IAS 402 — Lecture Notes

Network Security

What is threats and vulnerabilities in computer networks?

Types of Attacks in Network Security Threats

• Viruses and Malware: Viruses and malware are malicious software programs that can infect your computer or network and cause serious damage. They can
  delete important files, steal confidential information, or even shut down your entire system.
• SQL Injection Attacks: SQL injection attacks exploit vulnerabilities in web applications that use Structured Query Language (SQL) to communicate with databases. By injecting malicious SQL code into these vulnerable applications, attackers can gain access to sensitive data or even take control of the entire database.
• OnPath Attacks: OnPath attacks occur when an attacker intercepts communication between two parties and impersonates each party to the other. This allows the attacker to eavesdrop on the conversation or modify the data
  being exchanged.
• Password Attacks: Password attacks are common types of network attacks because they are very effective. There are many types of password attacks, but
  some of the most common include brute force attacks, dictionary attacks, and rainbow table attacks (EasyDmarc, 2022).

What Are the Main Types of Security Vulnerability?

Four Main Types of Security Vulnerabilities

• Misconfigurations: Incorrectly configured systems and applications are often the weakest links in an organization’s security posture. A poorly configured firewall in cybersecurity, weak passwords, and leaving default accounts active are all examples of common misconfigurations that can lead to serious security vulnerabilities.
• Unsecured APIs: Many modern applications rely on application programming
  interfaces (APIs) to function properly. However, if APIs are not properly secured, they can be a serious security vulnerability. Attackers can exploit unsecured APIs to gain access to sensitive data or even take control of entire systems.
• Outdated or Unpatched Software: Software vulnerabilities are often the root cause of major security breaches. Outdated software is especially vulnerable, as attackers can exploit known weaknesses that have already been patched in newer versions. Unpatched software is also a major security risk, as many organizations fail to apply critical security updates in a timely manner.
• Zero-Day Vulnerabilities: A zero-day vulnerability is a previously unknown security flaw exploited by attackers before the vendor has patched it. These types of vulnerabilities are extremely dangerous, as there is usually no way to defend against them until after they have been exploited (CrowdStrike, 2022).

Network Intrusion Detection and Prevention Systems

1. Check Point IPS: Checkpoint intrusion prevention systems offer organizations essential security features to protect against evading and sophisticated attackers
2. Palo Alto Networks: Palo Alto Networks is a leading provider of cybersecurity solutions
3. CISCO Secure IPS (NGIPS): Cisco Secure IPS (NGIPS) is a next-generation intrusion prevention system that provides advanced threat protection against attacks
4. Fidelis Network: Fidelis Network is an intrusion detection and prevention system that provides real-time visibility into network traffic
5. Trend Micro Tipping Point IPS: Trend Micro Tipping Point IPS is an intrusion prevention system that provides advanced threat protection against attacks

What Is an Intrusion Detection and Prevention System?

Basic Functions of an IDPS

• Guards technology infrastructure and sensitive data: No system can exist in a silo, particularly in the current era of data-driven businesses. Data is constantly flowing through the network, so the easiest way to attack or gain access to a system is to hide within the actual data. The IDS part of the system is reactive, alerting security experts of such possible incidents. The IPS part of the system is proactive, allowing security teams to mitigate these attacks that may cause financial and reputational damage.
• Reviews existing user and security policies: Every security-driven organization has its own set of user policies and access-related policies for its applications and systems. These policies considerably reduce the attack surface by providing access to critical resources to only a few trusted user groups and systems. Continuous monitoring by intrusion detection and prevention systems ensures that administrators spot any holes in these policy frameworks right away. It
  also allows admins to tweak policies to test for maximum security and efficiency.
• Gathers information about network resources: An IDS-IPS also gives the security team a bird’s-eye view of the traffic flowing through its networks. This helps them keep track of network resources, allowing them to modify a system in case of traffic overload or under-usage of servers.
• Helps meet compliance regulations: All businesses, no matter the industry vertical, are being increasingly regulated to ensure consumer data privacy and security. Predominantly, the first step toward fulfilling these mandates is to deploy an intrusion detection and prevention system.

Types of IDPS

• Network-based intrusion prevention system (NIPS): Network-based intrusion prevention systems monitor entire networks or network segments for malicious traffic. This is usually done by analyzing protocol activity. If the protocol activity matches against a database of known attacks, the corresponding information isn’t allowed to get through. NIPS are usually deployed at network boundaries, behind firewalls, routers, and remote access servers.
• Wireless intrusion prevention system (WIPS): Wireless intrusion prevention systems monitor wireless networks by analyzing wireless networking specific protocols. While WIPS are valuable within the range of an organization’s wireless network, these systems don’t analyze higher network protocols such as transmission control protocol (TCP). Wireless intrusion prevention systems are deployed within the wireless network and in areas that are susceptible to unauthorized wireless networking.
• Network behavior analysis (NBA) system: While NIPS analyze deviations in protocol activity, network behavior analysis systems identify threats by checking for unusual traffic patterns. Such patterns are generally a result of policy violations, malware-generated attacks, or distributed denial of service (DDoS) attacks. NBA systems are deployed in an organization’s internal networks and at points where traffic flows between internal and external networks.
• Host-based intrusion prevention system (HIPS): Host-based intrusion prevention systems differ from the rest in that they’re deployed in a single host. These hosts are critical servers with important data or publicly accessible servers that can become gateways to internal systems. The HIPS monitors the traffic flowing in and out of that particular host by monitoring running processes, network activity, system logs, application activity, and configuration changes.

Intrusion Detection and Prevention System Techniques with Examples

1. Threshold monitoring
The first step of threshold monitoring consists of setting accepted levels associated with each user, application, and system behavior. Examples of metrics that are used during threshold monitoring include the number of failed login attempts, the number of downloads from a particular source, or even something slightly more complicated such as the accepted time of access to a specific resource.
The monitoring system alerts admins and sometimes triggers automated responses when a threshold is crossed. Only having threshold monitoring instead of intrusion detection comes
with its own set of problems. More often than not, the complex infrastructure underlying an organization’s operations and offerings cannot be filtered down to a few metrics. These threshold values also tend to vary as the company’s customer base and services grow. Very stringent implementation of threshold monitoring, in these cases, can cause a lot of false positives. A false positive, in the context of IDP solutions, is when benign activity is identified as suspicious.
2. Profiling
Intrusion detection and prevention systems offer two types of profiling: user profiling and resource profiling.
• User profiling involves monitoring if a user with a particular role or user group only generates traffic that is allowed. For example, only a DevOps user can have access to the cloud server hosting applications. A programmer can only access data in a sandbox server environment. Short-term user profile monitoring allows administrators to view recent work patterns while long-term profiling provides an extended view of resource usage. This comes in handy while creating a baseline for normal behavior and for creating a user role itself.
• Resource profiling measures how each system, host, and application consumes and generates data. An application with a suddenly increased workflow might indicate malicious behavior.
• Executable profiling tells administrators what kind of programs are usually installed and run by individual users, applications, and systems. For example, a host can be running an application that accesses only certain files. Any other file or a rogue database request indicates foul play. This kind of profiling makes it easy to trace malware, ransomware, or Trojan downloaded by mistake.
Sometimes, profiling may make it difficult to interpret overall network traffic and the bumps that come along with it. The sweet spot for profiling lies between profiles that are too broad and allow bad actors and those too narrow, which hinder productivity.

Prevention–level functionalities of IDPS

1. Stopping the attack
Otherwise known as ‘banishment vigilance’, intrusion prevention
systems prevent incidents before they occur. This is done by blocking
users or traffic originating from a particular IP address. It also
involves terminating or resetting a network connection. For example,
when a particular user is scanning data too frequently, it makes sense
to revoke access until these requests have been investigated.
2. Security environment changes
This involves changing security configurations to prevent attacks. An
example is the IPS reconfiguring the firewall settings to block a
particular IP address.
3. Attack content modification
Malicious content can be introduced into a system in various forms.
One way of making this content more benign is to remove the offending
segments. A basic example is removing suspicious-looking attachments in
emails. A more intricate example is repackaging incoming payloads to a
common and pre-designed lot, such as removing unnecessary header
information.

Techniques of IDPS

1. Signature-based detection
A signature is a specific pattern in the payload. This specific pattern can be anything from the sequence of 1s and 0s to the number of bytes. Most malware and cyberattacks come with their own identifiable signature. Another example of a signature is something as simple as the name of the attachment in a malicious email.
The IDP system maintains a database of known malware signatures with signature-based detection. Each time new malware is encountered, this database is updated. The detection system works by checking the traffic payload against this database and alerting when there’s a match.
Signature-based detection obviously cannot work if the malware isn’t previously known. It does not check for the payload’s nature and cannot give administrators information such as the preceding request to a malicious response.
2. Anomaly-based detection
Anomaly detection works on threshold monitoring and profiling. The ‘normal’ behavior of all users, hosts, systems, and applications is configured. Any deviation from this norm is considered an anomaly and alerted for. For example, if an email ID generates hundreds of emails within a few hours, the chances of that email account being hacked are high.
Anomaly detection is better than signature-based detection when considering new attacks that aren’t in the signature database. Creating these baseline profiles takes a lot of time (also known as the ‘training period’). Even then, the rates of false positives may be high, especially in dynamic environments.
3. Stateful protocol analysis
Anomaly detection uses host- or network-specific profiles to determine suspicious activity. Stateful protocol analysis goes one step further and uses the predefined standards of each protocol state to check for deviations.
For example, file transfer protocol (FTP) only allows logins when unauthenticated. Once a session is authenticated, users can view, create, or modify files based on their permissions. This information is part of the FTP protocol definition. The intrusion detection system analyzes if these norms are met. This kind of stateful protocol analysis makes it easy to keep track of the authenticator in each session and subsequent activity associated with this request.
Stateful protocol analysis relies heavily on vendor-driven protocol definitions. The granular nature means that it is also resource-intensive, taking up precious bandwidth while tracking simultaneous sessions. Each of these techniques either ensures the prevention of incoming attacks or helps administrators spot security vulnerabilities in their systems. Most IDP solutions offer a combination of more than one approach.

Best Practices of Intrusion Detection and Prevention System

1. Establish a baseline

2. Define IDP requirements with all stakeholders

• Is the intrusion prevention system a cornerstone of the security setup, or are there a host of other tools such as SIEM and content filtering that can take up some of these responsibilities?
• Is the primary objective of the system to comply with industry regulations?
• Which segments of networks and which hosts must be covered by the system?

3. Integrate multiple IDP techniques

4. Design process to deal with false positives

5. Ensure optimal resource consumption

6. Run simulations regularly to fine-tune

7. Ensure up-to-date information

8. Create backups

9. Design a reliable and available system

10. Secure all IDP components

Web Application Security

Why is web security testing important?

Different Types of Security Tests

1. Dynamic Application Security Test (DAST). This automated application security test is best for internally facing, low-risk applications that must comply with regulatory security assessments. For medium-risk applications and critical applications undergoing minor changes, combining DAST with some manual web security testing for common vulnerabilities is the best solution.
2. Static Application Security Test (SAST). This application security approach offers automated and manual testing techniques. It is best for identifying bugs without the need to execute applications in a production environment. It also enables developers to scan source code and systematically find and eliminate software security vulnerabilities.
3. Penetration Test. This manual application security test is best for critical applications, especially those undergoing major changes. The assessment involves business logic and adversary-based testing to discover advanced attack scenarios.
4. Runtime Application Self Protection (RASP). This evolving application security approach encompasses a number of technological techniques to instrument an application so that attacks can be monitored as they execute and, ideally, blocked in real time.

What features should be reviewed during a web application security test?

• Application and server configuration. Potential defects are related to encryption/cryptographic configurations, Web server configurations, etc.
• Input validation and error handling. SQL injection, cross-site scripting (XSS), and other common injection vulnerabilities are the result of poor input and output handling.
• Authentication and session management. Vulnerabilities potentially resulting in user impersonation. Credential strength and protection should also be considered.
• Authorization. Testing the ability of the application to protect against vertical and horizontal privilege escalations.
• Business logic. These are important to most applications that provide business functionality.
• Client-side logic. With modern, JavaScript-heavy webpages, in addition to webpages using other types of client-side technologies (e.g., Silverlight, Flash, Java applets), this type of feature is becoming more prevalent.

SQL Injection

SQL injection examples

• Retrieving hidden data, where you can modify a SQL query to return additional results.
• Subverting application logic, where you can change a query to interfere with the application's logic.
• UNION attacks, where you can retrieve data from different database tables.
• Examining the database, where you can extract information about the version and structure of the database.
• Blind SQL injection, where the results of a query you control are not returned in the application's responses.

SELECT * FROM products WHERE category = 'Gifts' AND released = 1

• all details (*)
• from the products table
• where the category is Gifts
• and released is 1.

SELECT * FROM products WHERE category = 'Gifts'--' AND released = 1

SELECT * FROM products WHERE category = 'Gifts' OR 1=1--' AND released = 1

Subverting application logic

SELECT * FROM users WHERE username = 'wiener' AND password = 'bluecheese'

SELECT * FROM users WHERE username = 'administrator'--' AND password = ''

Retrieving data from other database tables (UNION)

SELECT name, description FROM products WHERE category = 'Gifts' 

' UNION SELECT username, password FROM users--

Examining the database

SELECT * FROM v$version

SELECT * FROM information_schema.tables

Blind SQL injection vulnerabilities

• You can change the logic of the query to trigger a detectable difference in the application's response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
• You can conditionally trigger a time delay in the processing of the query, allowing you to infer the truth of the condition based on the time that the application takes to respond.
• You can trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel, for example by placing the data into a DNS lookup for a domain that you control.

How to detect SQL injection vulnerabilities

• Submitting the single quote character ' and looking for errors or other anomalies.
• Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses.
• Submitting Boolean conditions such as OR 1=1 and OR 1=2, and looking for differences in the application's responses.
• Submitting payloads designed to trigger time delays when executed within a SQL query, and looking for differences in the time taken to respond.
• Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within a SQL query, and monitoring for any resulting interactions.

SQL injection in different parts of the query

• In UPDATE statements, within the updated values or the WHERE clause.
• In INSERT statements, within the inserted values.
• In SELECT statements, within the table or column name.
• In SELECT statements, within the ORDER BY clause.

SQL injection in different contexts

<stockCheck> <productId> 123 </productId> <storeId> 999 SELECT * FROM information_schema.tables </storeId> </stockCheck>

Second-order SQL injection

Database-specific factors

• Syntax for string concatenation.
• Comments.
• Batched (or stacked) queries.
• Platform-specific APIs.
• Error messages.

How to prevent SQL injection

String query = "SELECT * FROM products WHERE category = '"+ input + 
"'"; Statement statement = connection.createStatement(); ResultSet 
resultSet = statement.executeQuery(query);

PreparedStatement statement = connection.prepareStatement("SELECT * FROM products WHERE category = ?");
statement.setString(1, input);
ResultSet resultSet = statement.executeQuery();

Firewall

How does a firewall work?

Types of Firewalls

1. Packet-filtering firewalls, the most common type of firewall, examine packets and prohibit them from passing through if they don’t match an established security rule set. This type of firewall checks the packet’s source and destination IP addresses. If packets match those of an “allowed” rule on the firewall, then it is trusted to enter the network.
Packet-filtering firewalls are divided into two categories: stateful and stateless. Stateless firewalls examine packets independently of one another and lack context, making them easy targets for hackers. In contrast, stateful firewalls remember information about previously passed packets and are considered much more secure.
While packet-filtering firewalls can be effective, they ultimately provide very basic protection and can be very limited—for example, they can't determine if the contents of the request that's being sent will adversely affect the application it's reaching. If a malicious request that was allowed from a trusted source address would result in, say, the deletion of a database, the firewall would have no way of knowing that. Next-generation firewalls and proxy firewalls are more equipped to detect such threats.
2. Next-generation firewalls (NGFW) combine traditional firewall technology with additional functionality, such as encrypted traffic inspection, intrusion prevention systems, anti-virus, and more. Most notably, it includes deep packet inspection (DPI). While basic firewalls only look at packet headers, deep packet inspection examines the data within the packet itself, enabling users to more effectively identify,
   categorize, or stop packets with malicious data. 
3. Proxy firewalls filter network traffic at the application level. Unlike basic firewalls, the proxy acts an intermediary between two end systems. The client must send a request to the firewall, where it is then evaluated against a set of security rules and then permitted or blocked. Most notably, proxy firewalls monitor traffic for layer 7
   protocols such as HTTP and FTP, and use both stateful and deep packet inspection to detect malicious traffic.
4. Network address translation (NAT) firewalls allow multiple devices with independent network addresses to connect to the internet using a single IP address, keeping individual IP addresses hidden. As a result, attackers scanning a network for IP addresses can't capture specific details, providing greater security against attacks. NAT firewalls are similar to proxy firewalls in that they act as an intermediary between a group of computers and outside traffic.
5. Stateful multilayer inspection (SMLI) firewalls filter packets at the network, transport, and application layers, comparing them against known trusted packets. Like NGFW firewalls, SMLI also examine the entire packet and only allow them to pass if they pass each layer individually. These firewalls examine packets to determine the state of the communication (thus the name) to ensure all initiated communication is only taking place with trusted sources.

Common Types of Gateways

1. Network Gateway: A network gateway is a device or software component that connects a local network (such as a LAN) to another network, typically the Internet. It acts as the point of connection and provides access to external networks by routing traffic between the local network and the external network.
2. Protocol Gateway: A protocol gateway is responsible for translating and facilitating communication between networks that use different protocols. For example, it can convert data from one network protocol to another to enable communication between systems that speak different languages, so to speak.
3. Application Gateway: An application gateway, also known as an application-level gateway or proxy server, is a device or software that provides security and performance-enhancing features for specific applications or protocols. It can inspect application-layer data, enforce security policies, and optimize network traffic for specific applications or services.
4. Firewall Gateway: A firewall gateway is a specialized gateway that enforces security policies and filters network traffic based on predefined rules. It acts as a barrier between networks, inspecting packets and allowing or blocking traffic based on security criteria. Firewalls can be implemented as a standalone device or as part of a larger network gateway.

Firewall/Packet Filtering

How a web application firewall typically works:

1. Traffic Inspection: The WAF sits between the web server and the users, intercepting incoming requests and outgoing responses. It inspects the traffic at the application layer (Layer 7) of the network stack, which allows it to analyze the content of HTTP requests and responses.
2. Rule-Based Filtering: The WAF employs a set of predefined security rules or policies to identify and block malicious traffic. These rules are based on known attack patterns and vulnerabilities. For example, a WAF rule might specify that any request containing a suspicious SQL statement should be blocked.
3. Signature Matching: WAFs often use signature-based detection to identify known attack patterns. They compare the incoming requests against a database of attack signatures and, if a match is found, takeappropriate action, such as blocking or alerting.
4. Behavior Analysis: Some advanced WAFs employ behavioral analysis techniques to identify anomalies and suspicious patterns in web application traffic. By establishing a baseline of normal behavior, the WAF can detect deviations that may indicate an attack, such as a sudden spike in request rate or unusual input patterns.
5. Protection against Specific Vulnerabilities: WAFs are designed to address specific vulnerabilities commonly found in web applications. They provide protection against attacks like XSS, SQL injection, command injection, and directory traversal, among others. WAFs employ techniques like input validation, output encoding, and parameter sanitization to mitigate these vulnerabilities.
6. Positive Security Model: WAFs can also implement a positive security model, where they allow only explicitly permitted requests. By defining acceptable request patterns, the WAF blocks any requests that deviate from these patterns, helping to protect against zero-day attacks and unknown vulnerabilities.
7. Logging and Reporting: WAFs typically generate logs and reports about detected threats, blocked requests, and other security events. These logs can be analyzed to gain insights into attack patterns, aid in incident response, and fine-tune the security policies of the WAF.

Web Application Security Testing and Assessment

Web Application Security Testing Techniques

1. Vulnerability Scanning: This technique involves using automated tools to scan a web application for known vulnerabilities, such as outdated software versions or misconfiguration.
2. Penetration Testing: Also known as ethical hacking, penetration testing involves simulating real-world attacks to identify vulnerabilities in a web application. It typically involves a
   combination of manual and automated techniques to exploit weaknesses and gain unauthorized access.
3. Code Review: In this technique, security experts review the source code of the web application to identify potential security flaws, such as input validation issues, insecure coding practices, or
   vulnerabilities arising from the use of third-party libraries.
4. Security Headers Analysis: This technique involves analyzing the HTTP response headers sent by the web application to ensure they include appropriate security measures, such as Content Security Policy (CSP), Strict Transport Security (HSTS), or Cross-Origin Resource Sharing (CORS) policies.
5. Authentication and Authorization Testing: This technique focuses on evaluating the effectiveness of authentication and authorization mechanisms implemented in the web application, such as password policies, session management, or access control checks.

Software Tools Used for Web Application Security Testing:

1. Burp Suite: A comprehensive web application testing tool that includes features like scanning, intercepting and modifying HTTP requests, and performing manual and automated security testing.
2. OWASP ZAP: An open-source web application security scanner that helps identify vulnerabilities and provides both automated and manual testing capabilities.
3. Acunetix: A web vulnerability scanner that scans and identifies a wide range of security vulnerabilities in web applications, including SQL injection, cross-site scripting (XSS), and more.
4. Nessus: A network vulnerability scanner that can also perform web application scanning to identify vulnerabilities and misconfigurations.
5. Nikto: An open-source web server scanner that tests web servers for known vulnerabilities and configuration issues.
6. Qualys Web Application Scanning: A cloud-based solution that offers automated scanning and detection of web application vulnerabilities.

Code Review

1. Injection Attacks: This includes vulnerabilities like SQL injection, OS command injection, or LDAP injection, where untrusted user input is directly used in code execution without proper validation or
   sanitization.
2. Cross-Site Scripting (XSS): This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, data theft, or defacement.
3. Cross-Site Request Forgery (CSRF): In CSRF attacks, malicious actors trick authenticated users into unknowingly performing unwanted actions on a web application, exploiting the trust between the user and the application.
4. Insecure Direct Object References (IDOR): This occurs when an application exposes internal or sensitive resources directly through user-controlled input, allowing unauthorized access to restricted
   information.
5. Authentication and Session Management Issues: Code review can uncover weaknesses in password storage mechanisms, weak session management practices, or insecure authentication methods.

1. SonarQube: An open-source platform that performs static code analysis and offers security rule sets specifically designed for web application security, helping identify vulnerabilities, code smells, and bugs.
2. Veracode: A commercial tool that supports static code analysis to identify security vulnerabilities, including those specific to web applications, using various programming languages.
3. Checkmarx: A comprehensive source code analysis tool that detects security vulnerabilities in web applications, including those related to the OWASP Top 10.
4. Fortify: A software security suite that includes static code analysis capabilities to identify and mitigate vulnerabilities in web applications during the development lifecycle.
5. ESLint: Although primarily focused on JavaScript code style and quality, ESLint can be configured with security rulesets to catch common security issues and best practices in web application code.
6. Bandit: A Python-focused open-source tool that performs static analysis to identify common security issues in Python applications, including web applications.

• Good: Code review is done in a timely manner, with clear feedback and suggestions for improvement.
• Bad: Code review is done too late or not at all. Feedback is unclear or unhelpful.

Insecure Direct Object References (IDOR)

1. User A logs into the application and is assigned a unique user ID, let's say "12345".
2. User A wants to view their profile information, so they navigate to a URL like: https://example.com/profile?user_id=12345.
3. However, an attacker, User B, notices the pattern of the URL and decides to manipulate it.
4. User B changes the user ID in the URL to a different value, such as "54321": https://example.com/profile?user_id=54321.
5. The application retrieves and displays the profile information
   associated with the modified user ID, allowing User B to access User A's confidential data.

Secure Software Development

SSDF Practices

• Prepare the Organization (PO): Ensure that the organization’s people, processes, and technology are prepared to perform secure software development at the organization level and, in some cases, for individual development groups or projects.
• Protect the Software (PS): Protect all components of the software from tampering and unauthorized access.
• Produce Well-Secured Software (PW): Produce well-secured software with minimal security vulnerabilities in its releases.
• Respond to Vulnerabilities (RV): Identify residual vulnerabilities in software releases and respond appropriately to address those vulnerabilities and prevent similar vulnerabilities from occurring in
  the future.

• Practice: The name of the practice and a unique identifier, followed by a brief explanation of what the practice is and why it is beneficial.
• Task: An action that may be needed to perform a practice.
• Notional Implementation Example: A notional example of types oftools, processes, or other method that could be used to help implement a task. No examples or combination of examples are required, and thestated examples are not the only feasible options.
• Reference: A pointer to an established secure development practice document and its mappings to a particular task.

SSDF Use

Software Security Principles and Secure Coding Practices

What is secure coding?

Session Management

Mobile Device Security and Secure App Development

1. Device encryption: Implementing encryption techniques, such as full-disk encryption, ensures that data stored on the device is protected even if it falls into the wrong hands.
2. Secure lock screen: Encourage users to set a strong passcode, PIN, or biometric authentication (fingerprint or face recognition) to prevent unauthorized access to the device.
3. Regular OS updates: Prompt users to install operating system updates as they often contain security patches that address vulnerabilities discovered over time.
4. App permissions: Ensure that apps request only the necessary permissions and educate users about the importance of reviewing and understanding these permissions before granting access.
5. App reputation and downloads: Encourage users to download apps only from trusted sources, such as official app stores, to minimize the risk of installing malicious or compromised applications.
6. Remote wipe and device tracking: Enable features that allow users to remotely wipe data or track their lost or stolen devices to protect sensitive information.

1. Input validation: Validate and sanitize all user inputs to prevent common security vulnerabilities like SQL injection and cross-site scripting (XSS).
2. Secure authentication: Implement strong authentication mechanisms, such as multi-factor authentication (MFA), to ensure that only authorized users can access the app.
3. Encryption: Use encryption techniques, such as Transport Layer Security (TLS), to secure communication between the app and the server, as well as for storing sensitive data on the device.
4. Secure coding practices: Follow secure coding guidelines and best practices, such as avoiding hardcoded credentials, using secure libraries, and regularly updating dependencies to address known vulnerabilities.
5. Penetration testing: Conduct regular security assessments andpenetration testing to identify and address potential vulnerabilities in the application.
6. User data protection: Implement measures to protect user data, suchas secure storage, encryption, and adherence to data protection regulations like the General Data Protection Regulation (GDPR) orrelevant regional laws.
7. Secure backend infrastructure: Ensure that the backend systemssupporting the app are also secure, with proper access controls,monitoring, and regular security audits.

1. Incorporate the security team from day one.
2. Test, test, and retest.
3. Don’t assume the safety of third-party dependencies.
4. Careful with that API.
5. Think like an attacker.
6. Eliminate attack vectors by minimizing permissions.
7. Be mindful of what’s being stored on a device.
8. Secure data transmission.1

IoT and Industrial Control System (ICS) Security

Security Challenges in IoT and ICS Environments

1. Lack of visibility: With the increasing number of connected devices, it can be difficult to keep track of all devices and their security status.
2. Limited security integration: IoT devices often have limited security features and may not integrate well with existing security systems.
3. Open-source code vulnerabilities: Many IoT devices use open-source code, which can contain vulnerabilities that can be exploited by attackers.
4. Overwhelming data volume: The large amount of data generated by IoT devices can be difficult to manage and secure.
5. Poor testing: IoT devices may not undergo rigorous security testing before being released to the market.
6. Unpatched vulnerabilities: IoT devices may not receive regular security updates, leaving them vulnerable to known exploits.
7. Vulnerable APIs: APIs used by IoT devices may have vulnerabilities that can be exploited by attackers.
8. Weak passwords: Many IoT devices have weak default passwords that are easily guessed by attackers.
9. Software and firmware vulnerabilities: The software and firmware used by IoT devices may contain vulnerabilities that can be exploited by attackers.
10. Insecure communications: Communications between IoT devices and their controllers may not be properly secured, allowing attackers to intercept or alter data.
11. Data leaks from IoT systems: Data collected by IoT devices may be leaked or stolen, compromising the privacy of users.
12. Malware risks: IoT devices can be infected with malware, allowing attackers to take control of the device or steal data.
13. Cyberattacks: IoT devices are vulnerable to various types of cyberattacks, including denial-of-service attacks, man-in-the-middle attacks, and more

Best practices for securing IoT devices:

1. Change default router settings: Make sure to change the default privacy and security settings of your router, as these settings often benefit manufacturers more than you.
2. Disconnect IoT devices when they are not needed: Only connect devices to the internet if they need internet connectivity to function.
3. Pick a strong password and do not overuse it: Use a unique, strong password for every device to prevent hackers from guessing your password.
4. Avoid using Universal Plug and Play: This feature can open up your network to attackers.
5. Keep your software and firmware updated: Regularly update the software and firmware of your IoT devices to patch any known vulnerabilities.

1. Always keep your IoT up to date with the latest software updates.
2. Use encryption as IoT devices collect large swaths of data, which is often the primary target of hackers.
3. Automate security with antivirus software.
4. Keep tabs on all connected devices.
5. Take advantage of authentication tools.
6. Regularly audit actions on your network.
7. Disable unused devices and other entry points

Several best practices for the internet of things that may secure your information moving forward.

1. The Mirai Botnet was used to execute the worst DDoS attack against Internet performance management services provider Dyn back in October 2016. As a result, several websites went offline, including majors like CNN, Netflix, and Twitter¹.
2. Verkada, a cloud-based video surveillance service, was hacked in March 2021¹.
3. The Apache Log4j Vulnerability is one of the most serious IoT vulnerabilities that affects versions 2.0 to 2.14.1 and would allow an unauthenticated user to control the connected system for anything from data theft to cryptomining².

Implement Secure Wireless Infrastructure

• Co-channel interference (CCI) — when two WAPs in close proximity use the same channel, they compete for bandwidth within that channel, as signals collide and have to be re-transmitted.
• Adjacent channel interference (ACI) — channels have only ~5 MHz spacing, but Wi-Fi requires 20 MHz of channel space. When the channels selected for WAPs are not cleanly spaced, the interference pattern creates significant numbers of errors and loss of bandwidth. For example, if two access points within range of one another are configured in the 2.4 GHz band with channels 1 and 6, they will not overlap. If a third access point is added using channel 3, it will use part of the spectrum used by both the other WAPs, and all three networks will suffer from interference.

• Simultaneous Authentication of Equals (SAE)—replaces WPA's 4-way handshake authentication and association mechanism with a protocol based on Diffie-Hellman key agreement.
• Enhanced Open—enables encryption for the open authentication method.
• Updated cryptographic protocols—replaces AES CCMP with the AES Galois Counter Mode Protocol (GCMP) mode of operation. Enterprise authentication methods must use 192-bit AES,
  while personal authentication can use either 128-bit or 192-bit.
• Management protection frames—mandates use of these to protect against key recovery attacks.

Wi-Fi Authentication Methods

WPA2 Pre-Shared Key Authentication

WPA3 Personal Authentication

Wi-Fi Protected Setup

Rogue Access Points and Evil Twins

Dissociation and Replay Attacks

Jamming Attacks

Advanced Persistent Threats (APTs)

What Is an APT Attack?

• Loss of data and intellectual property.
• Infrastructure sabotage.
• Service outage.
• Total site takeovers.

• An APT is more complex than a usual online threat. Attacks require full-time teams to maintain a hidden presence in the target network.
• APTs are not hit-and-run attacks. Once hackers access a network, their goal is to remain inside for as long as possible.
• An APT is mostly a manual attack that does not rely on automation.
• APTs are not a threat to a large pool of targets. Attacks go after a specific company, so each breach has a custom plan that fits only thetarget’s defenses.

What Is the Main Goal of an APT Attack?

• Intellectual property.
• User PII.
• Classified data.
• Infrastructure data.
• Access credentials.
• Sensitive communications.

APT Attack Detection: What Are the Signs of an APT Attack?

APT Attack Lifecycle: The 4 Stages of an APT Attack

• Define the target and the goal of the operation.
• Identify the necessary skills and hire team members.
• Find (or create) the right tools for the job.
• Learn about the target architecture, access controls, and all hardware and software solutions.
• Define how best to engineer the attack.

• Web assets.
• Network resources.
• Authorized human users.

• Advanced exploits of zero-day vulnerabilities.
• Social engineering techniques.
• High-target spear phishing.
• Remote file inclusion (RFI).
• RFI or SQL injections.
• Cross-site scripting (XSS).
• Physical malware infection.
• The exploitation of application weaknesses (especially zero-day bugs).
• Domain Name System (DNS) tunneling.

• Hide from system controls.
• Navigate between network segments.
• Gather sensitive data.
• Monitor network activity.
• Detect new entry points in case existing ones become inaccessible.

How to Prevent an APT Attack

• Preventing backdoor setups.
• Blocking stolen data extraction.
• Identifying suspicious users.

• Command shells (WMI, CMD, and PowerShell) that establish network connections.
• Remote server or network administration tools on non-administrator systems.
• Microsoft Office documents, Flash, or Java incidents that invoke new processes or spawn command shells.