1 1 00:00:00,180 --> 00:00:02,220 Platform best practices. 2 2 00:00:02,220 --> 00:00:03,900 In this lesson, we are going to talk 3 3 00:00:03,900 --> 00:00:06,420 about some platform specific best practices 4 4 00:00:06,420 --> 00:00:08,820 and some of the vulnerabilities you may experience. 5 5 00:00:08,820 --> 00:00:10,380 Now, when you're thinking about different platforms, 6 6 00:00:10,380 --> 00:00:11,430 we have lots of them 7 7 00:00:11,430 --> 00:00:14,820 including client/server applications, web applications, 8 8 00:00:14,820 --> 00:00:18,480 mobile applications, embedded applications, firmware, 9 9 00:00:18,480 --> 00:00:21,060 and system-on-a-chip or SoC. 10 10 00:00:21,060 --> 00:00:23,760 We've talked about all of these areas before in this course, 11 11 00:00:23,760 --> 00:00:25,022 but now we're going to think about it 12 12 00:00:25,022 --> 00:00:26,880 \from a software development perspective. 13 13 00:00:26,880 --> 00:00:29,550 Now, when you're dealing with a client/server application, 14 14 00:00:29,550 --> 00:00:31,920 this is an application where part of the application 15 15 00:00:31,920 --> 00:00:34,110 is client software that's installed and run 16 16 00:00:34,110 --> 00:00:35,640 on a separate piece of hardware, 17 17 00:00:35,640 --> 00:00:37,560 and then you have a server application 18 18 00:00:37,560 --> 00:00:38,850 that's installed on a server 19 19 00:00:38,850 --> 00:00:41,790 and they're going to interact between the two over a network. 20 20 00:00:41,790 --> 00:00:43,230 Now, why is this dangerous? 21 21 00:00:43,230 --> 00:00:45,060 Well, because attacks can be directed 22 22 00:00:45,060 --> 00:00:46,530 in one of three places. 23 23 00:00:46,530 --> 00:00:48,420 They can be directed at the local client code 24 24 00:00:48,420 --> 00:00:49,650 on the workstation 25 25 00:00:49,650 --> 00:00:52,110 or at the server application on the server, 26 26 00:00:52,110 --> 00:00:53,910 or the network in between. 27 27 00:00:53,910 --> 00:00:55,590 And so you really have to think through this fully 28 28 00:00:55,590 --> 00:00:58,050 because you have three places that there could be attacks. 29 29 00:00:58,050 --> 00:01:00,090 For instance, if I install a piece of software 30 30 00:01:00,090 --> 00:01:02,880 and it's the most secure piece of software in the world, 31 31 00:01:02,880 --> 00:01:05,010 but I install it on a laptop that already has malware 32 32 00:01:05,010 --> 00:01:07,260 or a root kit, well guess what? 33 33 00:01:07,260 --> 00:01:09,690 That software is now going to be insecure 34 34 00:01:09,690 --> 00:01:11,370 because the underlying operating system 35 35 00:01:11,370 --> 00:01:12,840 has already been compromised. 36 36 00:01:12,840 --> 00:01:14,010 And so when you're doing all this, 37 37 00:01:14,010 --> 00:01:15,630 you have to think about the client system 38 38 00:01:15,630 --> 00:01:16,680 and you need to make sure it's secured 39 39 00:01:16,680 --> 00:01:18,240 with the right scanning and patching 40 40 00:01:18,240 --> 00:01:19,680 and any malware solutions. 41 41 00:01:19,680 --> 00:01:20,820 And the same thing with the server 42 42 00:01:20,820 --> 00:01:22,290 and the same thing with the network. 43 43 00:01:22,290 --> 00:01:24,420 If you can't secure all three places, 44 44 00:01:24,420 --> 00:01:26,280 regardless of whether or not your code is secure, 45 45 00:01:26,280 --> 00:01:28,410 you're going to have an insecure environment. 46 46 00:01:28,410 --> 00:01:30,330 Now, when you're dealing with server side code, 47 47 00:01:30,330 --> 00:01:32,940 you always want to make sure that whatever you're accepting 48 48 00:01:32,940 --> 00:01:35,850 from somebody needs to go through input validation. 49 49 00:01:35,850 --> 00:01:38,130 This will prevent things like buffer overflow attacks 50 50 00:01:38,130 --> 00:01:39,570 or integer overflows. 51 51 00:01:39,570 --> 00:01:41,160 This is a really important thing. 52 52 00:01:41,160 --> 00:01:44,880 Input validation in CYSA is a great thing to use. 53 53 00:01:44,880 --> 00:01:46,500 And when you see it on questions, 54 54 00:01:46,500 --> 00:01:49,350 it's pretty much the right answer at least 75% of the time. 55 55 00:01:49,350 --> 00:01:51,630 So when you see input validation, think about it, 56 56 00:01:51,630 --> 00:01:53,130 because anytime you're trying to prevent something 57 57 00:01:53,130 --> 00:01:56,910 like an SQL injection, an XML injection, an overflow attack, 58 58 00:01:56,910 --> 00:01:59,460 anything that's taking information from a client 59 59 00:01:59,460 --> 00:02:00,930 and going to a server, 60 60 00:02:00,930 --> 00:02:03,420 you always want to have input validation. 61 61 00:02:03,420 --> 00:02:05,760 The next area we want to talk about is web applications. 62 62 00:02:05,760 --> 00:02:08,010 Now, web applications are any applications 63 63 00:02:08,010 --> 00:02:10,530 which use a generic web browser as the client 64 64 00:02:10,530 --> 00:02:12,240 and that uses standard network protocols 65 65 00:02:12,240 --> 00:02:16,260 like HTTP or HTTPS to communicate with the server. 66 66 00:02:16,260 --> 00:02:18,390 This is really a client server application 67 67 00:02:18,390 --> 00:02:21,300 except that that application doesn't get installed 68 68 00:02:21,300 --> 00:02:23,580 on the client because the client is just a web browser 69 69 00:02:23,580 --> 00:02:24,960 that's accessing it. 70 70 00:02:24,960 --> 00:02:28,140 Now, web applications can use a multi-tiered architecture 71 71 00:02:28,140 --> 00:02:30,840 where the server part is split between application logic 72 72 00:02:30,840 --> 00:02:32,940 and then data storage and retrieval. 73 73 00:02:32,940 --> 00:02:35,400 This way, you have application logic that makes decisions 74 74 00:02:35,400 --> 00:02:37,770 and data storage and retrieval like a database. 75 75 00:02:37,770 --> 00:02:38,970 This is a very typical setup 76 76 00:02:38,970 --> 00:02:40,470 when you're dealing with a multi-tier. 77 77 00:02:40,470 --> 00:02:42,030 My website is actually built this way. 78 78 00:02:42,030 --> 00:02:43,230 It is a web application, 79 79 00:02:43,230 --> 00:02:45,300 and we use a multi-tier architecture. 80 80 00:02:45,300 --> 00:02:46,380 We have our front end, 81 81 00:02:46,380 --> 00:02:48,390 which is what you actually see the course on 82 82 00:02:48,390 --> 00:02:49,500 and take your quizzes on. 83 83 00:02:49,500 --> 00:02:50,760 But then we have the backend, 84 84 00:02:50,760 --> 00:02:52,260 which is the data storage and retrieval 85 85 00:02:52,260 --> 00:02:53,490 that's all stored in the database. 86 86 00:02:53,490 --> 00:02:56,400 So we know that you took this quiz and you got this score 87 87 00:02:56,400 --> 00:02:58,470 and we can look back in that over time. 88 88 00:02:58,470 --> 00:03:00,480 Now, when you're dealing with modern web applications, 89 89 00:03:00,480 --> 00:03:02,850 a lot of them don't even use servers anymore. 90 90 00:03:02,850 --> 00:03:05,940 They use what's called microservices or serverless designs. 91 91 00:03:05,940 --> 00:03:07,320 I have a couple of web applications 92 92 00:03:07,320 --> 00:03:09,690 that I use that actually are serverless. 93 93 00:03:09,690 --> 00:03:12,120 They're not ones that our clients use or our students use. 94 94 00:03:12,120 --> 00:03:14,370 It's something we use for backend systems and bookkeeping. 95 95 00:03:14,370 --> 00:03:15,960 But those same principles apply 96 96 00:03:15,960 --> 00:03:18,330 because we're dealing with these modern web applications 97 97 00:03:18,330 --> 00:03:20,580 that are serverless in their design. 98 98 00:03:20,580 --> 00:03:23,610 The next area we want to talk about is mobile applications. 99 99 00:03:23,610 --> 00:03:25,860 And this is any application that's deployed and run 100 100 00:03:25,860 --> 00:03:29,340 on a smartphone, a tablet, or other mobile operating system. 101 101 00:03:29,340 --> 00:03:30,750 So if you've got a smartwatch, 102 102 00:03:30,750 --> 00:03:33,240 it considers itself a mobile application. 103 103 00:03:33,240 --> 00:03:35,160 Now, when we talk about mobile applications, 104 104 00:03:35,160 --> 00:03:36,570 these are often more susceptible 105 105 00:03:36,570 --> 00:03:38,790 to unsecure use of authentication, 106 106 00:03:38,790 --> 00:03:41,550 authorization and confidentiality controls. 107 107 00:03:41,550 --> 00:03:43,770 These mobile devices are definitely vulnerable 108 108 00:03:43,770 --> 00:03:44,910 to attacks launched from the use 109 109 00:03:44,910 --> 00:03:47,100 of open wireless access points as well. 110 110 00:03:47,100 --> 00:03:48,810 A lot of times people take their device 111 111 00:03:48,810 --> 00:03:50,880 and they connect to the local coffee shop. 112 112 00:03:50,880 --> 00:03:51,840 They don't think about the fact 113 113 00:03:51,840 --> 00:03:53,790 that that network is not secure. 114 114 00:03:53,790 --> 00:03:55,650 So even if your mobile application is secure, 115 115 00:03:55,650 --> 00:03:57,570 if it's going over an unsecure network, 116 116 00:03:57,570 --> 00:03:59,370 there's a possibility for infiltration. 117 117 00:03:59,370 --> 00:04:01,320 So you want to keep this in mind. 118 118 00:04:01,320 --> 00:04:04,380 The next thing we want to talk about is embedded applications. 119 119 00:04:04,380 --> 00:04:07,080 Now, embedded applications are any applications 120 120 00:04:07,080 --> 00:04:10,410 which are designed to run on dedicated hardware platforms. 121 121 00:04:10,410 --> 00:04:13,050 When we talked about things like ICS and SCADA, 122 122 00:04:13,050 --> 00:04:14,820 we talked about these manufacturing systems, 123 123 00:04:14,820 --> 00:04:16,140 we talked about smart TVs. 124 124 00:04:16,140 --> 00:04:18,870 These are all examples of embedded applications. 125 125 00:04:18,870 --> 00:04:20,580 Now, the problem with embedded applications 126 126 00:04:20,580 --> 00:04:21,960 like we've talked about before 127 127 00:04:21,960 --> 00:04:24,300 is that they traditionally are not focused on security 128 128 00:04:24,300 --> 00:04:25,770 during development and deployment. 129 129 00:04:25,770 --> 00:04:27,420 And so a lot of bugs can exist, 130 130 00:04:27,420 --> 00:04:29,550 and a lot of these are very old technologies 131 131 00:04:29,550 --> 00:04:31,650 that have not been updated in quite some time. 132 132 00:04:31,650 --> 00:04:33,930 So if you have embedded applications in your network, 133 133 00:04:33,930 --> 00:04:36,450 think about this and think about how you can protect them. 134 134 00:04:36,450 --> 00:04:37,680 If you happen to be responsible 135 135 00:04:37,680 --> 00:04:40,590 for embedded application development, go check out OWASP. 136 136 00:04:40,590 --> 00:04:41,550 They have a great guide 137 137 00:04:41,550 --> 00:04:44,070 on showing you how you can do this more securely. 138 138 00:04:44,070 --> 00:04:45,660 And then we have firmware. 139 139 00:04:45,660 --> 00:04:47,250 Now, firmware is generally considered 140 140 00:04:47,250 --> 00:04:49,080 a type of embedded application 141 141 00:04:49,080 --> 00:04:51,060 that contains the block of embedded code 142 142 00:04:51,060 --> 00:04:52,320 that's run at first startup, 143 143 00:04:52,320 --> 00:04:54,660 things like your BIOS, if you want to think about that. 144 144 00:04:54,660 --> 00:04:57,360 This also performs low level input/ output device functions, 145 145 00:04:57,360 --> 00:05:00,840 plus bootstrapping of an operating system or application. 146 146 00:05:00,840 --> 00:05:02,520 So when we're dealing with firmware, 147 147 00:05:02,520 --> 00:05:04,020 we are dealing with something that starts up 148 148 00:05:04,020 --> 00:05:05,490 right at the beginning. 149 149 00:05:05,490 --> 00:05:08,310 And so this makes it a great target for attackers, 150 150 00:05:08,310 --> 00:05:10,350 because if they can get access to the firmware, 151 151 00:05:10,350 --> 00:05:12,030 that firmware has complete control 152 152 00:05:12,030 --> 00:05:14,340 over the hardware and system memory. 153 153 00:05:14,340 --> 00:05:17,190 The last thing we're going to talk about is system-on-a-chip. 154 154 00:05:17,190 --> 00:05:19,230 This is also known as SoC. 155 155 00:05:19,230 --> 00:05:21,000 This is a type of embedded application 156 156 00:05:21,000 --> 00:05:22,860 commonly used in mobile devices, 157 157 00:05:22,860 --> 00:05:26,340 which contains integrated CPUs, memory, graphics, 158 158 00:05:26,340 --> 00:05:28,770 audio, networks, storage controllers, 159 159 00:05:28,770 --> 00:05:31,230 and software all on one chip. 160 160 00:05:31,230 --> 00:05:32,670 Now, the great thing about system-on-a-chip 161 161 00:05:32,670 --> 00:05:33,960 is they're low power, right? 162 162 00:05:33,960 --> 00:05:35,580 And they have really good efficiency 163 163 00:05:35,580 --> 00:05:37,500 when they're being able to use processing. 164 164 00:05:37,500 --> 00:05:41,010 But these manufacturers often will reuse a lot of code. 165 165 00:05:41,010 --> 00:05:43,650 So the SoC manufacturers will often reuse code 166 166 00:05:43,650 --> 00:05:45,900 by selecting what's known as an IP block 167 167 00:05:45,900 --> 00:05:47,040 for certain functions, 168 168 00:05:47,040 --> 00:05:50,190 and they make these up using field-programmable gate arrays. 169 169 00:05:50,190 --> 00:05:51,960 Now, what are these IP blocks? 170 170 00:05:51,960 --> 00:05:55,020 Well, an IP block is a set of configurations 171 171 00:05:55,020 --> 00:05:57,810 that uses SoC logic gates to achieve a function. 172 172 00:05:57,810 --> 00:05:59,850 So if I wanted to make sure there was the ability 173 173 00:05:59,850 --> 00:06:01,020 to have a networking card, 174 174 00:06:01,020 --> 00:06:04,350 that can be programmed using field-programmable gate arrays 175 175 00:06:04,350 --> 00:06:06,840 inside of this IP block, and I can build that 176 176 00:06:06,840 --> 00:06:08,970 and then I can sell that to another manufacturer. 177 177 00:06:08,970 --> 00:06:10,140 So as a SoC manufacturer, 178 178 00:06:10,140 --> 00:06:11,580 if I wanted to build a system-on-a-chip, 179 179 00:06:11,580 --> 00:06:13,800 I don't have to go code my own network adapter. 180 180 00:06:13,800 --> 00:06:15,990 I can just go buy one of these IP blocks 181 181 00:06:15,990 --> 00:06:18,900 and embed it into my chip as I'm building my chip. 182 182 00:06:18,900 --> 00:06:20,940 That's how these things work, and because of that, 183 183 00:06:20,940 --> 00:06:23,250 you have code reuse, if you're reusing somebody else's code 184 184 00:06:23,250 --> 00:06:24,600 and you don't know the security of it, 185 185 00:06:24,600 --> 00:06:27,200 again you're bringing insecurities into your system.