ID 113 Andrzej Bialas - Patterns-based development of IT security

20 Pages·2010·0.54 MB·English

by  Andrzej Białas

Patterns-based development of IT security
evaluation evidences
– the concept, first results and future plans of the CCMODE R&D
Project (Common Criteria compliant, Modular, Open IT security
Development Environment)
Andrzej Bialas
The 11th International Common Criteria Conference
September 21-23, 2010, Antalya
Andrzej Bialas, Eng., PhD,
Information Security Centre
 IT Security development (Common Criteria)
and supporting tools (CCMODE, national R&D
project)
 Business continuity/ information security
management systems and supporting tools
(OSCAD, national R&D project)
 Advanced risk mangement methodology and
tools (VALUESEC, EU FP7 project)
Institute of Innovative Technologies EMAG
tel.: [phone]
e-mail: [email protected]
ul. Leopolda 31,
http://www.emag.pl
40-189 Katowice, POLAND
2
CCMODE Project objectives:
1. Elaboration of the CC-based methodology and tools
for development environments (sites)
of IT security-enhanced products and systems
2. Automation of the IT security development processes
Project - national aspects
to support the implementation of the Common Criteria standard in Poland
– organizing the CC community, disseminating knowledge, methodology
and best practices, etc.
Project - wider aspects
participation in activities aimed at improving the Common Criteria
methodology and extending the range of the standard application
3
y 1 ITSDF_ITSecurityDevelopmentFramework SL_SecurityLibrary
t
i T 1 1
r *
u S 1 1
Existing UML model of the
c security-related
: ST_Elaboration
e e BCLWorkout product or system
+<<stateAttribute>> (EUM_EntryUMLmodel) SM_SecurityModel
S l +<<stateAttribute>>
p +develstage : byte
+stagestatus : byte
+createST() BCL_BusinessConsumerLevel
T m 1 1 +forward() el
+openExistingST() d
+back() o
I de axE +saveS1T() STIntroWorkout STIntroduction S11T_SecurityTarget res of he ST m
sab k– ent 1 ++++fb<sota<arcwsgktaea()rstdeta(A)ttutrsib :u btyet>e> +T<O<EsStaetecAEtntrvibEulateb>o>ration TOESecurityEnvir1onment 1 data structumodel and t
L- r atepm +stagestatus : byte ng CL
M o medivelo TOESecObjElaboration ++fboar1cwka(r)d() 1 entie B
U:seh wemar nsible for the interd the ST model de ++++fb<sota<arcwsgktaea(r)stdeta(A)ttutrsib :u btye1t>e> 1 ++T<sOt<aEsgRteaesteqtaAsttEutrsliab :bu boteyrt>ae>tion SSeeccurirtiytRyOeqbujeircetimveesnts11 Classes represthe intermediat
c F on
pa
rae tn es resmodel 1 +<T<SsStaEtelaAbttorirbautitoe>n> ++fboarcwka(r)d() 1
s e assCL +stagestatus : byte TSS_TOESummarySpecification
e m ClB +forward()
r
1 +back() PreparePPclaims
y
p +<<stateAttribute>>
r STRationaleElaboration PPclaims 1
a o 1+stagestatus : byte
n +<<stateAttribute>> +forward() STRationale 1
l
i e +stagestatus : byte +back()
m
v +forward()
i +back()
l e
e
D
r Classes responsible Classes representing
P
for the ST elaboration specification data containers
4
UML-based IT Security Development
Preliminary researches:
Framework – ST elaboration as the FSM
EUMexists
EUM analyzing
Done
BCL workout
back(develstate) EUM - Existing UML model is an input for the BCL model.
When EUM does not exist, the BCL is elaborated
forward(develstate)
straight on the user's requirements
ST introduction workout
Every development stage (stagestatus state attribute) can be
#ELABORATED ("Under development"),
back(develstate) forward(develstate) #CHECKED ("Stage positively checked - ready for the rationale", Done
#CLOSED ("All stages checked and the rationale finished")
TSS rationale
TOE security environment
back(develstate)
forward(develstate)
forward(develstate)
back(develstate)
The develstage state attribute points at
Security requirements rationale
the current development stage
TOE security objectives
forward(develstate)
back(develstate)
forward(develstate)
back(develstate)
Security objectives rationale
2 state attributes:
TOE requirements elaboration forward(develstate)
Develstage forward(develstate) back(develstate)
back(develstate) forward(develstate)
and stagestatus
Prepare PP claims
back(develstate)
TSS for ST workout
Białas A.: Semiformal Common Criteria Compliant IT Security Development Framework. Studia
Informatica vol. 29, Number 2B(77), Silesian University of Technology Press, Gliwice 2008.
Enhanced generics – a language
Preliminary researches:
for the security specification – definition, features
mnemonic names that express common features, behaviours
or actions of different IT security aspects or elements.
Format:
[domain.][group.]family.mnemonic[derived][instance].description[.refinement][.attributes][.operation]
Enhanced generics features:
 Parameterization of generics  Grouping generics by their
domains of application
 Operations on generics – iteration,
refinement, assigning value to  Assigning attributes
parameter or leaving it uncompleted
 Building generics chains –
 Defining any generic on the basis proposing solutions to elementary
of the other (derivation) security problems
BiałasA.: IT security development – computer-aided tool supporting design and evaluation. W: Kowalik J., Górski J., SachenkoA.
(eds.): Cyberspace Security and Defense. vol. 196, Springer Verlag, Heidelberg 2005, s. 3-23.
BialasA.: Semiformal framework for ICT security development. The 8th International Common Criteria Conference (ICCC). Rome,
25-27 September 2007.
Enhanced generics example – – smart card
(iteration)
[domain.][group.]family.mnemonic[derived][instance].description[.refinement][.attributes][.operation]
CrpAnal_I0:TDAItem
TDA.CrpAnal_I0.
Card attacker [paramSNA <=SNA.HighPotenIntrud] may compromise [paramDAD
<=DAD.PlainText] – user data being encrypted by the TOE or the key needed to calculate
the plain text from cipher text.
DAD.PlainText
SNA.HighPotIntrud
DAD.EncKey_D2
TDA.CrpAnal_I1.
CrpAnal_I1:TDAItem
Card attacker [paramSNA <=SNA.HighPotenIntrud] may compromise [paramDAD
<=DAD.EncKey_D2] – user data being encrypted by the TOE or the key needed to
calculate the plain text from cipher text.
Both instances are covered by:
OCON.BlockCipher.
The TOE will ensure the confidentiality of keys during
a cryptographic function performed by the TOE
Example based on ”ST BSI-DSZ-CC-0153: First Evaluation of Philips
P8WE5032 Secure 8-bit Smart Card Controller, Philips Semic. Hamburg” 7
Ontological approach/knowledge base
Preliminary researches:
– Security Problem Definition for the motion sensor
Białas A., Ontological approach to the motion sensor security development, Electrical Review (Przegląd
Elektrotechniczny), ISSN 0033-2097, vol. 85 (R.85), Number 11/2009, pp. 36-44, Sigma-NOT, Warsaw (2009).
Ontological approach/knowledge base
Preliminary researches:
– evaluation evidences for the firewall example
Białas A., Ontological approach to the IT security development process. In: Tkacz, E; Kapczynski, A. (Eds.) Internet – Technical
Development and Applications Series: Advances in Intelligent and Soft Computing , Vol. 64 2009, Springer Verlag Berlin-
Heidelberg, ISBN: 978-3-642-05018-3 , pp. 261-270.
CCMODE project tasks
1.Research of development environments of IT security-enhanced products
with respect to life cycle processes – identification of developers’ needs and
expectations, a reference model
2.Working out an open, modular development (manufacturing, maintenance)
environment – patterns developed for evidence material related to the
environment and to the product developed in this environments
3.Working out a methodology for implementation and management of
development environments – how to adapt open patterns to the identified
needs, how to develop an environment based on these needs, and how to
manage this environment
4.Validation of the implementation methodology – with the participation of
security developers and evaluators
5.Working out a tool to support the development environment management –
automation of difficult and repeatable operations
6.Validation of the tool supporting the management of development
environments – with the participation of security developers and evaluators
7.Creating an experimental development environment
10