Chapter 23: Vulnerability Analysis Dr. Wayne Summers Department of Computer Science Columbus State University Summers_wayne@colstate.edu http://csc.colstate.edu/summers

Penetration Studies Test for evaluating strengths of all security controls on the computer system (tiger team attack, red team attack) Authorized attempt to violate constraints stated in security policy Layering of Tests External attacker with no knowledge of system External attacker with access to the system Internal attacker with access to the system

Penetration Studies Flaw Hypothesis Methodology Information Gathering Flaw Testing Flaw Generalization Flaw Elimination

Vulnerability Classification Goal of vulnerability analysis is to develop methodologies that provide Ability to specify, design, and implement a computer system without vulnerabilities Ability to analyze a computer system to detect vulnerabilities Ability to address any vulnerabilities introduced during the operation of the computer system Ability to detect attempted exploitations of vulnerabilities

Frameworks Research Into Secure Operating Systems (RISOS) – classified flaws Incomplete parameter validation (buffer overflow) Inconsistent parameter validation Implicit sharing of privileged/confidential data Asynchronous validation/inadequate serialization (race conditions/time-of-check to time-of-use) Inadequate identification/authentication/authorization Violable prohibition/limit (bound conditions) Exploitable logic error

Frameworks Protection Analysis Model (pattern-directed protection evaluation) Improper protection domain initialization and enforcement Improper choice of initial protection domain Improper isolation of implementation detail Improper change Improper naming Improper deallocation or deletion Improper validation Improper sychronization Improper indivisibility Improper sequencing Improper choice of operand / operation

Frameworks NRL Taxonomy Flaws by genesis Intentional Malicious Trojan horse Trapdoor Logic/time bomb Nonmalicious Covert channel Other Unintentional (RISOS taxonomy)

Frameworks NRL Taxonomy Flaws by time of introduction Development Requirement/specification/design Source code Object code Maintenance Operation

Frameworks NRL Taxonomy Flaws by location Software Hardware Operating System System initialization Memory management Process management/scheduling Device management File management Identification/authentication Other/unknown Support Privileged utilities Unprivileged utilities Application Hardware