Security Principles Ian Kayne For School of Computer Science, University of Birmingham 17th November 2008

Welcome Introductions Aim and subject matter Real world, industry examples What you would like to gain Q&A at the end NB: Some slides have been deleted from this version of the presentation. 4/7/2019

The Basics What is security? 4/7/2019

The Basics What is not security? A little hint: Why are firewalls, IDS, content scanners etc not security? A little hint: 4/7/2019

The Basics The Sony PSP – ultimate security? Closed platform Proprietary hardware Proprietary media (UMD) – “almost” Code signing Tight controls on devkits 4/7/2019

The Basics Insecure! LibTIFF GTA – missing a culture of security Not just once, repeatedly over years LibTIFF Widely distributed library Cross-platform security flaw GTA – missing a culture of security 3rd party company: “It’s only a game” 4/7/2019

Culture QA can’t find flaws that aren’t normal user experience One mistake cost £millions? Broke Sony’s business model Required new release of game & firmware Enabled piracy End-user desire (homebrew) won 4/7/2019

The Basics What is security? Firewalls, IDS etc are tech enablers Process Mindset Buy-in from day one Culture Firewalls, IDS etc are tech enablers Without a secure approach they’re useless 4/7/2019

The Basics UK Government Comparison: Number of laptop & USB stick losses –v– “proper hacks” Encryption is available but not used Strong, clear guidelines ignored Security: “someone else’s problem”, putting CDs in the post is fine Missing a culture of security 4/7/2019

In The Real World It’s not that easy Security is a balancing act: Security –v– cost Security –v– delivery Security –v– functionality Security –v– corporate politics Security –v– ………… Day 1 buy-in helps to mitigate 4/7/2019

In The Real World Security demands: Communication Early Involvement Empathy Pragmatism (Don’t forget the technical skills!) Most security teams/professionals don’t sit in ivory towers 4/7/2019

(Finding holes in the security culture) Pentesting PENETRATION TESTING (Finding holes in the security culture) 4/7/2019

Pen Testing Penetration Testing Very different to consultancy Not like the movies! Boring work/documentation Requires Wide knowledge and skill set Experience Ability to make logic leaps Diligence, resolve, patience, lots of coffee Pen-tester quality varies wildly Not a pen-tester? Understand approach to evaluate. 4/7/2019

Simple Design Internet External firewall Proxy appliance Web tier firewall Proxy appliance Web server App tier firewall Database server 4/7/2019

SQL Injection Occurs when unchecked input builds SQL queries Search box input: pizza Code builds SQL query: SELECT * FROM food WHERE type=’pizza’; pizza’; DROP DATABASE cafe;SELECT * FROM food WHERE type=’pizza Code builds SQL query: SELECT * FROM food WHERE type=’pizza’; DROP DATABASE cafe;SELECT * FROM food WHERE type=’pizza’; 4/7/2019

Pentesting Impact Site shut down Reputation damage Lost revenue Lost customers / goodwill Cost to resolve In the USA? Full disclosure may be required. 4/7/2019

Pentesting Review: If the end user has control, there is no security There is no security in client-side validation All input must be validated Don’t allow data uploads without validation Implement security controls correctly IDS & Content filtering Firewall rules – no connect out from web servers Culture of security is most important Not just “do it” but “do it properly & securely” If the end user has control, there is no security 4/7/2019

Doing the Job Career path – use it to learn the principles Why are the principles so important? Expect unique systems & software No courses on “Widgets v1.0 security” Expect unusual problems Expect unusual solutions Expect issues outside your comfort zone 4/7/2019

Doing the Job Your mission, should you choose to accept it… 95% of the time it’s (relatively) easy Most attackers go for the easy score The other 5% is hard – directed, tech attacks Non-technical: empathy & pragmatism Jack of all trades and master of some Learn the principles, investigate the rest 4/7/2019

Review Thank you! Questions Comments Items to review Further study 4/7/2019