Scribd
Upload
24 views68 pages

Sesi 26 How To Secure An Application

This document discusses how to secure an application by addressing top security issues. It covers malware issues from 2017 and 2016, as well as a 2015 buffer overflow vulnerability. It then discusses the top attacks in 2017 and why software security is important since many devices and services rely on software. Failure can result in tangible and intangible losses, reputation damage, and productivity losses. The document identifies connectivity, extensibility, and complexity as common sources of software security problems. It provides statistics on software vulnerabilities and discusses taking a holistic viewpoint on software security.

Uploaded by

Abiyau Neo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
24 views68 pages

Sesi 26 How To Secure An Application

This document discusses how to secure an application by addressing top security issues. It covers malware issues from 2017 and 2016, as well as a 2015 buffer overflow vulnerability. It then discusses the top attacks in 2017 and why software security is important since many devices and services rely on software. Failure can result in tangible and intangible losses, reputation damage, and productivity losses. The document identifies connectivity, extensibility, and complexity as common sources of software security problems. It provides statistics on software vulnerabilities and discusses taking a holistic viewpoint on software security.

Uploaded by

Abiyau Neo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 68

How To Secure an

Application
Topik 26
Issues

•2017
–Malware
•2016
–Rumour: Old CMS Drupal was the cause of Panama Papers
leak
•2015
–CVE-2015-0235: GHOST: glibc gethostbyname buffer overflow
Top Attack 2017
Peta Software Security
Mengapa Software Penting?
•Berbagai perangkat / layanan bergantung pada software
–Perangkat bisnis (ATM, e-commerce)
–Alat komunikasi
–Peralatan medis
–Transportasi modern
–Peralatan elektronik rumah tangga
–…
Konsekuensi Kegagalan
•Kerugian tangible & intangible
•Reputasi rusak & kepercayaan customer hilang
•Berakibat fatal bila operasionalnya terganggu
•Kerugian produktivitas
Statistik Software Vulnerabilities
Sumber Masalah Keamanan Software

•Connectivity
–Software terhubung ke mana-mana
•Extensibility
–Software dapat diubah meskipun sudah dipasang dan digunakan
(deployed)
•Complexity
–Software semakin kompleks
nectivity
–Software terhubung ke mana-mana
•Extensibility
–Software dapat diubah meskipun sudah dipasang dan digunakan (deployed)
Extensibility
•Software dapat diubah meskipun sudah
dipasang dan digunakan (deployed)
•Diubah sambil jalan
•Fitur yang belum ada dapat
dikembangkan sambil jalan
•Autoupdate
•Applet, plug-in, …
•Trend ke depan (JAVA, .NET) makin bisa
dikembangkan
•Malicious extension bisa masuk ke sistem
Complexity Operating Year Lines Of
Software Semakin Kompleks System Codes
Windows 3.1 1990 3 milion
Windows NT 1996 4 milion
–Dihitung dari jumlah baris Windows 95 1997 15 milion
(Lines of Code) Windows NT 4.0 1998 16.5 milion

•Trennya akan makin terus Windows 98 1999 18 milion


Windows NT 2000 20 milion
naik 5.0/2K beta
–Semakin banyak jumlah Debian 2000 55 milion
GNU/Linux 2.2
baris:
Windows 2000 2000 35 milion
•makin meningkat potensi Windows XP 2001 40 milion
lubang keamanan Red Hat 7.1 2007 50 milion
•makin banyak insiden Windows Vista 2007 50 milion
Sudut Pandang Holistik
Layer
Disposal
Terima Kasih
Solving the Problem
Risk Management Framework
Software Security Tools
Software Security Knowledge
Pihak Yang Terlibat Dalam Software
Security
Software Security: When and Where
Kelemahan Umum Dalam SDLC
Start the Security Process
Software Engineering Evolution
Security Software Development Life Cycle
(SSDLC)
Security Framework: SD 3
Security Throughout Project Life Cycle
Security Requirement
Security Requirement

•How to describe
–Using natural language
–Using diagrams
•Assignment
–Create a security requirement for
•internet banking web-based application
•Sistem informasi kepegawaian
Secure Software Design

•Architectural Issues
–Jika disain arsitektur software sudah memiliki lubang
keamanan, maka implementasi tidak mengubah hal
tersebut.
–Analogi: bangunan yang didesain tanpa dinding di bagian
belakang
Design Review
Implementasi Secure Coding

•Menentukan hasil dari implementasi


–Analogi : Dinding yang dibangun dengan batu bata
(beton) akan berbeda dengan tripleks (bedeng)
–Ada beberapa tools yang dapat digunakan untuk menguji
(static analysis tools)
Risk Analysis
Penetration Testing
"Improving the Security of
Your Site by Breaking Into it”
(Dan Farmer/Wietse Venema, 1993)
http://www.fish.com/security/admin-guide-to-cracking.html
Blackbox vs Whitebox

•Tidak ada pengetahuan awal


•Diberi pengetahuan lengkap
mengenai sistem yang akan diuji. mengenai sistem yang akan diuji
•Penguji menentukan dulu lokasi •Mencari lubang keamanan
dan coverage target. dengan menelusuri program :
•Menguji berbasis input dan –Dengan source code
output saja –Identifikasi programming error
–Tanpa source code –Mencari kelemahan (algoritma
dan teknik implementasi)
–Memberikan input yang tidak
lazim
Top Software Security Flaws
Terima Kasih

You might also like