1

Security Principles

Software development security principles are guidelines and best practices that help ensure the security of software applications throughout their development life cycle. These principles are essential for protecting sensitive data, preventing security breaches, and maintaining users' trust.

In this chapter, we're going to cover security principles by looking at the following main topics:

• What could go wrong?
• Principles
• Open Web Application Security Project
• NIST's Secure Software Development Framework
• MITRE frameworks
• Software development life cycles
• Microsoft's Security Development Lifecycle
• Confidentiality, integrity, and availability in software development

The goal of the chapter is to give you a good foundation of some secure software terminology along with an understanding of the current state of the practice. We will reference the topics of this chapter in future chapters.

What could go wrong?

Over the past few decades, there have been tens of thousands of successful malicious software security attacks. These include a data attack that affected approximately 40 million Target customers, the Facebook-Cambridge Analytica scandal in 2018, which involved unauthorized access to user data through a third-party app's API, and an XSS scripting attack that, within 20 hours, infected over one million Myspace profiles.

Hundreds of thousands of unintended user mistakes are due to poorly designed or implemented software. These mistakes often go unreported, even though the software or experiment may fail, or humans are harmed. Some examples include NASA's Mars Climate Orbiter, where the spacecraft's navigation software used metric units, while ground control provided data in imperial units. This mismatch resulted in incorrect calculations, causing the orbiter to approach Mars at too low an altitude, ultimately leading to its failure. Another example is Ariane 5's flight 501, where the rocket's inertial reference system software failed due to a data conversion error. The software was reused from the previous Ariane 4 model but proved incompatible with the higher velocity of Ariane 5. This led to a catastrophic failure within 40 seconds of liftoff.

The most well-known error from poorly designed software was the Therac-25 radiation therapy machine, where the software and hardware design flaws in the Therac-25 medical device led to patients receiving massive overdoses of radiation. The software allowed for race conditions, and insufficient testing failed to catch critical errors in the system.

Unintended programmer mistakes often lead to both malicious and unintended software failures. An excellent example is when a programming mistake in the OpenSSL cryptographic software led to the Heartbleed bug. This flaw allowed attackers to read sensitive data from the memory of thousands of web servers, compromising user privacy.

Principles

Software security principles are fundamental guidelines and best practices that help design, develop, and maintain secure software systems. These principles aim to protect software applications and their data from a wide range of threats and vulnerabilities. Here are some fundamental software security principles:

• Least privilege: Give individuals or processes only the minimum access and permissions they need to perform their tasks. This principle reduces the potential for unauthorized access or abuse of privileges.
• Defense in depth: Implement multiple security controls and safeguards layers rather than relying solely on a single security measure. This approach helps to mitigate risks and reduce the impact of security breaches.
• Fail-safe defaults: Configure systems and applications to operate securely by default. Fail-safe defaults mean that if a configuration or access control is not explicitly defined, it should be denied or disabled.
• Input validation: Validate and sanitize all user inputs to prevent injection attacks, such as SQL injection and cross-site scripting (XSS). Input validation helps ensure that data is safe before it's processed.
• Output encoding: Encode data before it is displayed to users. This encoding prevents attacks such as XSS by ensuring potentially malicious input is treated as data, not code.
• Secure data storage: Use strong encryption and access controls to protect sensitive data at rest. This principle includes encrypting data in databases, files, and other storage locations.
• Authentication and authorization: Implement robust authentication mechanisms to verify the identity of users and authorization controls to ensure that users can access only the resources and functionality they are allowed to.
• Session management: Properly manage and secure user sessions to prevent session fixation, session hijacking, and other session-related attacks.
• Secure communication: Use secure protocols such as HTTPS to protect data transmitted between clients and servers.
• Error handling: Implement appropriate error handling and reporting mechanisms to provide minimal information to users while logging detailed error messages for administrators.
• Secure dependencies: Regularly update and patch all software components and libraries to address known vulnerabilities. Ensure that third-party dependencies are secure and up to date.
• Security testing: Conduct thorough security testing, including code reviews, penetration testing, and vulnerability scanning, to identify and remediate security issues in the software.
• Security training and awareness: Promote security awareness among developers, users, and administrators and provide training to ensure they understand and follow security best practices.
• Incident response: Develop a plan to respond to security breaches and minimize their impact effectively.
• Security by design: Consider security from the initial stages of software design and architecture rather than attempting to bolt security onto a finished product.
• Secure development life cycle: Implement a secure software development life cycle (SDLC) incorporating security activities at each development phase, from requirements to deployment.
• Threat modeling: Identify and assess potential threats and vulnerabilities specific to your application, allowing you to address security issues proactively.

These principles provide a foundation for building and maintaining secure software applications. They should be integrated into the development process and adapted to each application's specific requirements and threat landscape. By following these principles, software developers and organizations can reduce the risk of security breaches and protect their applications and users. Next, we will look at a few specific frameworks to see how they tackle these important software security principles.

Open Web Application Security Project

When considering software security principles, you must reference Open Web Application Security Project (OWASP) terminology. OWASP is an online community and organization that focuses on web application security. OWASP is known for its extensive collection of resources and tools related to web application security, which are freely available to the public. The primary goal of OWASP is to improve software security by providing knowledge and tools that help organizations and individuals develop and maintain secure web applications.

Some of the critical activities and resources associated with OWASP include the following:

• Top 10: This is a regularly updated list of the top 10 most critical web application security risks. It serves as a guide for developers and organizations to prioritize their security efforts.
• Projects: OWASP sponsors and supports various open source projects related to web application security. These projects cover various security topics, including secure coding, vulnerability scanning, and penetration testing.
• Web application security testing: OWASP offers guidelines, tools, and resources for testing the security of web applications, helping organizations identify and address vulnerabilities.
• Cheat sheets: These practical guides and checklists provide developers and security professionals with best practices and recommendations for secure coding and...