]
  • Security Training for Developers
    Security Training for Developers Trusted Advisor for All Your Information Security Needs ® ZERODAYLAB Increasing Cyber Resilience by Coding with the Hacker in Mind Our Security Training for Developers has a simple objective, educating software engineers to reinforce security best practice when developing software to reduce the accidental introduction of security vulnerabilities. By training your development team in the latest secure coding practices, you can bring your overall security costs down by: Reducing the number of incidents Conducting fewer penetration tests and re-tests as fewer vulnerabilities are found Changing the way developers think and increasing their ability to identify other risks Following best practice so that code has fewer bugs overall Using tried-and-tested methods to reduce the need for further corrective coding further down the line and resulting in a faster development cycle. Specialists in Face-to-Face Security Training ZeroDayLab delivers security training courses across the world for staff and management at all levels of an organisation, with or without technical knowledge. Drawn from a wealth of experience from the security projects we deliver for clients every day, we specialise in intensive, face-to-face training with specialist content designed to address the issues your organisation faces. ® ZERODAYLAB Security Training for Developers Security Training for Developers is a comprehensive, on-site training programme based around the 2017 OWASP Top 10. This two-day course will assess, educate and re-test to raise your software engineers’ information security knowledge. As a result, they will develop code with fewer vulnerabilities, expand their knowledge of current threats and tactics and learn hacking techniques.
    [Show full text]
  • Secure Coding Frameworks for the Development of Safe, Secure and Reliable Code
    Building Cybersecurity from the Ground Up Secure Coding Frameworks For the Development of Safe, Secure and Reliable Code Tim Kertis October 2015 The 27 th Annual IEEE Software Technology Conference Copyright © 2015 Raytheon Company. All rights reserved. Customer Success Is Our Mission is a registered trademark of Raytheon Company. Who Am I? Tim Kertis, Software Engineer/Software Architect Chief Software Architect, Raytheon IIS, Indianapolis Master of Science, Computer & Information Science, Purdue Software Architecture Professional through the Software Engineering Institute (SEI), Carnegie-Mellon University (CMU) 30 years of diverse Software Engineering Experience Advocate for Secure Coding Frameworks (SCFs) Author of the JAVA Secure Coding Framework (JSCF) Inventor of Cybersecurity thru Lexical And Symbolic Proxy (CLaSP) technology (patent pending) Secure Coding Frameworks 10/22/2015 2 Top 5 Cybersecurity Concerns … 1 - Application According to the 2015 ISC(2) Vulnerabilities Global Information Security 2 - Malware Workforce Study (Paresh 3 - Configuration Mistakes Rathod) 4 - Mobile Devices 5 - Hackers Secure Coding Frameworks 10/22/2015 3 Worldwide Market Indicators 2014 … Number of Software Total Cost of Cyber Crime: Developers: $500B (McCafee) 18,000,000+ (www.infoq.com) Cost of Cyber Incidents: Number of Java Software Low $1.6M Developers: Average $12.7M 9,000,000+ (www.infoq.com) High $61.0M (Ponemon Institute) Software with Vulnerabilities: 96% (www.cenzic.com) Secure Coding Frameworks 10/22/2015 4 Research
    [Show full text]
  • OWASP Secure Coding Practices Quick Reference Guide
    November 2010 OWASP Secure Coding Practices Quick Reference Guide Copyright and License Copyright © 2010 The OWASP Foundation. This document is released under the Creative Commons Attribution ShareAlike 3.0 license. For any reuse or distribution, you must make clear to others the license terms of this work. http://creativecommons.org/licenses/by-sa/3.0/ Version 2.0 1 November 2010 Table of Contents Introduction .................................................................................................. 3 Software Security and Risk Principles Overview ............................................. 4 Secure Coding Practices Checklist .................................................................. 5 Input Validation: .......................................................................................... 5 Output Encoding: ......................................................................................... 5 Authentication and Password Management: ..................................................... 6 Session Management:.................................................................................... 7 Access Control: ............................................................................................ 8 Cryptographic Practices: ................................................................................ 9 Error Handling and Logging: ......................................................................... 9 Data Protection:...........................................................................................10
    [Show full text]
  • Software Development Guidelines Jan 2019
    SECURE Software Development Guidelines Jan 2019 CONTENT 01 Introduction 02 Secure Software Development 03 Good coding practices 04 Principles of secure code design 05 Examples Secure Software Development Guidelines 2 01 Introduction Introduction Information technology is part of the life-blood The purpose of this presentation is to stand on of modern-day business operations. the shoulders of existing good practices, not Organisations are dependent on reliable and replace recognised ways of secure coding. This secure communications and IT systems. guide provides an overview of good working practices and techniques for assuring the Furthermore, the secure development of development of secure software. software is essential for ensuring the confidentiality, integrity, and availability of It is impractical to eliminate all security information processed within software vulnerabilities. However, by following applications, running upon information recognised good practices, this guide will communication technologies. facilitate changes in behaviours to reduce the likelihood of main security threats. Secure Software Development Guidelines 4 02 Secure Software Development and Standards Overview: Secure Development “Buffer overflows”, “zero-day vulnerabilities”, Secure software development is the art, rather “SQL injection”, are all buzz-words that signify than science, of reducing the likelihood of security problems in software that have systems compromise, given known, common, allowed, for example, a website, or a fat-client insecure development practices. application to become compromised and cracked into by an organised gang, an individual for financial or reputation gain. The sources of these attacks are many and varied (but are explored later on). However what they have in common is an open field to plough and reap financial gain from miss- configured, and insecurely programmed software applications.
    [Show full text]