CISSP Essentials:

Mastering the Common Body of Knowledge

Class 6, Application and

System Development
Lecturer Shon Harris, CISSP, MCSE
President, Logical Security

CISSP Essentials:
Mastering the Common Body of Knowledge

CISSP Essentials Library:

www.searchsecurity.com/CISSPessentials
Class 6 Quiz:
www.searchsecurity.com/Class6quiz
Class 6 Spotlight:
www.searchsecurity.com/Class6spotlight

Applications and system development

objectives
Software flaws
Database concepts and security
issues
Software lifecycle development
processes
Change control concepts
Object-oriented programming
components
Expert systems and artificial
intelligence

Why are we not improving at a higher rate?

Some reasons why implementing security
into software has been lacking

Software vendors are trying to rush to market with their eyes

set on functionality, not security

A majority of security professionals themselves are not

software developers

The computing society is used to receiving software with bugs

and then applying patches to it

Software vendors have not been held liable for insecure code
Programmers are not taught secure coding practices in school

Carnegie Mellon University estimates that there are 5 to 15 bugs in

every 1,000 lines of code.
Windows 2000 has 4060 million lines of code.

Where to implement security

Security within software
development
Security should be planned and

managed throughout the lifecycle of a

system

It should not be added in as an afterthought

or front-end, which is a more time-consuming
and expensive approach

Security should not be kicked to the

back of the bus just because a
deliverable deadline is around the
corner

Focus is usually on functionality, not security

Software development models

They all have these basic
components:

1. Project initiation
2. Functional design analysis

Project
Initiation
Functional
Design

Disposal

and planning

3. System design specifications

4. Software development
Operational
5. Installation/test/implement Maintenance

Project
Development

System
Design

ation

6. Operational/maintenance
7. Disposal

Installation
Test

Software
Development

Agenda
Software development topics
Development tools
Object-oriented programming
concepts

Programming security issues

Distributed computing
Malicious code

New paradigm of coding

Software is written as
components, instead of large
applications on top of a small
operating system

Microsoft Word has over 1,000

components

Only one component of a

browser is the Java Virtual
Machine
Applets run on top of it
Applets actually have plug-ins

Security issues
Complexity of many components being used
together
Much harder to test in all scenarios

In the old paradigm, different pieces of software

communicated with the operating system, so the operating
system could implement the security framework

Tested and secure for one use, but not for a different use

Many components communicate directly to each other today, so the

operating system cannot provide protection

Use of dynamic linking

In the old paradigm, the programmer would link the whole program and
test it
Dynamic linked libraries (DLLs) and shared libraries work at runtime, and
are called from several different sources

Security problems from several different directions

Object-oriented programming
Definition
Non-procedural programming where the emphasis is on data
objects and their manipulation instead of processes.

Benefits
Modularity

Autonomous objects, cooperation through exchanges of messages

Deferred commitment
The internal components of an object can be redefined without changing
other parts of the system

Reusability
Refining classes through inheritance
Other programs using objects

Naturalness
Object-oriented analysis, design and modeling maps to business needs and
solutions

Classes and objects

Classes
Define attributes, characteristics and
behaviors of the objects that will be
instantiated

Allows for a layer of abstraction

Developer does not need to create each and every object

Objects are created from classes when needed

Provides a type of empty template of variables

that will be populated when the object is
instantiated

Objects
Instances of a class
They inherit the attributes, characteristics and
behaviors from their originating class

Modules of code that will actually carry out

some type of functionality

Distributed computing
Data processing taking place on
different systems
Common Object Request Brokers

CORBA, ORB

Distributed Communication Standard

COM, DCOM

Enterprise Java Bean

Distributed communication architecture

Common Object Request Broker Architecture (CORBA)
Architect and specifications for creating, distributing and
managing distributed objects in a distributed network
environment

Allows for interoperability between applications written by

different vendors

Based mainly on standard interfaces

Programming language independent

Over 500 members of the Object Management Group (OMG)

participate by using this architecture

Microsoft does not use this architecture, it uses DCOM

COM architecture
Component Object Model (COM)
The object-oriented programming
model that defines how objects
interact within a single application or
between applications

Client software accesses an object through a

pointer to an interface

Defines APIs

COM component = A binary file

containing code for one or more class
factories, COM classes, Registry-entry
mechanisms, loading code, etc.

Allows for interoperability and

reusability of objects

Programming language independent

Every component has a unique 128bit number called a Globally Unique
Identifier

Mobile code with active content

Active content
Mobile code = transferred from a
host to a client (or another host
computer) to be executed

Active content = software that is

embedded transparently in Web
pages that cause some type of action
to occur

Java applets, JavaScript, ActiveX

controls, macros, executable e-mail
attachments

Extends capabilities and functionality

but can introduce threats

Trojan horses, backdoors, viruses, malicious

code, worms

Java and bytecode

Uses bytecode verifier. When an applet is downloaded, the verifier checks the
code to ensure that it is correctly formatted and does not contain common
errors.

Common Gateway Interface

CGI
A server-side interface for initiating software services.
Specification lets Web servers execute other programs and
incorporate their output into the text, graphics and audio sent to a
Web browser.
CGI is a method of manipulating data passed to a Web site.
Allows for interactive Web sites that process user input
CGI script resides on Web server, not the browser
Security risks are that they use an array of low-level system
commands that can be exploited
The CGI scripts should check for illegal commands before processing

Agenda
Database components
Management system software
Models
Definitions
Security issues
Distributed databases
Data mining

Database model
Model characteristics
Describes relationships between data elements
Used to represent the conceptual organization of data
Formal method of representing information
Database models
Hierarchical
Distributed
Object-oriented
Relational

Agenda
Database security
mechanisms and issues
Concurrency problems
Checkpoints
Trusted front-end
Aggregation
Inference
Views

Artificial intelligence
Expert systems
Refers to computer programs that apply
substantial knowledge of specific areas of
expertise to the problem-solving process

Applications of artificial intelligence techniques to

carry out decision-making tasks based on a
programmed set of rules and logic within specific
subject areas

Systems in which human expertise is conveyed in

the form of rules
Allows the system to diagnose situations without a human
expert being present

Artificial Neural Networks

Artificial Neural Networks (ANN)

Computers whose architecture is modeled

after the brain
They contain neurons called nodes which
are connected together in a network to
simulate a human brain
Algorithms simulating the function of
human neurons may be used for pattern
recognition problems
Has the ability to learn from scenarios

Malware
Virus
MeMe virus
Blended attacks
Remote control
malware
Worm
Logic bomb
Trojan horse
Timing attacks
Side channel attacks

Malware

Virus
A piece of code that requires a host
application to reproduce itself

Virus types

Macro Virus = easy to create because of the simplicity of

the macro language

Boot Sector Virus = malicious code inserted into the disk

boot sector

Compression Virus = when decompressed, it initializes

Polymorphic Virus = makes copies and then changes those

copies in some way uses a mutation engine

Multi-Partite Virus = infects both boot sector and file

system

Self-garbling Virus = modifies own code to elude detection

Stealth Virus = hides its footprints and the changes it has

made

Advanced malware
Blended malware
Using more than one way to
infect and spread malicious
code within networks

Combination of virus, worm

and Trojan horse
technologies

Remote control programs

Many Trojan horses set up
backdoors on systems and
applications that can control
the victim system remotely

Cult of the Dead Cow's Back Orifice

Symantec's pcAnywhere
NetBus
SubSeven

CISSP Essentials:
Mastering the Common Body of Knowledge
Lecturer Shon Harris, CISSP, MCSE
President, Logical Security
www.LogicalSecurity.com
ShonHarris@LogicalSecurity.com

Coming next: Class 7: Business Continuity

Register at the CISSP Essentials Library:

www.searchsecurity.com/CISSPessentials