Narrator: Platform best practices. 2 2
In this lesson, we are going to talk 3 3
about some platform specific best practices 4 4
and some of the vulnerabilities you may experience. 5 5
Now, when you're thinking about different platforms, 6 6
we have lots of them 7 7
including client/server applications, web applications, 8 8
mobile applications, embedded applications, firmware, 9 9
and system-on-a-chip or SoC. 10 10
We've talked about all of these areas before in this course, 11 11
but now we're going to think about it 12 12
\from a software development perspective. 13 13
Now, when you're dealing with a client/server application, 14 14
this is an application where part of the application 15 15
is client software that's installed and run 16 16
on a separate piece of hardware, 17 17
and then you have a server application 18 18
that's installed on a server 19 19
and they're going to interact between the two over a network. 20 20
Now, why is this dangerous? 21 21
Well, because attacks can be directed 22 22
in one of three places. 23 23
They can be directed at the local client code 24 24
on the workstation 25 25
or at the server application on the server, 26 26
or the network in between. 27 27
And so you really have to think through this fully 28 28
because you have three places that there could be attacks. 29 29
For instance, if I install a piece of software 30 30
and it's the most secure piece of software in the world, 31 31
but I install it on a laptop that already has malware 32 32
or a root kit, well guess what? 33 33
That software is now going to be insecure 34 34
because the underlying operating system 35 35
has already been compromised. 36 36
And so when you're doing all this, 37 37
you have to think about the client system 38 38
and you need to make sure it's secured 39 39
with the right scanning and patching 40 40
and any malware solutions. 41 41
And the same thing with the server 42 42
and the same thing with the network. 43 43
If you can't secure all three places, 44 44
regardless of whether or not your code is secure, 45 45
you're going to have an insecure environment. 46 46
Now, when you're dealing with server side code, 47 47
you always want to make sure that whatever you're accepting 48 48
from somebody needs to go through input validation. 49 49
This will prevent things like buffer overflow attacks 50 50
or integer overflows. 51 51
This is a really important thing. 52 52
Input validation in CYSA is a great thing to use. 53 53
And when you see it on questions, 54 54
it's pretty much the right answer at least 75% of the time. 55 55
So when you see input validation, think about it, 56 56
because anytime you're trying to prevent something 57 57
like an SQL injection, an XML injection, an overflow attack, 58 58
anything that's taking information from a client 59 59
and going to a server, 60 60
you always want to have input validation. 61 61
The next area we want to talk about is web applications. 62 62
Now, web applications are any applications 63 63
which use a generic web browser as the client 64 64
and that uses standard network protocols 65 65
like HTTP or HTTPS to communicate with the server. 66 66
This is really a client server application 67 67
except that that application doesn't get installed 68 68
on the client because the client is just a web browser 69 69
that's accessing it. 70 70
Now, web applications can use a multi-tiered architecture 71 71
where the server part is split between application logic 72 72
and then data storage and retrieval. 73 73
This way, you have application logic that makes decisions 74 74
and data storage and retrieval like a database. 75 75
This is a very typical setup 76 76
when you're dealing with a multi-tier. 77 77
My website is actually built this way. 78 78
It is a web application, 79 79
and we use a multi-tier architecture. 80 80
We have our front end, 81 81
which is what you actually see the course on 82 82
and take your quizzes on. 83 83
But then we have the backend, 84 84
which is the data storage and retrieval 85 85
that's all stored in the database. 86 86
So we know that you took this quiz and you got this score 87 87
and we can look back in that over time. 88 88
Now, when you're dealing with modern web applications, 89 89
a lot of them don't even use servers anymore. 90 90
They use what's called microservices or serverless designs. 91 91
I have a couple of web applications 92 92
that I use that actually are serverless. 93 93
They're not ones that our clients use or our students use. 94 94
It's something we use for backend systems and bookkeeping. 95 95
But those same principles apply 96 96
because we're dealing with these modern web applications 97 97
that are serverless in their design. 98 98
The next area we want to talk about is mobile applications. 99 99
And this is any application that's deployed and run 100 100
on a smartphone, a tablet, or other mobile operating system. 101 101
So if you've got a smartwatch, 102 102
it considers itself a mobile application. 103 103
Now, when we talk about mobile applications, 104 104
these are often more susceptible 105 105
to unsecure use of authentication, 106 106
authorization and confidentiality controls. 107 107
These mobile devices are definitely vulnerable 108 108
to attacks launched from the use 109 109
of open wireless access points as well. 110 110
A lot of times people take their device 111 111
and they connect to the local coffee shop. 112 112
They don't think about the fact 113 113
that that network is not secure. 114 114
So even if your mobile application is secure, 115 115
if it's going over an unsecure network, 116 116
there's a possibility for infiltration. 117 117
So you want to keep this in mind. 118 118
The next thing we want to talk about is embedded applications. 119 119
Now, embedded applications are any applications 120 120
which are designed to run on dedicated hardware platforms. 121 121
When we talked about things like ICS and SCADA, 122 122
we talked about these manufacturing systems, 123 123
we talked about smart TVs. 124 124
These are all examples of embedded applications. 125 125
Now, the problem with embedded applications 126 126
like we've talked about before 127 127
is that they traditionally are not focused on security 128 128
during development and deployment. 129 129
And so a lot of bugs can exist, 130 130
and a lot of these are very old technologies 131 131
that have not been updated in quite some time. 132 132
So if you have embedded applications in your network, 133 133
think about this and think about how you can protect them. 134 134
If you happen to be responsible 135 135
for embedded application development, go check out OWASP. 136 136
They have a great guide 137 137
on showing you how you can do this more securely. 138 138
And then we have firmware. 139 139
Now, firmware is generally considered 140 140
a type of embedded application 141 141
that contains the block of embedded code 142 142
that's run at first startup, 143 143
things like your BIOS, if you want to think about that. 144 144
This also performs low level input/ output device functions, 145 145
plus bootstrapping of an operating system or application. 146 146
So when we're dealing with firmware, 147 147
we are dealing with something that starts up 148 148
right at the beginning. 149 149
And so this makes it a great target for attackers, 150 150
because if they can get access to the firmware, 151 151
that firmware has complete control 152 152
over the hardware and system memory. 153 153
The last thing we're going to talk about is system-on-a-chip. 154 154
This is also known as SoC. 155 155
This is a type of embedded application 156 156
commonly used in mobile devices, 157 157
which contains integrated CPUs, memory, graphics, 158 158
audio, networks, storage controllers, 159 159
and software all on one chip. 160 160
Now, the great thing about system-on-a-chip 161 161
is they're low power, right? 162 162
And they have really good efficiency 163 163
when they're being able to use processing. 164 164
But these manufacturers often will reuse a lot of code. 165 165
So the SoC manufacturers will often reuse code 166 166
by selecting what's known as an IP block 167 167
for certain functions, 168 168
and they make these up using field-programmable gate arrays. 169 169
Now, what are these IP blocks? 170 170
Well, an IP block is a set of configurations 171 171
that uses SoC logic gates to achieve a function. 172 172
So if I wanted to make sure there was the ability 173 173
to have a networking card, 174 174
that can be programmed using field-programmable gate arrays 175 175
inside of this IP block, and I can build that 176 176
and then I can sell that to another manufacturer. 177 177
So as a SoC manufacturer, 178 178
if I wanted to build a system-on-a-chip, 179 179
I don't have to go code my own network adapter. 180 180
I can just go buy one of these IP blocks 181 181
and embed it into my chip as I'm building my chip. 182 182
That's how these things work, and because of that, 183 183
you have code reuse, if you're reusing somebody else's code 184 184
and you don't know the security of it, 185 185
again you're bringing insecurities into your system.