Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David...
-
Upload
grant-stephens -
Category
Documents
-
view
212 -
download
0
Transcript of Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David...
![Page 1: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/1.jpg)
Security Patterns Template and Security Patterns Template and TutorialTutorial
- Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt
Presented by Dan Frohlich
![Page 2: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/2.jpg)
OverviewOverview
What is a Pattern?What is a Security Pattern?The Security Pattern Template.Related Work.
![Page 3: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/3.jpg)
What is a Pattern?What is a Pattern?
Developed by Christopher Alexander for Architectural and Urban Planning
Made popular for software design by GoF.Definition: A solution to a problem in a
context.– Summary, solution and impact– Expanded to include recurrence, a teaching
component, and a name by J. Vlissides (GoF)
![Page 4: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/4.jpg)
VariationsVariations
Architectural patterns.– Enterprise Level (System Patterns)
AntiPatterns.– Document common mistakes
Pattern Languages.– Families of solutions good for OO
Frameworks.
![Page 5: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/5.jpg)
What is a Security Pattern?What is a Security Pattern?
Technique for encapsulating and disseminating security expertise.
Some but not all are design PatternsStructural Security Patterns
– Like GoF Design PatternsProcedural Security Patterns
– Improve the development process of secure software
![Page 6: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/6.jpg)
Audience drives Level of DetailAudience drives Level of Detail
Concepts– General Strategies like “Least Privilege”
Classes of Patterns– General problem area with many solutions
Patterns– General enough to be used in many circumstances
Examples– A worked solution for a specific problem instance
![Page 7: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/7.jpg)
The Security Pattern Template.The Security Pattern Template.
Pattern Name– Noun describing a thing to be built.
(Structural)– Verb describing recommended action.
(Procedural)Abstract
– Describes intent/purpose– Independent of context– Indicates limits on applicability.
![Page 8: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/8.jpg)
The Security Pattern Template.The Security Pattern Template.
Aliases– Also Known As
Problem– Context for application– Motivation for use
Solution– Applicability / Rationale– How the Pattern solves the Problem
![Page 9: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/9.jpg)
The Security Pattern Template.The Security Pattern Template.
Static Structure– Includes a Diagram if applicable or a note if
not– Enumerates the components of the Diagram
Dynamic Structure– Collaborations– Outlines Component interactions
![Page 10: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/10.jpg)
The Security Pattern Template.The Security Pattern Template.
Implementation Issues– Detailed hints and techniques– Identify pitfalls, and guide reader around them
Common attacks– Identify attacks that interact with this pattern– Links to public databases
![Page 11: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/11.jpg)
The Security Pattern Template.The Security Pattern Template.
Known Uses– Cite examples of this pattern from all 3 levels
when possible.– Code Level
Rely on language features.
– System LevelRely on OS features
– Network Level Implemented with network level components.
![Page 12: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/12.jpg)
The Security Pattern Template.The Security Pattern Template.
Sample Code– Presented whenever possible.– Adds tangibility to an abstract idea.
Consequences– Each area should be discussed.– Accountability, Confidentiality, Integrity,
Availability, Performance, Cost, Manageability, Usability
![Page 13: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/13.jpg)
The Security Pattern Template.The Security Pattern Template.
Related Patterns– Reference related patterns and the nature of
the relationshipReferences
– Enumerate citations related to the pattern
![Page 14: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/14.jpg)
Related WorkRelated Work
Security Properties of Design Patterns– Security ramifications of GoF
NRL Patterns work– Formal verification of security-critical
softwarewww.security-patterns.de
– Collaborative site for security pattern developers
![Page 15: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/15.jpg)
Related Work (cont.)Related Work (cont.)
OpenGroup Security Forum– Developing a library of architectural security
patterns.
![Page 16: Security Patterns Template and Tutorial - Darrell M. Kienzle, Ph.D., Matthew C. Elder, Ph.D., David S. Tyree, James Edwards-Hewitt Presented by Dan Frohlich.](https://reader036.fdocuments.us/reader036/viewer/2022083010/5697bfab1a28abf838c9accd/html5/thumbnails/16.jpg)
QuestionsQuestions