Inspection guidelines to identify security design flaws

Abstract

Recent trends in the software development practices (Agile, De-vOps, CI) have shortened the development life-cycle causing the need for efficient security-by-design approaches. In this context, software architectures are analyzed for potential vulnerabilities and design flaws. Yet, design flaws are often documented with natural language and require a manual analysis, which is inefficient. Besides low-level vulnerability databases (e.g., CWE, CAPEC) there is little systematized knowledge on security design flaws. The purpose of this work is to provide a catalog of security design flaws and to empirically evaluate the inspection guidelines for detecting security design flaws. To this aim, we present a catalog of 19 security design flaws and conduct empirical studies with master and doctoral students. This paper contributes with: (i) a catalog of security design flaws, (ii) an empirical evaluation of the inspection guidelines with master students, and (iii) a replicated evaluation with doctoral students. We also account for the shortcomings of the inspection guidelines and make suggestions for their improvement with respect to the generalization of guidelines, catalog re-organization, and format of documentation. We record similar precision, recall, and productivity in both empirical studies and discuss the potential for automating the security design flaw detection.

An Asset-Based Assistance for Secure by Design

“…Four case studies are discussed in [10] using a strategic, system-wide architectural approach, implemented as a security framework. Guidelines are proposed to detect security design flaws in [31]. Both of them lack an automatic process as well.…”

Towards Automated Security Design Flaw Detection

“…This work is based on the catalog of security design flaws proposed by Malamas and Hosseini [6] (and later re-evaluated by Tuma et al [14]). We briefly summarize the contents and origin of this catalog, and zoom into a single security design flaw, namely "Insecure Data Exposure", which is used extensively throughout this paper.…”

“…Another resource from MITRE is CAPEC [5] which provides this information from an attacker perspective. Finally, the issues of similar flaws (Section V-B) have led Tuma et al [14] to do a re-evaluation of the security catalog and they suggest several improvements to reduce overlap between the flaws. While the above catalogs provide an extensive set of issues to identify, applying that knowledge a concrete application's design model requires translating this knowledge to practical detection rules, linked to a suitable system description that supports automatic assessment.…”

“…However, while there are numerous resources available that catalog the potential security issues [2]- [6], [12]- [14], their application in a concrete system design context remains a challenge. The purpose of this work is to identify the necessary requirements for architectural models that allow automatic detection of security design flaws, based on an existing catalog of 19 security design flaws [6].…”