DOCSLIB.ORG

Guidelines on Active Content and Mobile Code

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Guidelines on Active Content and Mobile Code Archived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated below). Archived Publication Series/Number: NIST Special Publication 800-28 Title: Guidelines on Active Content and Mobile Code Publication Date(s): October 2001 Withdrawal Date: March 2008 Withdrawal Note: SP 800-28 is superseded in its entirety by the publication of SP 800-28 Version 2 (March 2008). Superseding Publication(s) The attached publication has been superseded by the following publication(s): Series/Number: NIST Special Publication 800-28 Version 2 Title: Guidelines on Active Content and Mobile Code Author(s): Wayne A. Jansen, Theodore Winograd, Karen Scarfone Publication Date(s): March 2008 URL/DOI: http://dx.doi.org/10.6028/NIST.SP.800-28ver2 Additional Information (if applicable) Contact: Computer Security Division (Information Technology Lab) Latest revision of the SP 800-28 Version 2 (as of June 19, 2015) attached publication: Related information: http://csrc.nist.gov/ Withdrawal N/A announcement (link): Date updated: June ϭ9, 2015 Special Publication 800-28 *XLGHOLQHVRQ$FWLYH&RQWHQW DQG0RELOH&RGH Recommendations of the National Institute of Standards and Technology Wayne A. Jansen NIST Special Publication 800-28 Guidelines on Active Content and Mobile Code Recommendations of the National Institute of Standards and Technology Wayne A. Jansen C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20988-8930 October 2001 U.S. Department of Commerce Donald L. Evans, Secretary Technology Administration Karen H. Brown, Acting Under Secretary of Commerce for Technology National Institute of Standards and Technology Karen H. Brown, Acting Director Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-28 Natl. Inst. Stand. Technol. Spec. Publ. 800-23, 53 pages (Oct. 2001) CODEN: NSPUE2 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. U.S. GOVERNMENT PRINTING OFFICE WASHINGTON: 2001 For sale by the Superintendent of Documents, U.S. Government Printing Office Internet: bookstore.gpo.gov — Phone: (202) 512-1800 — Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001 TABLE OF CONTENTS 7DEOHRI&RQWHQWV Foreword....................................................................................................................................v Executive Summary..................................................................................................................v Introduction............................................................................................................................... 1 Background .............................................................................................................................. 1 Browser Anatomy.............................................................................................................. 3 Server Anatomy ................................................................................................................ 8 Threats.................................................................................................................................... 11 Underlying Issues............................................................................................................ 14 Categories of Threats ..................................................................................................... 16 Technology Related Risks .................................................................................................... 17 PostScript ........................................................................................................................ 19 Portable Document Format ............................................................................................ 20 Java.................................................................................................................................. 20 JavaScript and VBScript ................................................................................................. 22 ActiveX............................................................................................................................. 22 Desktop Application Macros........................................................................................... 24 Plug-ins............................................................................................................................ 25 CGI and Related Interfaces............................................................................................ 26 Safeguards ............................................................................................................................. 27 Security Policy.................................................................................................................27 Risk Analysis and Management..................................................................................... 28 Evaluated Information Technology ................................................................................ 29 Security Audit ..................................................................................................................30 Application Settings......................................................................................................... 30 Version Control................................................................................................................ 31 ,,, TABLE OF CONTENTS Incident Response Handling .......................................................................................... 31 Automated Filters ............................................................................................................ 31 Behavioral Controls......................................................................................................... 32 Readers ........................................................................................................................... 32 Digital Signature .............................................................................................................. 33 Isolation............................................................................................................................ 33 Minimal Functionality....................................................................................................... 34 Least Privilege .................................................................................................................34 Layered and Diverse Defenses...................................................................................... 34 Summary ................................................................................................................................ 35 Terminology............................................................................................................................ 37 On-line Resources ................................................................................................................. 40 References ............................................................................................................................. 41 Annex A – HTTP Request Methods ..................................................................................... 46 Annex B – HTTP Response Status...................................................................................... 46 ,9 FORWARD )RUHZRUG This document provides guidelines for Federal organizations’ acquisition and use of security-related Information Technology (IT) products. These guidelines provide advice to agencies for sensitive (i.e., non-national security) unclassified systems. NIST’s advice is given in the context of larger recommendations regarding computer systems security. NIST developed this document in furtherance of its statutory responsibilities under the Computer Security Act of 1987 and the Information Technology Management Reform Active of 1996 (specifically section 15 of the United States Code (U.S.C.) 278 g-3(a)(5)). This is not a guideline within the meaning of 15 U.S.C. 278 g-3 (a)(3). These
Load more

Recommended publications
  • Chapter 11 Web-Based Information Systems
    Prof. Dr.-Ing. Stefan Deßloch AG Heterogene Informationssysteme Geb. 36, Raum 329 Tel. 0631/205 3275 [email protected] Chapter 11 Web-based Information Systems TP Application Architecture client n Front-end program n interacts with (possibly wide range of) display devices front-end n gathers and validates input, displays output n constructs and forward request (e.g., as a RPC Front-end or asynchronous message) Program è provides device-independence for server n Request controller server n guides the request execution Request Controller n determines required steps, then executes them by invoking transaction servers Transaction Transaction Transaction n usually runs as part of an ACID transaction ... Server Server Server n Transaction server n process that runs application programs doing the actual work of the request DBMS n almost always runs within the scope of an Database Database ACID transaction System System n typically interacts with a DBMS n simple applications can be composed into more complex ones (using local proc. call, TRPC, asynch. messaging, …) DB DB n makes difference to req. controller fuzzy Middleware for Heterogeneous and 2 © Prof.Dr.-Ing. Stefan Deßloch Distributed Information Systems Front-end Program Functions n Gather input and display output (user interaction) n form and menu concepts n user selects a menu item to identify the type of transaction to be executed n front-end program display a (series of) form(s) for gathering input data n input data is validated by the front-end program n goal: avoid calling
    [Show full text]
  • Validators Report
    National Information Assurance Partnership ® TM Common Criteria Evaluation and Validation Scheme Validation Report IBM Global Security Kit (GSKit) 8.0.14 Report Number: CCEVS-VR-VID10394-2011 Dated: 2012-03-06 Version: 1.0 National Institute of Standards and Technology National Security Agency Information Technology Laboratory Information Assurance Directorate 100 Bureau Drive 9800 Savage Road STE 6740 Gaithersburg, MD 20899 Fort George G. Meade, MD 20755-6740 ACKNOWLEDGEMENTS Validation Team Jim Brosey Orion Security Fort Meade, Maryland Jandria S. Alexander Aerospace Fort Meade, Maryland Vicky Ashby The MITRE Corporation McLean, Virginia Evaluation Team Alejandro Masino, Trang Huynh, Courtney Cavness atsec Information Security Corporation Austin, Texas Table of Contents 1. EXECUTIVE SUMMARY ........................................................................................................................................ 4 2. IDENTIFICATION .................................................................................................................................................... 4 3. CLARIFICATION OF SCOPE ................................................................................................................................. 6 3.1. PHYSICAL SCOPE ................................................................................................................................................... 6 3.2. LOGICAL SCOPE ....................................................................................................................................................
    [Show full text]
  • Cen Workshop Agreement Cwa 14722-3
    CEN CWA 14722-3 WORKSHOP August 2004 AGREEMENT ICS 35.240.15 Supersedes CWA 14722-3:2004 English version Embedded financial transactional IC card reader (embedded FINREAD) - Part 3: Functional and Security Specifications This CEN Workshop Agreement has been drafted and approved by a Workshop of representatives of interested parties, the constitution of which is indicated in the foreword of this Workshop Agreement. The formal process followed by the Workshop in the development of this Workshop Agreement has been endorsed by the National Members of CEN but neither the National Members of CEN nor the CEN Management Centre can be held accountable for the technical content of this CEN Workshop Agreement or possible conflicts with standards or legislation. This CEN Workshop Agreement can in no way be held as being an official standard developed by CEN and its Members. This CEN Workshop Agreement is publicly available as a reference document from the CEN Members National Standard Bodies. CEN members are the national standards bodies of Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom. EUROPEAN COMMITTEE FOR STANDARDIZATION COMITÉ EUROPÉEN DE NORMALISATION EUROPÄISCHES KOMITEE FÜR NORMUNG Management Centre: rue de Stassart, 36 B-1050 Brussels © 2004 CEN All rights of exploitation in any form and by any means reserved worldwide
    [Show full text]
  • Part 3: Security Assurance Components
    Common Criteria for Information Technology Security Evaluation Part 3: Security assurance components September 2012 Version 3.1 Revision 4 CCMB-2012-09-003 Foreword This version of the Common Criteria for Information Technology Security Evaluation (CC v3.1) is the first major revision since being published as CC v2.3 in 2005. CC v3.1 aims to: eliminate redundant evaluation activities; reduce/eliminate activities that contribute little to the final assurance of a product; clarify CC terminology to reduce misunderstanding; restructure and refocus the evaluation activities to those areas where security assurance is gained; and add new CC requirements if needed. CC version 3.1 consists of the following parts: Part 1: Introduction and general model Part 2: Security functional components Part 3: Security assurance components Trademarks: UNIX is a registered trademark of The Open Group in the United States and other countries Windows is a registered trademark of Microsoft Corporation in the United States and other countries Page 2 of 233 Version 3.1 September 2012 Legal Notice: The governmental organisations listed below contributed to the development of this version of the Common Criteria for Information Technology Security Evaluation. As the joint holders of the copyright in the Common Criteria for Information Technology Security Evaluation, version 3.1 Parts 1 through 3 (called “CC 3.1”), they hereby grant non- exclusive license to ISO/IEC to use CC 3.1 in the continued development/maintenance of the ISO/IEC 15408 international standard. However, these governmental organisations retain the right to use, copy, distribute, translate or modify CC 3.1 as they see fit.
    [Show full text]
  • Ccdb-2009-03-001
    Supporting Document Mandatory Technical Document Application of Attack Potential to Smartcards March 2009 Version 2.7 Revision 1 CCDB-2009-03-001 Foreword This is a supporting document, intended to complement the Common Criteria version 3 and the associated Common Evaluation Methodology for Information Technology Security Evaluation. Supporting documents may be “Guidance Documents”, that highlight specific approaches and application of the standard to areas where no mutual recognition of its application is required, and as such, are not of normative nature, or “Mandatory Technical Documents”, whose application is mandatory for evaluations whose scope is covered by that of the supporting document. The usage of the latter class is not only mandatory, but certificates issued as a result of their application are recognized under the CCRA. Technical Editor: BSI Document History: V2.7 March 2009 (technical update of rating categories and update on usage of open samples based upon corresponding JIL document version 2.7) V2.5 December 2007 (explicit statements added that the points for identification and exploitation have to be added at the end to achieve the final attack potential value, references updated) V2.3 April 2007 (evaluation time guideline and rules regarding the use of open samples added and updated for use with both CC version 2 and 3) V2.1 April 2006 (classification as mandatory technical document, several updates to the tables) V1.1, July 2002 (draft indicator deleted, references updated, same content as V1.0) General purpose: The security properties of both hardware and software products can be certified in accordance with CC. To have a common understanding and to ensure that CC is used for hardware integrated circuits in a manner consistent with today’s state of the art hardware evaluations, the following chapters provide guidance on the individual aspects of the CC assurance work packages in addition to the Common Evaluation Methodology [CEM].
    [Show full text]
  • Microsoft Windows Common Criteria Evaluation Security Target
    Windows 10, Server 2012 R2 Security Target Microsoft Windows Common Criteria Evaluation Microsoft Windows 10 Microsoft Windows Server 2012 R2 Security Target Document Information Version Number 1 Updated On March 17, 2016 Microsoft © 2016 Page 1 of 97 Windows 10, Server 2012 R2 Security Target This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein. The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs- NonCommercial License (which allows redistribution of the work). To view a copy of this license, visit http://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious.
    [Show full text]
  • Features Enabled on Your Windows Host During Installation Snapcenter Software Soumik Das, Archana August 08, 2021
    Features enabled on your Windows host during installation SnapCenter Software Soumik Das, Archana August 08, 2021 This PDF was generated from https://docs.netapp.com/us- en/snapcenter/install/reference_features_enabled_on_your_windows_host_during_installation.html on September 16, 2021. Always check docs.netapp.com for the latest. Table of Contents Features enabled on your Windows host during installation . 1 Features enabled on your Windows host during installation The SnapCenter Server installer enables the Windows features and roles on your Windows host during installation. These might be of interest for troubleshooting and host system maintenance purposes. 1 Category Feature Web Server • Internet Information Services • World Wide Web Services • Common HTTP Features ◦ Default Document ◦ Directory Browsing ◦ HTTP Errors ◦ HTTP Redirection ◦ Static Content ◦ WebDAV Publishing • Health and Diagnostics ◦ Custom Logging ◦ HTTP Logging ◦ Logging Tools ◦ Request Monitor ◦ Tracing • Performance Features ◦ Static Content Compression • Security ◦ IP Security ◦ Basic Authentication ◦ Centralized SSL Certificate Support ◦ Client Certificate Mapping Authentication ◦ IIS Client Certificate Mapping Authentication ◦ IP and Domain Restrictions ◦ Request Filtering ◦ URL Authorization ◦ Windows Authentication • Application Development Features ◦ .NET Extensibility 4.5 ◦ Application Initialization ◦ ASP.NET 4.5 ◦ Server-Side Includes ◦ WebSocket Protocol • Management Tools ◦ IIS Management Console 2 Category Feature IIS Management Scripts and Tools • IIS Management Service • Web Management Tools .NET Framework 4.5.2 Features • .NET Framework 4.5.2 • ASP.NET 4.5.2 • Windows Communication Foundation (WCF) HTTP Activation45 ◦ TCP Activation ◦ HTTP Activation ◦ Message Queuing (MSMQ) activation Message Queuing • Message Queuing Services Ensure that no other applications uses the MSMQ service that SnapCenter creates and manages. • MSMQ Server Windows Process Activation Service • Process Model Configuration APIs All 3 Copyright Information Copyright © 2021 NetApp, Inc.
    [Show full text]
  • Lecture 28 Scripting Language Used to Create Dynamic Web Pages (Like Perl Open Source)
    PHP A server-side, cross-platform, HTML-embedded Lecture 28 scripting language used to create dynamic Web pages (like Perl open source). We can write PHP code directly into HTML and don’t PHP need to worry about CGI (like Java Server Pages). April 6, 2005 Looks like Perl and knowledge of one can help you understand the other. Web server needs to be configured to parse files with certain extensions (e.g. php or phtml) appropriately. PHP Serve-side Scripting Server-side scripting SSI: Server-side includes: Most CGI tools: very old scripting language write page headers, define layout, etc. mostly provides #include few really dynamic parts, most static PHP: have to write many static print statements complete language Let’s design pages by writing static HTML documents free with pieces of code inside: integrates nicely into Apache, IIS, other servers code is executed at request time pages can take parameters ASP: Active Server Pages Scripting languages come with libraries providing Microsoft version of PHP functions specially designed for Web programming: language is essentially Basic e.g.: URL/parameters manipulations, database gateways, ... JSP: Java Server Pages Java version PHP PHP Most popular third-party module for Apache: <html> code and extensive documentation available from <head><title>PHP Test</title></head> http://www.php.net/ <body><? print(“Hello World!”); ?></body> </html> Pieces of code are enclosed into <?...?> tags Example: <html> <html> <head><title>PHP Test</title></head> <head><title>PHP Test</title></head> <body>Hello World!</body> <body><? print(“Hello World!”); ?></body> </html> </html> 1 Parameter Decoding Parameter Decoding Each PHP script can be invoked as a CGI.
    [Show full text]
  • Validators Report
    National Information Assurance Partnership ® TM Common Criteria Evaluation and Validation Scheme Validation Report SGI Red Hat Enterprise Linux Version 5.1 Report Number: CCEVS-VR-VID10286-2008 Dated: 2008-04-21 Version: 1.0 National Institute of Standards and Technology National Security Agency Information Technology Laboratory Information Assurance Directorate 100 Bureau Drive 9800 Savage Road STE 6740 Gaithersburg, MD 20899 Fort George G. Meade, MD 20755-6740 ACKNOWLEDGEMENTS Validation Team The Aerospace Corporation Columbia, MD Noblis Falls Church, VA atsec Information Security Corporation Austin, TX Table of Contents 1. EXECUTIVE SUMMARY ........................................................................................................................................4 2. IDENTIFICATION ....................................................................................................................................................5 3. SECURITY POLICY .................................................................................................................................................6 3.1. I&A.......................................................................................................................................................................6 3.2. AUDITING ..............................................................................................................................................................6 3.3. DISCRETIONARY ACCESS CONTROL ......................................................................................................................7
    [Show full text]
  • Review on Common Criteria As a Secure Software Development Model
    International Journal of Computer Science & Information Technology (IJCSIT) Vol 4, No 2, April 2012 REVIEW ON COMMON CRITERIA AS A SECURE SOFTWARE DEVELOPMENT MODEL Mehmet Kara 1 1TUBITAK BILGEM UEKAE, Kocaeli, Turkey [email protected] ABSTRACT Standards, models, frameworks and guidelines have been developed for secure software development such as such as Common Criteria, SSE-CMM, Microsoft SDL, OpenSAMM. Current standards and models provide guidance for particular areas such as threat modelling, risk management, secure coding, security testing, verification, patch management, configuration management etc. But there is not a generally accepted model for a secure software development lifecycle. Common Criteria provides objective evaluation methodology to validate that a product satisfies a specified set of security requirements. In this paper Common Criteria secure software development approach is examined and compared with other well known standards and models. KEYWORDS Common Criteria, Secure Software Development, Vulnerability, Confidentiality, Integrity, Availability. 1. INTRODUCTION Software applications are increasingly ubiquitous, heterogeneous, mission-critical and vulnerable to security incidents, so that it is absolutely vital that information systems are properly ensured from the very beginning, due to the potential losses faced by organizations that put their trust in all these information systems and because it is cost-effective and also brings about more robust designs. Therefore, security is among the non-functional requirements which are more seriously taken into account nowadays [1]. Software development process has been continuing for a long time. Characteristic of the first software projects was missed schedules, blown budget, and flawed products. But when we looked to the past there wasn’t a magic solution, a single development, in either technology or management technique, promises magnitude improvement in productivity, in reliability, in simplicity [15].
    [Show full text]
  • 523 Lss 2020 Common Criteria Certification Report Ricoh
    UNCLASSIFIED COMMON CRITERIA CERTIFICATION REPORT RICOH Pro C5300S/C5310S, v.JE-1.00-H 21 December 2020 523 LSS 2020 UNCLASSIFIED TLP:WHITE FOREWORD This certification report is an UNCLASSIFIED publication, issued under the authority of the Chief, Communications Security Establishment (CSE). The Information Technology (IT) product identified in this certification report, and its associated certificate, has been evaluated at an approved evaluation facility established under the Canadian Centre for Cyber Security (CCCS). This certification report, and its associated certificate, applies only to the identified version and release of the product in its evaluated configuration. The evaluation has been conducted in accordance with the provisions of the Canadian CC Scheme, and the conclusions of the evaluation facility in the evaluation report are consistent with the evidence adduced. This report, and its associated certificate, are not an endorsement of the IT product by Canadian Centre for Cyber Security, or any other organization that recognizes or gives effect to this report, and its associated certificate, and no warranty for the IT product by the Canadian Centre for Cyber Security, or any other organization that recognizes or gives effect to this report, and its associated certificate, is either expressed or implied. If your department has identified a requirement for this certification report based on business needs and would like more detailed information, please contact: Contact Centre and Information Services [email protected] | 1-833-CYBER-88 (1-833-292-3788) 2 UNCLASSIFIED TLP:WHITE OVERVIEW The Canadian Common Criteria Scheme provides a third-party evaluation service for determining the trustworthiness of Information Technology (IT) security products.
    [Show full text]
  • Cloud On-Premise Installation: IIS Settings Prerequisites
    Portal > Knowledgebase > Cloud > Cloud On-Premise installation: IIS Settings Prerequisites Cloud On-Premise installation: IIS Settings Prerequisites Scott Kircher - 2020-02-10 - in Cloud Certain settings should be configured in Internet Information Services (IIS) before installing the On-Premise version of AssetCloud or InventoryCloud. 1. This section is for Windows 10. Windows Server users, skip to Step 2. Enable the following features: Open the Programs and Features control panel, then click Windows Features at the left. You can enable most other features with no negative impact. Exception: DO NOT enable WebDAV Publishing. Screenshots are below. .NET Framework 3.5.x (expand and check all boxes) .NET Framework 4.6.2 (or higher) (expand and check all boxes) Internet Information Services, Web Management Tools, IIS Management Console Internet Information Services, World Wide Web Services, Application Development, .NET Extensibility 3.5.x Internet Information Services, World Wide Web Services, Application Development, .NET Extensibility 4.6.2 (or higher) Internet Information Services, World Wide Web Services, Application Development, ASP Internet Information Services, World Wide Web Services, Application Development, ASP.NET 3.5.x Internet Information Services, World Wide Web Services, Application Development, ASP.NET 4.6.2 (or higher) Internet Information Services, World Wide Web Services, Application Development, ISAPI Extensions Internet Information Services, World Wide Web Services, Application Development, ISAPI Filters Internet Information
    [Show full text]