Secure Software Development: Misuse Cases & Checking for Vulnerabilities, Slides of Software Engineering

Download Secure Software Development: Misuse Cases & Checking for Vulnerabilities and more Slides Software Engineering in PDF only on Docsity!

Secure Software Development

Application of Touchpoints

Requirement andUse cases Architectureand Design Test Plans Code (^) Test ResultsTests and Feedback fromthe Field

5. Abuse cases 6. Security Requirements 2. Risk Analysis

External Review

4. Risk-Based Security Tests 1. Code Review (Tools) 2. Risk Analysis 3. Penetration Testing 7. Security Operations

Software Vendor Accountability

• Proper implementation of security features
• Looking for known security flaws
• Passing third party validation
• Source code analysis

Checking for Known Vulnerabilities

• Need tool
• Possible attacks and attack types
• How the software behaves if something goes WRONG
• What motivates an attacker?

Misuse Cases

• Analyze system design and requirements
  • Assumptions
  • Failure of assumptions
  • Attack patterns
• Software that is used also going to be attacked
• What can a bad guy do and how to react to malicious use

Misuse Case Development

• Team work – software developers and security experts
• Identifying and documenting threats
• Creating anti-requirements: how the system can be abused
• Creating attack model
  • Select attack pattern relevant to the system
  • Include anyone who can gain access to the system