1. Chapter 23: Vulnerability Analysis Dr. Wayne Summers Department of Computer Science Columbus State University Summers_wayne@colstate.edu http://csc.colstate.edu/summers

2. 2 Penetration Studies  Test for evaluating strengths of all security controls on the computer system (tiger team attack, red team attack)  Authorized attempt to violate constraints stated in security policy  Layering of Tests –External attacker with no knowledge of system –External attacker with access to the system –Internal attacker with access to the system

3. 3 Penetration Studies  Flaw Hypothesis Methodology –Information Gathering –Flaw Hypothesis –Flaw Testing –Flaw Generalization –Flaw Elimination

4. 4 Vulnerability Classification  Goal of vulnerability analysis is to develop methodologies that provide –Ability to specify, design, and implement a computer system without vulnerabilities –Ability to analyze a computer system to detect vulnerabilities –Ability to address any vulnerabilities introduced during the operation of the computer system –Ability to detect attempted exploitations of vulnerabilities

5. 5 Frameworks  Research Into Secure Operating Systems (RISOS) – classified flaws –Incomplete parameter validation (buffer overflow) –Inconsistent parameter validation –Implicit sharing of privileged/confidential data –Asynchronous validation/inadequate serialization (race conditions/time-of-check to time-of-use) –Inadequate identification/authentication/authorization –Violable prohibition/limit (bound conditions) –Exploitable logic error

6. 6 Frameworks  Protection Analysis Model ( pattern-directed protection evaluation) –Improper protection domain initialization and enforcement Improper choice of initial protection domain Improper isolation of implementation detail Improper change Improper naming Improper deallocation or deletion –Improper validation –Improper sychronization Improper indivisibility Improper sequencing –Improper choice of operand / operation

7. 7 Frameworks  NRL Taxonomy –Flaws by genesis Intentional –Malicious Trojan horse Trapdoor Logic/time bomb –Nonmalicious Covert channel Other Unintentional (RISOS taxonomy)

8. 8 Frameworks  NRL Taxonomy –Flaws by time of introduction Development –Requirement/specification/design –Source code –Object code Maintenance Operation

9. 9 Frameworks  NRL Taxonomy –Flaws by location Software –Operating System System initialization Memory management Process management/scheduling Device management File management Identification/authentication Other/unknown –Support Privileged utilities Unprivileged utilities –Application Hardware