Software Security Engineering – Part I

The rapid development and expansion of network based applications have changed the computing world in the last decade. However, this overwhelming success has an Achilles’ heel: almost every software controlled system faces threats from potential adversaries both from internal and external users of the highly connected computing systems. These software systems must be engineered with reliable protection mechanisms, while still delivering the expected value of the software to their customers within the budgeted time and cost. The principal obstacle in achieving the above two different but interdependent objectives is that current software engineering processes do notprovide enough support for the software developers to achieve security goals. In this chapter, we reemphasize the principal objectives of both software engineering and security engineering, and strive to identify the major steps of a software security engineering process that will be useful for building secure software systems. Both software engineering and security engineering are ever evolving disciplines, and software security engineering is still in its infancy. This chapter proposes a unification of the process models of software engineering and security engineering in order to improve the steps of the software life cycle that would better address the underlying objectives of both engineering processes. This unification will facilitate the incorporation of the advancement of the features of one engineering process into the other. The chapter also provides a brief overview and survey of the current state of the art of software engineering and security engineering with respect to computer systems.

Security pattern-based system and software engineering (PBSE) approaches aim at building secure software and systems by capturing and reusing artifacts that encapsulate security expert's knowledge called security patterns. In this context, security patterns are selected by developers based on security requirements. On the other hand, security risk management is an iterative approach that consists of: (1) a risk assessment activity for identifying, analyzing and evaluating security risks and (2) a risk treatment activity to mitigate these risks which result in issuing security requirements. Hence, risk management and security PBSE can be used together. In this context, this paper aims at guiding the selection of security patterns in security PBSE based on security risk management results and pattern classification. For illustration purposes, we consider an example of a SCADA (Supervisory Control And Data Acquisition) system.

The interconnection of software engineering and security engineering has been bringing research challenges and opportunities to us. We propose a layered framework for the trust management model of trusted software, including three layers: the application behavior layer, the trust check engineer layer, and the trust policy layer. The multi-layer approach attempts to organize a complex security design into simpler layers that can be evaluated against security requirements. Each layer has its own form of state information and thus each may be modeled.

Secure software engineering has emerged in recent decades by encouraging the idea of software security has to be an integral part of all the phases of the software development lifecycle. As a result, each phase of the lifecycle is associated with security-specific best practices such as threat modeling and static code analysis. It was observed that various artifacts (i.e., security requirements, architectural flaws, bug reports, security test cases) generated as a result of security best practices tend to be segregated. This creates a significant barrier to resolve the security issues at the implementation phase since most of them are originated in the design phase. In order to address this issue, this paper presents a knowledge-modeling based approach to semantically infer the associations between architectural level security flaws and code-level security bugs, which is manually tedious. Threat modeling and static analysis are used to identify security flaws and security bugs, respectively. The case study based experimental results revealed that the architectural level security flaws have a significant impact on originating security bugs in the code level. Besides, the evaluation results confirmed the scalability of the proposed approach to large-scale industrial software products.

Information security is currently considered to be a crucial aspect of systems development. However it has traditionally been considered during the final stages of development, once the main components of the system have been developed and therefore provides solutions which are inappropriate for security integration. Software engineering has traditionally been separated from security engineering, and security issues have not usually been included in software engineering processes, activities, techniques, models, and so on. Furthermore, security engineering has not been aligned with information systems, and has focused rather on the definition of protocols, cryptographic algorithms, access control policies, etc. However, the scientific community is beginning to realize the importance of aligning software engineering and security engineering in order to develop more secure systems. Security in software engineering is a branch of research in which many contributions dealing with security integration from the early development stages have recently appeared. This chapter discusses some of the most interesting contributions in this area, and also provides a summary of our contributions through the development of various research lines dealing with different strategies to integrate security into information systems development as early in the development stages as is possible.

For web-based applications, a security analysis was conducted in order to identify software vulnerabilities and develop a new security assessment model. During such an analysis, the major security vulnerabilities observed in the open web proxy honeypot during the data collection time from February to March 2005 were computer worm attacks in Code Red and Nimda, AWSTAT attacks, unauthorized access request (HTTP error code 403), MS-SQL version overflow attacks, etc. To develop the security assessment model, we extended the generic security model for a single component system to multiple components using the multidimensional Markov process model. The resulting model was applied to the most popular software systems. The software system availability in security is computed using real data, and the mean time to security failure is calculated. This paper not only provides the software vulnerability analysis of the web-based applications, but also details the software security assessment for multiple component systems.

In today’s organizations, a vast amount of existing software systems is insecure, which results in compromised valuable assets and has negative consequences on the organizations. Throughout the years, many attempts have been made to build secure software systems, but the solutions proposed were limited to a few add-on fixes made after implementation and installation of the system.The contribution of the research in this thesis is a software security engineering methodology, called Controlled Security Engineering Process, which provides support to developers when developing more secure software systems by integrating software lifecycle and security lifecycle, and enhancing the control in the engineering process. The proposed methodology implements security in every phase of general software system engineering, i.e., requirement, design, implementation, and testing, as well as operation and maintenance to certify that software systems are built with security in mind.The Controlled Security Engineering Process methodology addresses security problems in the development lifecycle. Construction of a secure software system involves specific steps and activities, which include security requirements specifications of system behavior, secure software design, an analysis of the design, implementation, with secure coding and integration, and operating and maintenance procedures.The methodology incorporates software security patterns and control of the engineering process. The software security patterns can be used as security controls and information sources to demonstrate how a specific security task should be performed or a specific security problem solved. Many patterns can be implemented in an automated way, which can facilitate the work of software engineers.The control of the engineering process provides visibility over the development process. The control assures that authorised developers access legitimate and necessary information and projects’ documents by using authentication, and authorization.To support implementation of automated patterns and provide control over the engineering process, a design of a multi-agent system is provided. The multi-agent system supports implementation of patterns and extracting security information, and provides traceability in the engineering process. The security information is requirements, threats and security mechanisms that are provided by matching project documents, and traceability is achieved by monitoring and logging services.The Controlled Security Engineering Process methodology has been evaluated through interviews with developers, security professionals, and decision makers in different types of organizations but also through a case study which was carried out in an organization.

These days, if you say that you are doing research in the area of computer security you instantly receive attention. Sadly, the same cannot be said of software engineering. But are the two areas really so different? Both seem to be concerned with issues that range from the finely technical to the broadly social and that force us to make difficult tradeoffs among cost, performance, quality, and usability. Both seem to require that we conduct our research in an interdisciplinary context. In the end we realize that fully solving the security problem for ever larger and more complex systems is as intractable as fully solving the traditional software engineering problem.In this talk I will attempt to relate the challenges of security engineering and software engineering, and will argue that security engineering is more of a software engineering problem than many people would like to admit.

Software security factors are quantifiable measures that provide the base for mathematical foundations. These mathematical results help to estimate software security. Analysis of security factors is vital for software as well as a software dependent society. Security factors play a significant role in software security estimation, such as confidentiality, integrity, availability, authentication, authorization etc. Integration of security features must be part of software development life cycle. It is important for security analysts to know what to look for when they analyze software architecture during software security analysis. Therefore, it is highly required to develop such a framework able to identify a set of security factors including its perspectives, the user and environment. Many of the ideas in this paper are derived from approaches developed in the software security and software quality measurement fields.

Understanding how to better elicit, specify, and manage requirements for secure and usable software systems is a key challenge in security software engineering, however, there lacks tool-support for specifying and managing the voluminous amounts of data the associated analysis yields. Without these tools, the subjectivity of analysis may increase as design activities progress. This paper describes CAIRIS (Computer Aided Integration of Requirements and Information Security), a step toward tool-support for usable secure requirements engineering. CAIRIS not only manages the elements associated with task, requirements, and risk analysis, it also supports subsequent analysis using novel approaches for analysing and visualising security and usability. The authors illustrate an application of CAIRIS by describing how it was used to support requirements analysis in a critical infrastructure case study.

The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance.

Software security is an increasingly important aspect of computing; however, it is still addressed as an after thought in too many development efforts. While a variety of approaches have been proposed for security requirements engineering, we find many still lacking with respect to their usability. In this proposal I describe my work in the area of security requirements engineering. SURE, Secure and Usable Requirements Engineering, is a new approach that supports non-security experts in order to specify security requirements from which testing artifacts can be derived. In addition, ASSURE, Automated Support for Secure and Usable Requirements Engineering, a system that implements the SURE technique is presented.

Software security research traditionally focuses on the development of specific offense and defense techniques on software vulnerabilities. Software security techniques are useful in practice only to the extent they can be leveraged to achieve a goal. Different parties-individuals, companies, or nations-implement offensive and defensive techniques as components in holistic systems, and these systems strategically interact with each other. This chapter aims to introduce to the reader cyber autonomy in software security. We will offer a holistic view on this topic by presenting both techniques and tactics in software security. This chapter will introduce the high-level model of cyber autonomy in software security and explain how techniques and tactics co-work in software security, discuss current software security techniques (including vulnerability discovery, exploit generation, vulnerability patching, and vulnerability ricochet) and, once the readers have gained familiarity with the background and the context in software security that serves as the prerequisites for building a game theoretical model, will introduce the autonomous computer security game, which is the core of the chapter.

Security researchers believe that identifying software vulnerabilities is extremely important, and classifying vulnerabilities is a crucial part of software security analysis. This study on Software Vulnerability Assessment aims to make vulnerability risk assessments more objective. Errors in software design can negatively impact the security and reliability of the systems they run on. Researchers have proposed some methodologies when specifying threats, but some methods are not as scalable and flexible as required. We are taking this problem on to attack detection and mitigation during the design time of the software architecture. The proposed method minimizes the threat of software vulnerabilities by embracing an integrated security software vulnerability framework. This paper presents a framework for increasing software security called the secure software Vul-IAA (Identification, Analysis and Assessment) framework. The findings provide an improved understanding of software vulnerabilities and how they can be exploited and thus should help lead to more sophisticated software defenses.

With the dramatic increase in the number of software security problems, a growing body of research in how to integrate security within software development is notable. Many security approaches have appeared to solve security problems by applying a set of activities through Software Development Life Cycle (SDLC). Among the top approaches are McGraw's Touchpoints, Comprehensive Lightweight Application Security Process (CLASP) from Open Web Application Security Project (OWASP) organization, and Microsoft Security Development Lifecycle (SDL). In this paper, we evaluate these three security approaches by discussing their common process, strength, and limitations. Moreover, we discuss why these approaches do not effectively increase software security. Finally, we set the stage for a future framework to enhance and simplify the application of various security activities within the SDLC.