Chapter 10: Software Development Life Cycle

• Software development deals with putting repeatable and predictable processes in place which helps to ensure functionality, cost, quality, and delivery schedule requirements are met. 
• Software Development Life Cycle (SDLC) in general covers the following areas:
• Requirements gathering:
• Answers the "why, what, and for whom" in why do we create this software, what will the software do, and for whom the software will be created?
• In this phase, everyone attempts to understand why the project is needed and what the scope of the project will be. 
• The team examines software's requirements and proposed functionality, brainstorming sessions take place, and obvious restrictions are reviewed. 
• This is where you can evaluate products currently on the market and identify demands that aren't met by current vendors.
• From a security aspect, the following items should be accomplished in this phase:
• Security requirements
• Security risk assessment
• Privacy risk assessment
• Risk-level acceptance
• Design:
• Design in SDLC covers "how" the software will accomplish the goals that are identified.
• The design phase maps theory and reality
• Theory encompasses all the requirements that were identified in previous phases and outlines how the product is actually going to accomplish these requirements.
• Software requirements commonly come in three models:
• Information model (dictates type of information to be processed and how it will be processed)
• Functional model (outlines tasks and functions application needs to carry out)
• Behavioral model (Explains states the application will be in during and after specific transitions take place)
• From a security standpoint, the following items should be accomplished:
• Attack surface analysis:
• Attack surface - what is available to be used by attackers against the product itself.
• Attack surface analysis - identifies and reduces amount of code and functionality accessible to untrusted users. 
• Threat modeling:
• Systematic approach used to understand how different threats could be realized and how a successful compromise could take place.
• Development:
• Development is when the actual programming of the software and the code has to meet specifications laid out in the design phase.
• The software design created in the previous phase (design) is broken down into defined deliverables, and programmers develop code to meet the deliverable requirements. 
• Computer-aided software engineering (CASE):
• Any type of software tool 
• Allows for automated development of software (i.e. program editors, debuggers, code analyzers, version-control mechanisms etc.)
• Testing/Validation:
• We have to validate software to ensure the goals are met and the software works as planned.
• Formal/informal testing should be done as soon as possible.
• Unit testing:
• Start very early in development
• After programmer develops a component (unit of code) it is tested with several different input values in many different situations
• It isolates each part of the software and show that the individual parts are correct 
• Continues throughout development phase
• Different types of testing:
• Unit testings:
• Individual components in a controlled environment where programmers validate structure, logic, and boundary conditions.
• Integration testing:
• Verifying components work together as outlined in design specifications.
• Acceptance testing:
• Ensures code meets customer requirements 
• Regression testing:
• When changes are made to the system, you have to retest it to ensure functionality, performance, and protection.
• Release/maintenance:
• After the software is developed and deployed, you have to ensure that it is properly configured, patched, and monitored. 

• The difference in the software development life cycle and the system development life cycle is how each goal is accomplished. System development life cycle has a focus on operations which the IT department usually follows. Software development life cycle focuses more on design and programming and software engineers and coders usually follow this model. 

Chapter 10: System Development Life Cycle

• A life cycle is a representation of development changes and a project has the following life cycle: initiation, planning, execution and controlling, and closure.
• A system's life cycle consist of the following phases: initiation, acquisition/development, implementation, operation/maintenance, and disposal. 
• The basic components of the system development life cycle:
• Initiation is needed for a new system to be defined
• When the company establishes a need for a specific system
• Answer the questions "What do we need and why do we need it?"
• Primary risk assessment is carried out to develop an initial description of the confidentiality, integrity, and availability requirements of the system.
• the assessment defines the environment in which the system will operate within any identified vulnerabilities.
• Acquisition/development is when a new system is either created or purchased
• "buy" or "build" decision - the organization needs to evaluate ithe need for the system and see if it can be developed in-house or if it needs to be purchased from a vendor.
• Activities that need to take place:
• Requirements analysis
• Formal risk assessment
• Security functional requirements analysis
• Security assurance requirements analysis
• Third-party evaluations
• Security plan
• Security test and evaluation plan
• Implementation is when a new system is installed into production environment
• Before a system can be formally installed within the production environment a certification and accreditation (C&A) processes has to be performed.
• Certification: the technical testing of a system.
• Accreditation: formal authorization given by management to allow a system to operate in a specific environment.
• Operation/maintenance is when the system is used and cared for
• Within the implementation phase, baselines were set pertaining to the system's hardware, software, and firmware configuration.
• In the operation/maintenance phase, continuous monitoring needs to take place to ensure that the baselines are always met. 
• Disposal is when the system is removed from the production environment
• Disposal activities need to ensure that orderly termination of systems that no longer provide a needed function can take place and all the necessary data are preserved.

Chapter 10: Different Environments Demand Different Security 

Environment vs. Application

• Software controls can be implemented by the operating system or by the application, but usually its a combination of both.
• Application controls and database management controls are specific to their needs and security compromises they understand.
• Application:
• Application protects data by allowing only certain types of inputs and not permitting certain users to view data kept in sensitive database fields.
• It does not protect against users inserting bogus data into Address Resolution Protocol (ARP) table.
• The downsides to relying mainly on operating system controls:
• Although they can control a subject's access to different objects and restrict the actions of that subject within the system, they do not necessarily restrict the subject's actions within an application.  
•  In other words, if an application has a security vulnerability within its own programming code, it is hard for the operating system to predict and control this vulnerability. 

Functionality vs. Security

• Trying to account for all the "what-ifs" and programming with caution can reduce the overall functionality of the application.
• You have to balance functionality and security but in the development world functionality is more important. 
• Each module of the system should be capable of being tested individually and in concert with other modules so the product can be more secure because flaws could be exploited early on.

Implementation and Default Issues

• Most security has to be configured and turned on after installation.
• Settings have to be configured to properly integrate it into different environments.
• When a security application or device is installed, it should default to "No Access" because when a user installs a packet-filter firewall, it should not allow any packets to pass into the network that were not specifically granted access.
• A fine balance exists between security, functionality, and user-friendliness.
• A user-friendly application requires a lot of extra coding for potential user errors, dialog boxes, wizards, and step-by-step instructions, this could result in bloated codes that can create unforeseeable compromises because of extra coding. 
• Various servers are enabled when a system is installed.
• Implementation errors and misconfigurations are common items that cause a majority of security issues in network environments. 

Chapter 10: Software Development Security

• To help implement security into a software you have to understand the security needs of a piece of software, implement the right controls and mechanisms, thoroughly test the mechanisms and how they integrate into the application, follow structured development methodologies, and provide secure and reliable distribution methods. 
• Today, network and security administrations are having to integrate different applications and computer systems to keep up with their company's demand for expandable functionality.
• The usual trend of dealing with security, figure 10-1 from CISSIP All-in-One Exam Guide:
  

Chapter 9: Complexities in Cybercrime- International Issues

• Council of Europe (CoE) Convention on Cybercrime:
• Is an example to create a standard international response to cybercrime.
• It is the first international treaty seeking to address computer crimes by coordinating national laws and improving investigative techniques and international cooperation.
• Objectives include:
• Creating a framework for establishing jurisdiction and extradition of the accused
• Organization for Economic Co-operation and Development (OECD):
• Global organization that move data across other country boundaries must be aware and follow the Organization for Economic Co-operation and Development (OECD).
• The OECD is an international organization that helps different governments come together and tackle the economic, social, and governance challenges of a globalized economy. 
• The OECD came up with guidelines for various countries to follow so that data are properly protected and everyone follows the same types of rules.
• The core principles defined by the OECD are as follows:
• Collection of personal data should be limited, obtained by lawful and fair means, and with the knowledge of the subject.
• Personal data should be kept complete and current, and be relevant to the purposes for which it is being used.
• Subjects should be notified of the reason for the collection of their personal information at the time that it is collected, and organizations should only use it for that stated purpose.
• Only with the consent of the subject or by the authority of law should personal data be disclosed, made available, or used for purposes other then those previously stated.
• Reasonable safeguards should be put in place to protect personal data against risks such as loss, unauthorized access, modification, and disclosure.
• Developments, practices, and policies regarding personal data should be openly communicated. In addition, subjects should be able to easily establish the existence and nature of personal data, its use, and the identity and usual residence of the organization in possession of that data.
• Subjects should be able to find out whether an organization has their personal information and what that information is, to correct erroneous data, and to challenge denied request to do so.
• Organizations should be accountable for complying with measures that support the previous principles.

Chapter 9: Complexities in Cybercrime - The Evolution of Attack

• Advanced Persistent Threat (APT)
• APT differs from regular attackers in that it is a common group of attackers, not just one hacker, which combine knowledge and abilities to carry out whatever exploit that will get them into the environment they seek.
• APT are focused and motivated to aggressively and successfully penetrate a network with variously different attack methods.
• This type of attack is coordinated by human involvement, rather then various types of threats that goes through automated steps to inject its payload.
• The APT has specific goals and is commonly highly organized and well funded, this makes it the biggest threat of all. 
• An APT is commonly custom-developed malicious code that is build specifically for its target, it has multiple ways of hiding itself once it infiltrates the environment, may be able to polymorph itself in replication capabilities, and has several different "anchors" so eradicating it is difficult if it is discovered. 
• The attacker put the code through barrage of tests against the most up-to-date detection applications on the market so APT infiltrations are usually very hard to detect with host-based solutions. 

Chapter 9: Complexities in Cybercrime

• Most hackers never get caught because there aren't enough investigators to investigate the attack and the individuals who actually investigate the crime are behind in their abilities and expertise compare to the hacker. 
• Within the United States, local law enforcement departments, the FBI, and the Secret Service investigate computer crimes.
• Also, hackers hide their identity by using innocent people's computers to cary out the brimes for them. The attacker install malicious software on a computer that stays dormant until the attacker tells it what system to attack and when.
• Zombies are the compromised systems.
• Bots are the software installed on the zombies.
• Botnet is a term to describe several compromised systems.
• You can visit www.cybercrime.gov to find all the current and pass prosecuted cyber crimes that have taken place int he United States.