Fluent Essays

.I. Executive Summary: Provide a high-level overview of the contents of your report for the leadership team. Include your findings on major security flaws uncovered and the impact vulnerabilities pose. II. Summary of Methods In this section, you will describe the various methods used to identify vulnerabilities in the source code. A. Describe how and when you used methods to visually inspect the code to identify the vulnerabilities you found. [CS-405-01] B. Describe how and when you used the compiler errors or warnings to identify the vulnerabilities you found. [CS-405-01] C. Explain how and when you used a static analysis tool to identify the vulnerabilities you found. [CS-405-01] III. Vulnerability Findings In this section, you will assess the identified weaknesses in the following areas:  String-formatted output  Memory management  Pointers  Integer arithmetic  Code quality Provide the following for each indicated weakness: A. An evaluative description that explains why the code is insecure and details the implications of the weakness [CS-405-02] B. Remediation recommendations as modified code that corrects the weakness or reduces the vulnerability [CS-405-03] IV. Depth of Audit: You will be graded on the percentages of weaknesses and vulnerabilities that you identify in your secure code audit report. These sections should adhere to best practices and industry standards.Part II: Case Study Analysis Based on the provided documentation on the following two case studies from Predicting Software Assurance Using Quality and Reliability Measures, provide a brief analysis of the two case studies. I. Case One: Database Vulnerabilities (Apple Coding Vulnerability, found on page 19) Given the particular scenario pertaining to the database system, evaluate security aspects of program designs and architectures for defending against attacks: A. Explain the security issues present, indicating the potential risks that the issues pose. [CS-405-04] B. Recommend testing types or processes necessary to identify the vulnerabilities. [CS-405-04] II. Case Two: Architecture-Specific Vulnerabilities (Heartbleed Vulnerability, found on page 21) Given the particular scenario pertaining to a server, evaluate security aspects of program designs and architectures for defending against attacks: A. Explain the security issues present, indicating the potential risks that the issues pose. [CS-405-04] B. Recommend testing types or processes necessary to identify the vulnerabiliti cs_405_final_project_guidelines_and_rubric.pdf _004_001_428597.pdf cs_405_final_project_template.docx final_project_source_code__1_.zip cs_405_final_project_issues_checklist.pdf Unformatted Attachment Preview CS 405 Final Project Guidelines and Rubric Overview As the complexity of and demand for applications on a variety of platforms continues to grow, the importance of a secure coding disposition grows with it. While writing your own secure code is vital, the ability to identify vulnerabilities in others’ code has become increasingly important. Consider Black Duck Software’s 2017 Open Source Security and Risk Analysis in which 96\% of applications scanned utilized open source components, with 67\% of those analyzed applications having vulnerabilities in the open-source components used. As the use of open-source code and third-party code becomes more widespread, the ability to identify and correct insecure code is a valuable skill. The final project for this course has two parts: a secure code audit and a case study analysis. The first part is the creation of a secure code audit report. The second part is a brief case study analysis of system-level issues: database and architecture-specific vulnerabilities. Refer to the Predicting Software Assurance Using Quality and Reliability Measures resource to access your required case studies. Consider using the Final Project Template to help organize your final project. In this assignment, you will demonstrate your mastery of the following course outcomes:     [CS-405-01] Analyze source code through manual and automated testing methods for the identification of potential vulnerabilities and code weaknesses [CS-405-02] Evaluate identified vulnerabilities and weaknesses using best practices and industry standards for determining the implications of insecure code [CS-405-03] Modify code by correcting common weaknesses and reducing vulnerabilities using best practices and industry standards [CS-405-04] Recommend testing processes and protocols necessary for securing program designs/architectures Prompt Part I: Securing Code Audit Report Conducting a secure code review is a crucial stage of the software development life cycle. The goal of a secure code review is to identify specific types of weaknesses in the source code of a given project. The task involves both manual and automated review of the source code with the goal of identifying issues and recommending mitigation strategies. For the first part of the final project, download the Final Project Source Code and import the files to the Eclipse development environment. Use the Final Project Issues Checklist document as a guide to find the errors and vulnerabilities in the code. 1 Specifically, you must address the following critical elements: I. Executive Summary: Provide a high-level overview of the contents of your report for the leadership team. Include your findings on major security flaws uncovered and the impact vulnerabilities pose. II. Summary of Methods In this section, you will describe the various methods used to identify vulnerabilities in the source code. A. Describe how and when you used methods to visually inspect the code to identify the vulnerabilities you found. [CS-405-01] B. Describe how and when you used the compiler errors or warnings to identify the vulnerabilities you found. [CS-405-01] C. Explain how and when you used a static analysis tool to identify the vulnerabilities you found. [CS-405-01] III. Vulnerability Findings In this section, you will assess the identified weaknesses in the following areas:  String-formatted output  Memory management  Pointers  Integer arithmetic  Code quality Provide the following for each indicated weakness: A. An evaluative description that explains why the code is insecure and details the implications of the weakness [CS-405-02] B. Remediation recommendations as modified code that corrects the weakness or reduces the vulnerability [CS-405-03] IV. Depth of Audit: You will be graded on the percentages of weaknesses and vulnerabilities that you identify in your secure code audit report. These sections should adhere to best practices and industry standards. 2 Use the matrix provided to you as an example of how to format each weakness. Weakness Category Code quality Location Source file: src\main\java\org\project\ex ample.java Line Numbers: 2–25 Method of Identification Compiler warning Description On lines 2 through 25, the program does not include a break statement in a switch statement. This can result in the execution of multiple sections of code, rather than association with one condition. Also, the code does not have a default case in a switch statement; therefore, the code does not check for other (incorrect values) passed to the method. This can cause isolated or cascading failure that may result in any number of security issues. 3 Remediation Recommendation Highlighted code added: public void printDay(int day){ switch (day) { case 1: print(Sunday); break; case 2: print(Monday); break; case 3: print(Tuesday); break; case 4: print(Wednesday); break; case 5: print(Thursday); break; case 6: print(Friday); break; case 7: print(Saturday); break; default: print(Everyday); break; } println( is a great day); } Part II: Case Study Analysis Based on the provided documentation on the following two case studies from Predicting Software Assurance Using Quality and Reliability Measures, provide a brief analysis of the two case studies. I. Case One: Database Vulnerabilities (Apple Coding Vulnerability, found on page 19) Given the particular scenario pertaining to the database system, evaluate security aspects of program designs and architectures for defending against attacks: A. Explain the security issues present, indicating the potential risks that the issues pose. [CS-405-04] B. Recommend testing types or processes necessary to identify the vulnerabilities. [CS-405-04] II. Case Two: Architecture-Specific Vulnerabilities (Heartbleed Vulnerability, found on page 21) Given the particular scenario pertaining to a server, evaluate security aspects of program designs and architectures for defending against attacks: A. Explain the security issues present, indicating the potential risks that the issues pose. [CS-405-04] B. Recommend testing types or processes necessary to identify the vulnerabilities. [CS-405-04] Milestones Milestone One: Summary of Methods and Vulnerability Findings Draft In Module Five, you will submit a draft of your Summary of Methods and Vulnerability Findings sections of the first part of your final project. In this milestone, you will include topics that you have covered up until this point in the course, which include code quality, strings, pointers, and memory management. This milestone will be graded with the Milestone One Rubric. Final Submission: Secure Code Audit Report and Case Study Analysis In Module Seven, you will submit your final project. It should be a complete, polished artifact containing all of the critical elements of the final product. It should reflect the incorporation of feedback gained throughout the course. This submission will be graded with the Final Project Rubric. Final Project Rubric Guidelines for Submission: Submit your final project as a Word document. The executive summary and summary of methods from Part I of your final project must be 1 to 2 pages in length. Use the vulnerability findings matrix to complete the Vulnerability Findings section. Part II of the final project must be 1 to 2 pages in length, not including a reference page, and must be written in APA format. Use double spacing, 12-point Times New Roman font, and one-inch margins. Include at least three references cited in APA format. 4 Critical Elements Executive Summary Exemplary Summary of Methods: Visual Inspection [CS-405-01] Meets “Proficient” criteria with specific details that illustrate a comprehensive grasp of how and when to use visual inspection methods to identify vulnerabilities (100\%) Meets “Proficient” criteria with specific details that illustrate a comprehensive grasp of how and when to use compiler errors and warnings to identify vulnerabilities (100\%) Meets “Proficient” criteria with specific details that illustrate a comprehensive grasp of how and when to use a static analysis tool to identify vulnerabilities (100\%) Summary of Methods: Compiler Errors [CS-405-01] Summary of Methods: Static Analysis Tool [CS-405-01] Vulnerability Findings: Weakness: Strings: Description [CS-405-02] Vulnerability Findings: Strings: Remediation Recommendation [CS-405-03] Vulnerability Findings: Weakness: Memory Management: Description [CS-405-02] Proficient Provides a high-level overview of the contents of the report, including findings around major security flaws uncovered and the impact vulnerabilities pose (100\%) Describes how and when visual inspection methods were used to identify vulnerabilities in the code (85\%) Needs Improvement Provides an overview of the contents of the report, but overview is overly detailed or is missing required components (55\%) Not Evident Does not provide an overview of the contents of the report (0\%) Value 5 Describes visual inspection methods but is cursory or contains inaccuracies (55\%) Does not describe how and when visual inspection methods were used to identify vulnerabilities in the code (0\%) 7.1 Describes how and when compiler errors and warnings were used to identify vulnerabilities in the code (85\%) Describes use of compiler errors and warnings methods but is cursory or contains inaccuracies (55\%) Does not describe how and when compiler errors and warnings were used to identify vulnerabilities in the code (0\%) 7.1 Describes how and when a static analysis tool was used to identify vulnerabilities in the code (85\%) Describes use of static analysis tool but is cursory or contains inaccuracies (55\%) Does not describe how and when a static analysis tool was used to identify vulnerabilities in the code (0\%) 7.1 Explains why the code is insecure and provides details regarding the implications of the weakness (100\%) Incorporates remediation code that corrects the weakness and adheres to best practices and industry standards (100\%) Explains why the code is insecure, but the explanation lacks key details, lacks clarity, or is not supported (55\%) Incorporates remediation code, but code does not completely secure the source code or does not adhere to best practices and industry standards (55\%) Explains why the code is insecure, but the explanation lacks key details, lacks clarity, or is not supported (55\%) Does not explain why the code is insecure (0\%) 4.25 Does not incorporate remediation code that corrects the weakness (0\%) 4.25 Does not explain why the code is insecure (0\%) 4.25 Explains why the code is insecure and provides details regarding the implications of the weakness (100\%) 5 Critical Elements Vulnerability Findings: Memory Management: Remediation Recommendation [CS-405-03] Vulnerability Findings: Weakness: Pointers: Description [CS-405-02] Vulnerability Findings: Pointers: Remediation Recommendation [CS-405-03] Vulnerability Findings: Weakness: Integer Arithmetic: Description [CS-405-02] Vulnerability Findings: Integer Arithmetic: Remediation Recommendation [CS-405-03] Vulnerability Findings: Weakness: Code Quality: Description [CS-405-02] Vulnerability Findings: Code Quality: Remediation Recommendation [CS-405-03] Exemplary Proficient Incorporates remediation code that corrects the weakness and adheres to best practices and industry standards (100\%) Needs Improvement Incorporates remediation code, but code does not completely secure the source code or does not adhere to best practices and industry standards (55\%) Not Evident Does not incorporate remediation code that corrects the weakness (0\%) Explains why the code is insecure and provides details regarding the implications of the weakness (100\%) Incorporates remediation code that corrects the weakness and adheres to best practices and industry standards (100\%) Explains why the code is insecure, but the explanation lacks key details, lacks clarity, or is not supported (55\%) Incorporates remediation code, but code does not completely secure the source code or does not adhere to best practices and industry standards (55\%) Explains why the code is insecure, but the explanation lacks key details, lacks clarity, or is not supported (55\%) Does not explain why the code is insecure (0\%) 4.25 Does not incorporate remediation code that corrects the weakness (0\%) 4.25 Does not explain why the code is insecure (0\%) 4.25 Incorporates remediation code that corrects the weakness and adheres to best practices and industry standards (100\%) Incorporates remediation code, but code does not completely secure the source code or does not adhere to best practices and industry standards (55\%) Does not incorporate remediation code that corrects the weakness (0\%) 4.25 Explains why the code is insecure and provides details regarding the implications of the weakness (100\%) Explains why the code is insecure, but the explanation lacks key details, lacks clarity, or is not supported (55\%) Does not explain why the code is insecure (0\%) 4.25 Incorporates remediation code that corrects the weakness and adheres to best practices and industry standards (100\%) Incorporates remediation code, but code does not completely secure the source code or does not adhere to best practices and industry standards (55\%) Does not incorporate remediation code that corrects the weakness (0\%) 4.25 Explains why the code is insecure and provides details regarding the implications of the weakness (100\%) 6 Value 4.25 Critical Elements Depth of Audit Case Study Analysis: Database: Security Issues [CS-405-04] Case Study Analysis: Database: Recommendations [CS-405-04] Case Study Analysis: Architecture-Specific Security Issues [CS-405-04] Case Study Analysis: Architecture-specific: Recommendations [CS-405-04] Articulation of Response Exemplary Identifies more than 80\% of total weaknesses and vulnerabilities (100\%) Meets “Proficient” criteria and the details of the explanation reveal a comprehensive grasp of the connection between the security issues and the risks associated with them (100\%) Meets “Proficient” criteria and the testing types and procedures indicate a thorough grasp of methods necessary to identify the specific issues presented in the case study (100\%) Meets “Proficient” criteria and the details of the explanation reveal a comprehensive grasp of the connection between the security issues and the risks associated with them (100\%) Meets “Proficient” criteria and the testing types and procedures indicate a thorough grasp of methods necessary to identify the specific issues presented in the case study (100\%) Proficient Identifies 75\% to 80\% of total weaknesses and vulnerabilities (85\%) Explains the security issues present including a description of the potential risks posed by the issues (85\%) Needs Improvement Identifies 50\% to 74\% of total weaknesses and vulnerabilities (55\%) Explains the security issues present but is cursory or contains inaccuracies (55\%) Not Evident Identifies less than 50\% of total weaknesses and vulnerabilities (0\%) Does not explain the security issues present (0\%) Value 5 Recommends testing types or processes necessary to identify the vulnerabilities (85\%) Recommends testing types or processes necessary to identify the vulnerabilities, but the recommendation lacks clarity, lacks key details, or is not supported (55\%) Explains the security issues present but is cursory or contains inaccuracies (55\%) Does not recommend testing types or processes necessary to identify the vulnerabilities (0\%) 5.3 Does not explain the security issues present (0\%) 5.3 Recommends testing types or processes necessary to identify the vulnerabilities, but the recommendation lacks clarity, lacks key details, or is not supported (55\%) Follows formatting and citation requirements with minor errors (55\%) Does not recommend testing types or processes necessary to identify the vulnerabilities (0\%) 5.3 Does not follow formatting and citation requirements (0\%) 5 Explains the security issues present including a description of the potential risks posed by the issues (85\%) Recommends testing types or processes necessary to identify the vulnerabilities (85\%) Follows formatting and citation requirements (100\%) Total 7 5.3 100\% Predicting Software Assurance Using Quality and Reliability Measures Carol Woody, Ph.D. Robert Ellison, Ph.D. William Nichols, Ph.D. December 2014 TECHNICAL NOTE CMU/SEI-2014-TN-026 CERT Division/SSD http://www.sei.cmu.edu Copyright 2014 Carnegie Mellon University This material is based upon work funded and supported by the Department of Defense under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the United States Department of Defense. This report was prepared for the SEI Administrative Agent AFLCMC/PZM 20 Schilling Circle, Bldg 1305, 3rd floor Hanscom AFB, MA 01731-2125 NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. This material has been approved for public release and unlimited distribution except as restricted below. Internal use:* Permission to reproduce this material and to prepare derivative works from this material for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works. External use:* This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other external and/or commercial use. Requests for permission should be directed to the Software Engineering Institute at permission@sei.cmu.edu. * These restrictions do not apply to U.S. government entities. Team Software ProcessSM and TSPSM are service marks of Carnegie Mellon University. DM-0002014 . Table of Contents Acknowledgments vii Executive Overview ix Abstract xiii 1 Introduction 1 2 Assurance 2.1 DoD Assurance Case Example 3 4 3 Analysis of Quality Cases 3.1 SEI Data 3.2 Defect Prediction Models 3.3 In-Depth Analysis: Security Focused Example (Project A1) 3.3.1 Security Example Results 3.3.2 Security Example Discussion 3.3.3 Security Example Summary 3.4 In-Depth Analysis: Safety-Focused Examples (Projects D1, D2, D3) 3.4.1 Safety Examples Process Approach 3.4.2 Safety Examples Discussion 3.4.3 Safety Examples Summary 7 7 8 11 11 12 12 12 13 17 17 4 Assurance and Finding Defects 4.1 Case Study: Apple Coding Vulnerability 4.2 Case Study: Heartbleed Vulnerability 19 19 21 5 Other Data Sources: Security, Quality, and Reliability 5.1 Quality Practices 5.1.1 Design and Engineering Defects 5.1.2 Capers Jones Software Quality Survey 5.1.3 Consortium for IT: Software Quality (CISQ) 25 25 25 26 26 6 Planning for Improved Security and Quality 6.1 Next Steps 29 30 Appendix A: Relationship Between Vulnerabilities and Defects, a Brief Summary of the Literature 31 Appendix B: Quality Cannot Be Tested In 35 Bibliography 38 CMU/SEI-2014-TN-026 | i CMU/SEI-2014-TN-026 | ii List of Figures Figure 1: Hardware and Software Failures Over Time ix Figure 2: Confidence Gap 3 Figure 3: NR-KPP ... Purchase answer to see full attachment