Security course 30 April 2018

ACL

Access Control List.

Access Control

who can access which parts of a system, by assigning permissions to roles, users to groups, and roles to groups.

Authentication

confirmation of identity.

Authorisation

access control.

NZISS

New Zealand Internet Security Standard

Restrict database access to only the tables required, use a minimum of stored procedures to hide sensitive tables entirely (e.g. an AUTHENTICATE() stored procedure, and no access to the USER table.

CREATE FUNCTION AUTHENTICATE(u TEXT, p TEXT) RETURNS TABLE (username TEXT, property1, TEXT, ...) AS $$
BEGIN
  SELECT username, property1, ... FROM users WHERE username = u, password = CRYPT(p);
END;
$$ LANGUAGE plpgsql;

1. Design software to use the lowest privilege level required to complete its tasks.
2. Deny access by default.
3. Check return values of all system calls.
4. Validate all inputs - lengths, field types, ranges, controlled vocabularies.

Authentication

1. User IDs - users must be unique. No shared 'office admin' accounts with naff passwords.
2. Don't use shit passwords. Enforce minimum password complexity, use multi-factor auth, biometrics, etc.
3. Encrypt user authentication data over the network (including database connections).
4. Don't store passwords in clear text.
5. Password management policies - e.g. time-out or reset request after x attempts, lock account after y attempts.
6. Display when a user last logged in.

Auditing

Log at least these events. We need who did what, where (source IP, device ID, etc.), and when:

1. User logins.
2. Privileged operations e.g. create new user, role/permissions changes, etc.
3. failed attempts to elevate privileges.
4. failed attempts to access files, functions, services. (Was it temporarily down, or was it attacked?)
5. Security-related alerts and failures.

DON'T IMPLEMENT YOUR OWN CRYPTO unless you are a professional cryptologist implementing a software cryptography library.

Input handling

Never trust anything passed in, including the URL and its parameters, HTML form data, cookie values, request headers, without validating/sanitising them.

Output handling

1. Use appropriate URL encoding (/ = %2f) and HTML encoding (& = &)
2. Use HTTPS Strict Transport Security, Content Security Policy, and HTML frame options.

OWASP

Open Web Application Security Project. Freely available information, cheat sheets and guidelines, including:

• The OWASP Top Ten.
• Secure Coding Quick Reference Guide
• Zed Attack Proxy (ZAP)