Principle 2:Defense in depth (cont. Example 1:have a firewall and secure web application software, and run web application with minimal privileges Example 2:use OS access control to restrict access to sensitive files,and encrypt them,especially when files are stored on removable media such as USB sticks,laptops,or PCs which might be disposed. Counterexample:on UNIX systems,the password file, /etc/passwd,which contains hashed passwords,was world readable. -Solution:enforce tight access control to the file. Counterexample:having a firewall,and only having firewall -a user bringing in a laptop circumvents firewall Counterexample:firewall unencrypted data within network CSE825 6
CSE825 6 Principle 2: Defense in depth (cont.) Example 1: have a firewall and secure web application software, and run web application with minimal privileges Example 2: use OS access control to restrict access to sensitive files, and encrypt them, especially when files are stored on removable media such as USB sticks, laptops, or PCs which might be disposed. Counterexample: on UNIX systems, the password file, /etc/passwd, which contains hashed passwords, was world readable. ─ Solution: enforce tight access control to the file. Counterexample: having a firewall, and only having firewall ─ a user bringing in a laptop circumvents firewall Counterexample: firewall + unencrypted data within network
Principle 3:Secure failure When systems fail,they should not revert to insecure behavior. Otherwise,attacker only need to invoke the right failure. Incorrect handling of unexpected errors is major cause of security breaches Example:careful handling of exceptions in JAAS (Java Authentication and Authorization Service)module code! isAdmin true;//enter Admin mode try something that may throw SomeException catch(SomeException ex){ /∥should we log? log.write(ex.toString()); /how should we proceed? isAdmin false; /∥or should we exit? } -CSE825 7
CSE825 7 Principle 3: Secure failure When systems fail, they should not revert to insecure behavior. Otherwise, attacker only need to invoke the right failure. Incorrect handling of unexpected errors is major cause of security breaches Example: careful handling of exceptions in JAAS (Java Authentication and Authorization Service) module code! isAdmin = true; // enter Admin mode try { something that may throw SomeException } catch (SomeException ex) { // should we log? log.write(ex.toString()); // how should we proceed? isAdmin = false; // or should we exit? }
Principle 3:Secure failure (cont.) Counterexample:old version software did not use encryption, new version does;for backward compatibility,when new version talks to old version,new version disables encryption. -Attack:when new version talks to new version,attackers can tamper message on the wire to make both think the other is over version. 一 Solution:new version notifies old version to download patches from a secure place that the old version knows. Question:what about old version downloads patches from new version? -Security problem:then new version is not authenticated. Counterexample-Remote Method invocation(RMI) -When a client and server want to communicate over RMI,if the server wants to use an encryption protocol that client does not support,the client downloads the protocol implementation from the server at runtime. Security problem:if the client fails to establish a secure connection(a failure),it will establish a connection using whatever protocol an untrusted entity gives it. CSE825 8
8 Principle 3: Secure failure (cont.) Counterexample: old version software did not use encryption, new version does; for backward compatibility, when new version talks to old version, new version disables encryption. ─ Attack: when new version talks to new version, attackers can tamper message on the wire to make both think the other is over version. ─ Solution: new version notifies old version to download patches from a secure place that the old version knows. ─ Question: what about old version downloads patches from new version? ─ Security problem: then new version is not authenticated. Counterexample - Remote Method invocation (RMI) ─ When a client and server want to communicate over RMI, if the server wants to use an encryption protocol that client does not support, the client downloads the protocol implementation from the server at runtime. ─ Security problem: if the client fails to establish a secure connection (a failure), it will establish a connection using whatever protocol an untrusted entity gives it. CSE825
Principle 4:Least privilege Only the minimum access necessary to perform an operation should be granted,and that access should be granted only for the minimum amount of time necessary. Example:you go vacation,ask a friend to pick up mail Example:U.S.government--the policy of "need to know." Counterexample:famous violations of least privilege exist in UNIX systems (--needs root privilege for running a service on a port number less than 1024) Some e-mail servers is that they don't give up their root permissions once they have grabbed the mail port(Sendmail is a classic example). Counterexample:device drivers having to run in kernel mode Counterexample:Several calls in the Windows API for accessing objects that grant all access if you pass "O"as an argument. -Programmers are lazy. -CSE825 9
CSE825 9 Principle 4: Least privilege Only the minimum access necessary to perform an operation should be granted, and that access should be granted only for the minimum amount of time necessary. Example: you go vacation, ask a friend to pick up mail Example: U.S. government -- the policy of “need to know.” Counterexample: famous violations of least privilege exist in UNIX systems (-- needs root privilege for running a service on a port number less than 1024) ─ Some e-mail servers is that they don't give up their root permissions once they have grabbed the mail port (Sendmail is a classic example). Counterexample: device drivers having to run in kernel mode Counterexample: Several calls in the Windows API for accessing objects that grant all access if you pass "0" as an argument. ─ Programmers are lazy
Principle 4:Least privilege (cont.) In organization don't give everyone access to root passwords -don't give everyone administrator rights On computer -Run process with minimal set of privileges -For example,don't run web application as root or administrator for Java application:not the default policy grant codeBase "ile:$java.ext.dirs)/*"{ permission java.security.AllPermission, but minimum required grant codeBase "file:./forum/*" permission java.security.FilePermission; "/home/forumcontent/*","read/write";}; -CSE825 10
CSE825 10 Principle 4: Least privilege (cont.) In organization ─ don’t give everyone access to root passwords ─ don’t give everyone administrator rights On computer ─ Run process with minimal set of privileges ─ For example, don’t run web application as root or administrator for Java application: not the default policy grant codeBase "file:${{java.ext.dirs}}/*" { permission java.security.AllPermission; }; but minimum required grant codeBase "file:./forum/*" { permission java.security.FilePermission; "/home/forumcontent/*","read/write";};