The Future of the System Development Life Cycle (SDLC)

Andrew Murren

Deloitte & Touche LLP March 10, 2010

What is the Systems Development Life Cycle (SDLC)?

Deloitte & Touche LLP

SDCL Defined

     SDLC is the process of developing information systems through investigation, analysis, design, implementation and maintenance. SDLC is also known as information systems development or application development. SDLC is a systems approach to problem solving and is made up of several phases, each comprised of multiple steps:

The software concept:

Identifies and defines a need for the new system

A requirements analysis:

Analyzes the information needs of the end users

The architectural design:

Creates a blueprint for the design with the necessary specifications for the hardware, software, people and data resources

Coding and debugging:

Creates and programs the final system

System testing:

Evaluates the system's actual functionality in relation to expected or intended functionality. 1 http://www.webopedia.com/TERM/S/SDLC.html

- 3 -

The NIST Systems Development Life Cycle (SDLC)

Initiation Development / Acquisition Implementation / Assessment Operations & Maintenance Disposal A version from the National Institute for Standards and Technology (NIST) 1  defines the phases as:

Initiation:

During the initiation phase, the need for a system is expressed and  the purpose of the system is documented.

Development/Acquisition:

During this phase, the system is designed,  purchased, programmed, developed, or otherwise constructed.

Implementation / Assessment:

After system acceptance testing, the system is installed or fielded. 

Operations & Maintenance:

During this phase, the system performs its work. The system is almost always modified by the addition of hardware and  software and by numerous other events.

Disposal:

Activities conducted during this phase ensure the orderly termination of the system, safeguarding vital system information, and migrating data processed by the system to a new system, or preserving it in accordance with applicable records management regulations and policies. 1 NIST Special Publication 800-64 Revision 2: Security Considerations in the System Development Life Cycle - 4 -

Quiz Time!

Test your knowledge of how vulnerable systems are!

Deloitte & Touche LLP

Question 1

1. About how many new malware signatures were added by Symantec in 4Q2009?

a. Over 1.5 million b. Between 1 million and 1.5 million c. Between 500,000 and 1 million d. Less than 500,000 - 6 -

Question 2

2. According to McAfee in 2009 about how many new zombie computers were created per day in 3Q2009?

a. Over 250,000 b. Between 150,000 and 250,000 c. Between 100,000 and 150,000 d. Less than 100,000 - 7 -

Question 3

3. (ISC) 2 estimated what percentage of security breaches are related to application related?

a. 80% b. 70% c. 60% d. 50% - 8 -

Question 4

4. In February 2010, Security Labs collected and tested more than 30,000 live malicious URL samples against the typical tools of third-party URL lists and anti-virus scanners. How many malicious URLs pass unnoticed through anti-virus scanners and URL filtering, even when these two approaches are used together?

a. Between 50% and 70% b. Between 30% and 50% c. Between 10% and 30% d. Less than 10% - 9 -

Quiz Solutions

Question 1

1. About how many new malicious code signatures were added by Symantec in 4Q2009?

a. Over 1.5 million b. Between 1 million and 1.5 million

c. Between 500,000 and 1 million

d. Less than 500,000 Symantec added 921,143 new malicious code signatures in 4Q2009. - 11 -

Question 2

2. According to McAfee in 2009 about how many new zombie computers were created per day in 3Q2009?

a. Over 250,000

b. Between 150,000 and 250,000

c. Between 100,000 and 150,000 d. Less than 100,000 McAfee estimates that 148,000 New zombie computers created per day and 40 million in the first three quarters of 2009. - 12 -

Question 3

3. (ISC) 2 estimated what percentage of security breaches are related to application related?

a. 80%

b. 70% c. 60% d. 50% (ISC) 2 estimates that 80% of security breaches are due to application. As operating systems become more secure attacks are moving to less secure applications and specifically web applications.

- 13 -

Question 4

4. In February 2010, Security Labs collected and tested more than 30,000 live malicious URL samples against the typical tools of third-party URL lists and anti-virus scanners. How many malicious URLs pass unnoticed through anti-virus scanners and URL filtering, even when these two approaches are used together?

a. Between 50% and 70%

b. Between 30% and 50% c. Between 10% and 30% d. Less than 10% Security Labs found that in the best case scenario 60% passed through filters and scanning. - 14 -

Deloitte & Touche LLP

Quiz Time How did you do?

Key Components to Secure SDLC

Security Architecture and Code Review

         Security Architecture review focuses on indentifying weakness in the design, implementation and security controls of the application, including: Authentication & Authorization Session management Secure communications Sensitive data management (Privacy of information) Parameter validation Configuration management Database access management Exception management Audit Log management - 16 -

Key Components to Secure SDLC (cont)

Security Architecture and Code Review

        Audit Log management Code quality Cache Management, Pooling, and Reuse System Calls Automated line by line review of source code along with manual code reviews Detection of vulnerabilities in security design and/or flaws of the application Identification of security vulnerabilities in the Source code of the application Evaluation of secured application development processes - 17 -

Key Components to Secure SDLC (cont.)

Application Vulnerability Testing

Consists of a controlled security test of the application environment to identify potential external exposures. Application testing includes the following:  Black-box (un-credentialed) and grey-box (credentialed) testing  Insecure configuration Testing (e.g., missing patches, improper file or directory permissions, default accounts, excessive services, unnecessary coding files)  Manipulation testing (e.g., Injection flaws, privilege escalation, insecure direct object reference, cross-site scripting, forceful browsing)   Aggregation Testing (e.g., error messages, support data, legacy code, Developer comments) Iteration Testing (e.g., “brute force” techniques can be used for timing attacks or to bypass session/state management) - 18 -

Source Code Analysis Tools



Ounce 6 -

automatically delivers confirmed vulnerabilities directly to the developer's IDE as part of the SDLC build process. 

Fortify 360 -

integrates source code analysis, program trace analysis and real time analysis to identify the most comprehensive and accurate list of vulnerabilities  

Veracode

- provides code analysis and web application security testing through a software-as-a-service delivery model

Coverity

– offers integrated static and dynamic code analysis, build analysis and architecture analysis - 19 -

Web Application Assessment Tools



IBM AppScan -

automates Web application security assessments. Automatically validates and provides fix advisories for both Common Web Vulnerabilities (CWVs) and application-specific vulnerabilities, such as cross site scripting, and SQL injection 

Nikto -

Web server scanner that performs comprehensive tests, including more than 3,550 potentially dangerous files/CGIs, versions on more than 115 products/CGIs, and reports details on more than 180 products/CGIs.  

Whisker -

CGI scanner.

Web Sphinx -

A fully customizable web crawler that browses and processes Web pages automatically. 

NGS OraScan -

A security tool designed to automate the process of assessing an Oracle web front end and its online applications. - 20 -

What Changes are Happening?

    Virtualization Pervasive, Always On Connectivity Cloud Computing Breakdown of the Traditional Perimeter   Social Networking / Web 2.0

New Laws and Regulations • Privacy • Due Diligence  Increased Sophistication and Capability of Attackers • Criminal Organizations • Government Agencies • Non-Nation/State Political Actors - 21 -

Current SDLC Issues / Trends

 “The most obvious issue is that security defects come in two flavors –

implementation bugs

found at the code level and

architectural flaws

found at the design level. Each of these accounts for roughly half of the defects in practice.

” - Gary McGraw, CTO Cigital  Application breaches today are primarily the result of poor coding, yet security embedded in SDLC processes continues to be an afterthought  Simply maintaining patches on COTS can address a number of vulnerabilities, however, few organizations stay ahead of the curve  Most security groups state that security resources are not involved early and often enough in the SDLC process, yet when asked to participate, security groups do not always dedicate the time/resources required  To address above, organizations are moving towards: • More formalized security integration into SDLC • Code scanning during SDLC process - 22 -

Emerging Security Considerations

 Virtualization • Multiple Virtual Machines (VM) on One Physical Host • Security Zones • Inter-VM communications  Cloud Computing • Trusted Connections • Legal & regulatory compliance of actual hosting location • Shared physical hosts  Embedded & Mobile Applications • Multiple methods of connecting (Bluetooth, IR, Wireless) • Always on  Data Protection • Backup • Data Loss Protection - 23 -

Microsoft’s Security Development Lifecycle (SDL)

The Trustworthy Computing Security Development Lifecycle (or SDL) is the process that Bill Gates announce in Jan 2002 and Microsoft adopted for the development of software after a number of high profile security attacks that embarrassed the company.

It was added on top of Microsoft’s existing SDLC. It is designed for Microsoft’s SDLC and is considered by many smaller organizations too complex and heavy. In Feb 2010 Microsoft released a simpler version for organizations that don’t have the same resources as Microsoft.

Stage 0: Education and Awareness Stage 1: Project Inception Stage 2: Define and Follow Design Best Practices Stage 3: Product Risk Assessment Stage 4: Risk Analysis Stage 5: Creating Security Documents, Tools, and Best Practices for Customers Stage 6: Secure Coding Policies Stage 7: Secure Testing Policies Stage 8: The Security Push Stage 9: The Final Security Review Stage 10: Security Response Planning Stage 11: Product Release Stage 12: Security Response Execution - 24 -

Microsoft’s Changes to their SDLC

  Microsoft’s Trustworthy Computing effort has four major benefits: 1) risk reduction, 2) cost reduction, 3) improved time-to-market, 4) enhanced functionality  Microsoft reduced the number of security incidents by half using their Security Development Lifecycle (SDL) On average, a critical vulnerability costs Microsoft $100k Cost of any defect increase exponentially throughout the SDLC    Unsecured applications raise the operational cost by constantly reacting to operational security issues Security review costs are reduced significantly using SDL

Pre-SDL

Time to market improves after the initial investment  Componentized software security with clearly defined interfaces and guidelines encourages reuse which results in cost savings and faster time to market

Microsoft Research Faculty Summit 2005: The Trustworthy Computing Security Development Lifecycle by Steve Lipner

Post-SDL

- 25 -

Quiz Time Again!

Test your knowledge of some system vulnerabilities!

Deloitte & Touche LLP

Question 1

1. According to Symantec what application was the top target of web attacks in 2009?

a. Microsoft Internet Explorer b. Adobe Acrobat c. Microsoft Movie Maker d.

Mozilla’s Firefox - 27 -

Question 2

2. What percentage of applications evaluated by Veracode got a passing score for security the first time tested?

a. Between 50% and 70% b. Between 30% and 50% c. Between 10% and 30% d. Less than 10% - 28 -

Question 3

3. What is the Number 1 programming error on The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors list?

a. SQL Injection b. Buffer Overflow c. OS Command Injection d. Cross-site Scripting - 29 -

Question 4

4. How much was stolen by cybercriminals from small to medium sized businesses in 3Q2009?

a. Over $20 million b. Between $10 and $20 million c. Between $5 and $10 million d. Less than $5 million - 30 -

Deloitte & Touche LLP

Quiz Solutions

Question 1

1. According to Symantec what application was the top target of web attacks in 2009?

a. Microsoft Internet Explorer

b. Adobe Acrobat

c. Microsoft Movie Maker d.

Mozilla’s Firefox The Acrobat PDF file download vulnerability accounted for 47% of all web attacks. When various attacks against Microsoft IE were combined they accounted for 37% of attacks.

- 32 -

Question 2

2. What percentage of applications evaluated by Veracode got a passing score for security the first time tested?

a. Between 50% and 70%

b. Between 30% and 50%

c. Between 10% and 30% d. Less than 10%    Open Source applications passed 39% Commercial applications passed 38% Internally Developed applications passed 31% Applications were evaluated against the CWE/SANS Top 25 Most Dangerous Programming Errors.

- 33 -

Question 3

3. What is the Number 1 programming error on The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors list?

a. SQL Injection b. Buffer Overflow c. OS Command Injection

d. Cross-site Scripting

CWE-79: Failure to Preserve Web Page Structure ('Cross-site Scripting') “Cross-site scripting (XSS) is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications. “ XSS is an easy to detect and fix design flaw.

     Top 5 were: Cross-site Scripting SQL Injection Classic Buffer Overflow Cross-Site Request Forgery (CSRF) Improper Access Control (Authorization) - 34 -

Question 4

4. How much was stolen by cybercriminals from small to medium sized businesses in 3Q2009?

a. Over $20 million

b. Between $10 and $20 million c. Between $5 and $10 million d. Less than $5 million According to FBI statistics cybercriminals stole over $25 million in the 3Q2009. During the same period traditional bank robberies stole less than $9.5 million.

- 35 -

Deloitte & Touche LLP

Quiz Time Again How did you do?

Models for Securing SDLC

 Microsoft’s Security Development Lifecycle • Adds activities on top of existing SDLC • Used by many large software developers • Can be expensive  Cigital’s Touch Points • Seven activities that can be added into existing SDLC • Designed to be phased in and minimal impact • Adopted by DHS and DoD   The Open Web Application Security Project (OWASP) Comprehensive, Lightweight Application Security Process (CLASP) Set of process pieces that can be integrated into any software development process   Designed to be easy to adopt and effective Freely available for organizations to obtain and adopt - 37 -

Trends in SDLC

 Adopting all or parts of the Secure Development models  Use of Source Code Analysis (SCA) tools such as Fortify and Ounce  Increased Risk Analysis throughout the SDLC  Adding Threat Modeling, Abuse Cases and Security Requirements to the initial design requirements  External reviews  Incorporating Web Application Firewalls and other application layer security devices to the network  Vulnerability Assessments and Penetration Testing as part of the application testing and acceptance  Adding checklists of do’s and don’ts to development policies  Movement to add security assurances to software acquisition contracts - 38 -

Take Aways

 SLDC is the process to develop and maintain software  Applications are now the prime targets of attackers as the OS layer gets more secure  The diffusion of the client environment makes securing applications more critical  Virtualization and Cloud Computing will make designers and developers adapt due to less certainty of the hosting environment  Current network and host based defenses are not enough  Legal issues are becoming increasingly important, with increased visibility by lawyers  Rewards for cyber theft significantly higher than for traditional theft - 39 -

Questions?

Deloitte & Touche LLP