- 3.1 Making Design Decisions
- 3.2 Design Concepts: The Building Blocks for Creating Structures
- 3.3 Design Concepts to Support Performance
- 3.4 Design Concepts to Support Availability
- 3.5 Design Concepts to Support Modifiability
- 3.6 Design Concepts to Support Security
- 3.7 Design Concepts to Support Integrability
- 3.8 Summary
- 3.9 Further Reading
- 3.10 Discussion Questions
This chapter is from the book
This chapter is from the book
This chapter is from the book
3.6 Design Concepts to Support Security
Security is a measure of the system’s ability to protect data and resources from unauthorized access while still providing legitimate access to authorized actors. The most common approaches to characterizing and analyzing security focus on three important characteristics: confidentiality, integrity, and availability (CIA):
Confidentiality is the property that data or services are protected from unauthorized access.
Integrity is the property that data or services are not subject to unauthorized manipulation.
Availability is the property that the system will be there for legitimate use, consistent with its specifications.
The security tactics provide strategies for achieving confidentiality and integrity. We have already discussed availability.
3.6.1 Security Tactics
Secure facilities in the physical world permit only limited access to certain resources (e.g., by building walls, having locked doors and windows, and establishing security checkpoints), have means of detecting intruders (e.g., requiring visitors to wear badges, using motion detectors), have deterrence mechanisms (e.g., armed guards, razor wire), have reaction mechanisms (e.g., automatic locking of doors), and have recovery mechanisms (e.g., off-site backups). These strategies are all relevant to computer-based systems and so lead to our four categories of security tactics: Detect Attacks, Resist Attacks, React to Attacks, and Recover from Attacks, as shown in Figure 3.8.
)
FIGURE 3.8 Security tactics categorization
Within the Detect Attacks category, the tactics are:
Detect intrusion. This tactic compares network traffic or service request patterns within a system to a set of signatures or known patterns of malicious behavior stored in a database.
Detect service denial. This tactic compares the pattern or signature of network traffic coming into a system to historical profiles of known denial-of-service (DoS) attacks.
Verify message integrity. This tactic employs techniques such as checksums or hash values to verify the integrity of messages, resource files, deployment files, and configuration files.
Detect message delivery anomalies. This tactic is used to detect man-in-the-middle attacks. If message delivery times are normally stable, then by checking the amount of time that it takes to deliver or receive a message, it becomes possible to detect suspicious timing behavior. Similarly, abnormal numbers of connections and disconnections may indicate such an attack.
Within the Resist Attacks category, the tactics are:
Identify actors. Identifying actors (users or remote computers) focuses on identifying the source of any external input to the system. Users are typically identified through user IDs. Other systems may be identified through access keys, IP addresses, protocols, ports, or some other means.
Authenticate actors. Authentication means ensuring that an actor is actually who or what it purports to be. Passwords, digital certificates, two-factor authentication, and biometric identification provide means for authentication.
Authorize actors. Authorization means ensuring that an authenticated actor has the rights to access and modify either data or services. This mechanism is usually enabled by providing some access control mechanisms within a system.
Limit access. This tactic involves limiting access to computer resources. Limiting access might mean restricting the number of access points to resources, or restricting the type of traffic that can go through the access points. Both kinds of limits minimize the attack surface of a system.
Limit exposure. This tactic focuses on minimizing the effects of damage caused by a hostile action. It is a passive defense since it does not proactively prevent attackers from doing harm. Limiting exposure is typically realized by reducing the amount of data or services that can be accessed through a single access point, and hence compromised in a single attack.
Encrypt data. Confidentiality is usually achieved by applying some form of encryption to data and to communication. Encryption provides extra protection to persistently maintained or in-transit data beyond that available from authorization.
Separate entities. Separating different entities limits the scope of an attack. Separation within the system can be done through physical separation on different servers attached to different networks, the use of virtual machines, or an “air gap”—that is, by having no electronic connection between different portions of a system.
Validate input. Cleaning and checking input as it is received by a system, or portion of a system, is an important early line of defense in resisting attacks. This is often implemented by using a security framework or validation class to perform actions such as filtering, canonicalization, and sanitization of input.
Change credential settings. Many systems have default security settings assigned when the system is delivered. Forcing the user to change those settings will prevent attackers from gaining access to the system through settings that may be publicly available.
Within the React to Attacks category, the tactics are:
Revoke access. If the system or an administrator believes that an attack is under way, then access can be limited to sensitive resources, even for normally legitimate users and uses.
Restrict login. Repeated failed login attempts may indicate a potential attack. Many systems limit access from a particular computer if there are repeated failed attempts to access an account from that computer.
Inform actors. Ongoing attacks may require action by operators, other personnel, or cooperating systems. Such personnel or systems—the set of relevant actors—must be notified when the system has detected an attack.
Finally, within the Recover from Attacks category, the tactics are:
Audit. We audit systems—that is, keep a record of user and system actions and their effects—to help trace the actions of, and to identify, an attacker. We may analyze audit trails to attempt to prosecute attackers or to create better defenses in the future.
Nonrepudiation. This tactic guarantees that the sender of a message cannot later deny having sent the message and that the recipient cannot deny having received the message.
In addition, all of the availability tactics aid in recovering from attacks.
3.6.2 Security Patterns
Many security patterns have been developed over the years. Here we touch on just two of them, as examples: Intercepting Validator and Intrusion Detection.
3.6.2.1 Intercepting Validator
This pattern inserts a software element—an adapter—between the source and the destination of messages. This approach assumes greater importance when the source of the messages is outside the system.
The most common responsibility of this pattern is to implement the verify message integrity tactic, but it can also incorporate tactics such as detect intrusion and detect service denial, or detect message delivery anomalies.
The benefit of this pattern is that, depending on the specific validator that you create and deploy, this pattern can cover most of the waterfront of the “detect attack” category of tactics, all in one package. The tradeoffs are that, as always, introducing an intermediary exacts a performance price.
Attack vectors change and evolve over time, so this component must be kept up-to-date to ensure that it maintains its effectiveness. This imposes a maintenance obligation on the organization responsible for the system. Of course, this maintenance cost must be paid in any case, if the system is to maintain its level of security.
3.6.2.2 Intrusion Detection
An intrusion prevention system (IPS) is a standalone element whose main purpose is to identify and analyze any suspicious activity. If the activity is deemed acceptable, it is allowed. Conversely, if it is suspicious, the activity is prevented and reported. These systems often implement most of the “detect attacks” and “react to attacks” tactics.
There are some tradeoffs associated with this pattern, however. For example, the patterns of activity that an IPS looks for change and evolve over time, so the patterns database must be constantly updated. Also, systems employing an IPS incur a performance cost. In addition, IPSs are typically created from commercial off-the-shelf components, which might mean that they are not tailored for your specific application.