Secure Software

Engineering
BITS Pilani Dr Sunil Dhore
Pilani Campus
 BITS Pilani
Pilani Campus

Course :
Secure Software Engineering
Lecture No. 4
IMP Note to Self

3
 Disclaimers

❖ The slides presented here are obtained from various authors of books, online

articles, relevant standards, community developed online resources

❖ The content is suitably modified for this sake of conducting this course

❖ Relevant references, citations will be provided wherever applicable

❖ I acknowledge, appreciate and thank all the authors of the content am reusing

4
M1: Overview of Secure Software Engineering
• Why Secure Software Engineering ?
• Popular Cyber attacks on Software, Hardware and Cloud
delivered products.
• Core definitions, concepts, examples.
• Differences Product Security versus Security Products

BITS Pilani, Pilani Campus

M2: Product Security Programs

• Establishing a Security Program

• Secure Software Engineering in legacy and
agile SDLC models
• Shift Left versus Shift Right
• Maturity Models - OpenSAMM , BSIMM
• Metrics and Success Criteria

BITS Pilani, Pilani Campus

M3: Product Security Requirements

• Software Requirements - Functional and Nonfunctional

• What are Product Security Baselines ?
• Security Requirements for Applications such as Web and Mobile
• Security Requirements for IOT/Hardware/SCADA Products

BITS Pilani, Pilani Campus

CS4: Secure Design & Architecture

Contact List of Topic Title Text/Ref Book/external

Sessions(#) (from content structure in Course Handout) resource
4 M4: Secure Design & Architecture T2, Chapter 4, 5; R3
● Security Perimeter and Attack Surface
● Risk Assessments
● Threat Modelling

Text Book(s)
T1 Secure, Resilient, and Agile Software Development By Mark Merkow · 2019
T2 Core Software Security Security at the Source By James Ransome, Anmol Misra · 2018
T3 Secure and Resilient Software Requirements, Test Cases, and Testing Methods
By Mark S. Merkow, Lakshmikanth Raghavan · 2011
BITS Pilani, Pilani Campus
 Evaluation Scheme
Legend: EC = Evaluation Component
Note - Evaluation components can be tailored depending on the proposed model.

No Name Type Weight Start Date End Date

EC1 Quiz-1 20 questions, MCQ 10%

15/02/2025 16/02/2025

Quiz-2 20 questions, MCQ 10%

Assignment Five Questions will be 10%

given

EC2 Mid Semester 30%

Test
EC3 After M5 – 40%
Comprehensive
Examination
 BITS Pilani
Pilani Campus

Security Assessment (A1): SDL

Activities and Best Practices
https://www.microsoft.com/en-us/securityengineering/sdl/practices?oneroute=true
Security Assessment (A1) Key
Success Factors and Metrics

BITS Pilani, Pilani Campus

Security Assessment (A1) Key
Success Factors and Metrics

BITS Pilani, Pilani Campus

Deliverables

BITS Pilani, Pilani Campus

Metrics

Here are our suggestions for metrics for this phase:

• Time in weeks when software security team was looped in
• Percent of stakeholders participating in SDL
• Percent of SDL activities mapped to development activities
• Percent of security objectives met

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Architecture (A2): SDL Activities and

Best Practices
https://www.microsoft.com/en-us/securityengineering/sdl/practices?oneroute=true
Architecture (A2): SDL
Activities and Best Practices

BITS Pilani, Pilani Campus

M4: Secure Design & Architecture

• Security Perimeter & Attack Surface

• Risk Assessments
• Threat Modelling
• Security Constructs - Authentication, Authorization,
Encryption, Logging
• Secure By Design & Trustworthiness Principles

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Security Perimeter
https://www.sangfor.com/glossary/cybersecurity/what-is-security-
perimeter#:~:text=The%20boundary%20that%20divides%20a,gates%20that%20block%
20access%20physically.
Security Perimeter

Security Perimeter is the

border between
the assets we want to
protect and the outside
world.

Also called Trusted

Boundary

BITS Pilani, Deemed to be University under Section 3 of UGC Act, 1956

Examples

Real World Cyber World

• Individual Homes - Gate • Cloud computing in all
• Private Properties - A fence forms
or high wall around the • Extranets and virtual private
property networks
• Parking Lot - A boom barrier • Globally telecommuting
• Between States - A check employees
post • Mobile technologies
• Opening up of back-office
services to public users and
automation

BITS Pilani, Pilani Campus

Security Perimeter
• The boundary that divides a network or system from the outside world,
including the internet, is called a security perimeter. A security perimeter can
be physical or logical.
• A physical security perimeter refers to impediments such as fences, walls, and gates
that block access physically. Logical security perimeters use security protocols,
access controls, and firewalls to control access to the network and its resources.
• Moreover, a logical security perimeter usually includes hardware, software, and
human elements.
• Hardware perimeter security involves network devices such as firewalls, intrusion
detection systems, routers, and switches.
• Software perimeter security is designed to protect networks. It includes access control
software, authentication, encryption technologies, and antivirus products.
• Additionally, human elements can include elements such as passwords, user IDs,
physical entry cards, video surveillance systems, guards, and alarm systems. Most
companies use multiple hardware and software products in conjunction with each
other to create a strong defense system.

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Attack Surface

https://graquantum.com/cyber-basics-cyber-attack-surface/
Attack Surface

All possible entry points that an attacker can

use to attack the application or system under
consideration.

BITS Pilani, Pilani Campus

Applications – Attack Surface

All the web pages the attacker (Internal or External) can access,
either directly or forcibly
• User interface (UI) forms and fields
• HTTP headers and cookies
• APIs
• Files
• Databases
• Other local storage
• Email or other kinds of messages
• Runtime arguments
• ...Your points of entry/exit

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Threat Modelling

https://www.cisco.com/c/en/us/products/security/what-is-threat-modeling.html
Threat Modelling

Threat modeling is a process for identifying and assessing

potential threats to a system, including the likelihood and
impact of each threat.

It is a proactive approach to security, and can be used to

improve the security of systems at all stages of their
lifecycle, from design to implementation to operation.

BITS Pilani, Pilani Campus

Simple Process

BITS Pilani, Deemed to be University under Section 3 of UGC Act, 1956

Next Steps

Prioritize
Identify Identify
Assess Risks Mitigation
Assets Threats
Efforts

BITS Pilani, Pilani Campus

Key Steps Involved in Threat
Modeling
1. Break down your product architecture using data flow diagrams
2. Use STRIDE threat categories to identify what threats are applicable
to each element of the data flow diagram.
3. Map all threats with relevant vulnerabilities as applicable in the
context of the usage scenario.
4. Rank threats. Assign a risk rating to each threat and vulnerability to
understand the impact; this will help define the priority for fixing. Use
DREAD or other methodologies.
5. Define the mitigation plan/countermeasures for each of the
vulnerabilities identified.
6. Fix the vulnerabilities that are not acceptable to the business in order
of priority as decided in the preceding steps.

BITS Pilani, Pilani Campus

 BITS Pilani
Pilani Campus

Data Flow Diagrams

Data Flow Diagrams

Data flow diagrams (DFDs) are a type of flowchart that is

used to model the flow of data through a system. DFDs
are used in systems analysis and design to help
visualize and understand how data is processed and
used.

Data flow diagram with data storage, data flows, function and interface

BITS Pilani, Pilani Campus

DFD Elements

BITS Pilani, Pilani Campus

Data Flow Diagrams - Sample

BITS Pilani, Pilani Campus

Data Flow Diagrams – Case
Study

Review : https://blog.hubspot.com/marketing/data-flow-diagram

BITS Pilani, Pilani Campus

Methodologies

• STRIDE: STRIDE stands for Spoofing, Tampering, Repudiation,

Information disclosure, Denial of service, and Elevation of
privilege. It is a threat modeling methodology that focuses on the six
most common types of threats to web applications.
• DREAD: DREAD stands for Damage, Reproducibility, Exploitability,
Affected users, and Discoverability. It is a risk assessment
methodology that can be used to prioritize the threats identified
during threat modeling.
• PASTA: PASTA stands for Process for Attack Simulation and Threat
Analysis. It is a threat modeling methodology that uses a
combination of brainstorming, attack simulation, and risk
assessment to identify and mitigate security risks.
Stride :https://www.iriusrisk.com/resources-blog/threat-modeling-methodology-
stride
DREAD : https://www.purestorage.com/knowledge/dread-threat-
model.html#:~:text=The%20DREAD%20threat%20model%20is,practical%20applicability%20in%20many%20sc
BITS Pilani, Pilani Campus
STRIDE – Web Applications

• S - Spoofing: Impersonating a legitimate user or system

to gain unauthorized access.
• T - Tampering: Modifying data or code without
authorization.
• R - Repudiation: Denying responsibility for an action.
• I - Information disclosure: Exposing sensitive
information to unauthorized individuals.
• D - Denial of service: Making a system or application
unavailable to legitimate users.
• E - Elevation of privilege: Gaining unauthorized access
to higher-level privileges.

BITS Pilani, Pilani Campus

STRIDE – Web Applications

BITS Pilani, Pilani Campus

Threat Modelling

• Microsoft Threat Modelling Tool Based Review –

https://www.cisco.com/c/en/us/products/security/what-is-threat-
modeling.html

• Threagile – Another tool - https://threagile.io/

BITS Pilani, Pilani Campus

STRIDE – Threats - Controls
Type Description Security Control
Threat action aimed at accessing and use of another
Spoofing Authentication
user’s credentials, such as username and password.
Threat action intending to maliciously change or
modify persistent data, such as records in a database,
Tampering Integrity
and the alteration of data in transit between two
computers over an open network, such as the Internet.
Threat action aimed at performing prohibited
Repudiation operations in a system that lacks the ability to trace the Non-Repudiation
operations.
Information Threat action intending to read a file that one was not
Confidentiality
disclosure granted access to, or to read data in transit.
Threat action attempting to deny access to valid users,
Denial of
such as by making a web server temporarily Availability
service
unavailable or unusable.
Threat action intending to gain privileged access to
Elevation of
resources in order to gain unauthorized access to Authorization
privilege
information or to compromise a system.
BITS Pilani, Pilani Campus
Threat Mitigation - Mapping

Threat Type Mitigation Techniques

1. Appropriate authentication
Spoofing
2. Protect secret data
Identity
3. Don’t store secrets
1. Appropriate authorization
2. Hashes
Tampering with
3. MACs
data
4. Digital signatures
5. Tamper resistant protocols

BITS Pilani, Pilani Campus

Threat Mitigation - Mapping

Threat Type Mitigation Techniques

1. Authorization
2. Privacy-enhanced protocols
Information
3. Encryption
Disclosure
4. Protect secrets
5. Don’t store secrets
1. Appropriate authentication
2. Appropriate authorization
Denial of Service 3. Filtering
4. Throttling
5. Quality of service
Elevation of
1. Run with least privilege
privilege
BITS Pilani, Pilani Campus
Threat Profile

• Non mitigated threats: Threats which have no

countermeasures and represent vulnerabilities that can be
fully exploited and cause an impact.
• Partially mitigated threats: Threats partially mitigated by one
or more countermeasures and can only partially be exploited
to cause a limited impact.
• Fully mitigated threats: These threats have appropriate
countermeasures in place and do not expose vulnerabilities.

BITS Pilani, Pilani Campus

Treatment Strategy

1. Do nothing: for example, hope for the best.

2. Inform about the risk: for example, warn your user
population about the risk.
3. Mitigate the risk: for example, by putting
countermeasures in place.
4. Accept the risk: for example, after evaluating the
impact of the exploitation (business impact).
5. Transfer the risk: for example, through contractual
agreements and insurance

BITS Pilani, Pilani Campus

Risk Based Decisions

BITS Pilani, Pilani Campus

Risk Based Decisions

BITS Pilani, Pilani Campus

Summary

BITS Pilani, Pilani Campus

Threat Modelling - References

Cloud Threat Modelling References

• https://cloudsecurityalliance.org/research/topics/top-
threats/
• https://cloudsecurityalliance.org/artifacts/top-threats-to-
cloud-computing-egregious-eleven/
• https://cloudsecurityalliance.org/artifacts/top-threats-
egregious-11-deep-dive/

Threat Modelling References

https://www.threatmodelingmanifesto.org/
BITS Pilani, Pilani Campus
IMP Note to Self

48
 BITS Pilani
Pilani | Dubai | Goa | Hyderabad

Thank You !!