Security in System Development
-
Upload
yusifsuleiman -
Category
Documents
-
view
213 -
download
0
Transcript of Security in System Development
-
7/27/2019 Security in System Development
1/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 1
INTERNATIONAL ADVANCE DIPLOMA IN NETWORK &COMPUTER SECURITY
SECURITY IN SYSTEM DEVELOPMENT (CSM202)
ASSIGNMENT
TERM 3 2012
Student declaration:
I declare that:
I understand what is meant by plagiarism The implication of plagiarism has been explained to me by my institution This assignment is all my own work and I have acknowledged any use of the published and unpublished works of other people.
Students signature:. Date: 29\10\2012
Total number of pages including this cover page
Submission Date 29/10/2012 Due Date 06/11/2012
Students ID 2308-0703-0223 Class Code GROUP 1
Students Full Name Yusif Suleiman
Lecturers Name Mr. Ibrahim
OFFICIAL USE ONLY
Markers comments
Markers name Initial mark awarded /100
Penalty on late submission
Penalty for plagiarism
Final mark awarded /100
-
7/27/2019 Security in System Development
2/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 2
Table of Contents
CONTENT PAGESCover ..1
Table of Contents........2
List of Figures..3
List of Tables...3
1.0 Introduction.......5
1.1Description of Vulnerabilities........5What is Vulnerability...5The Web Application Security Gap....5How it Affect the System....6Top Web Application Vulnerabilities & Security Threats..7
1.2Proof of Concept81.2.1 SQL Injection81.2.2 Counter Measures for SQL Injection...121.3.1 CSRF....131.3.2 Counter Measures for CSRF....191.4.1 Denial of Service..20
Modes of Attacks....201.4.2 Counter Measures for DOS..25
2.1 Existing System Function26
2.2 Description of Customers Services......26
2.3 Bank Use Case List......29
2.4 Bank Abuse Case List......30
2.5 Bank Abuse Case Counter Measures ......31
3.1 References...32
-
7/27/2019 Security in System Development
3/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 3
List of Figures, Tables and Diagrams
1. Figure 1.2.1: SQL command to generate a specific error message .82. Figure 1.2.2: Beginning Web Scan...83. Figure 1.2.3: Entering Web Address....94. Figure 1.2.4: Beginning Testing....95. Figure 1.2.5: Vulnerabilities Shown....106. Figure 1.2.6: Final Report....107. Figure 1.3.1: CSRF......138. Figure 1.3.2: Entering Apple web address...149. Figure 1.3.3: Finding Target.....1410.Figure 1.3.4: Login Web Scan..1511.Figure 1.3.5: Completing Login Web...1512.Figure 1.3.6: Beginning Web Scan...1613.Figure 1.3.7: Element of Vulnerabilities..1614.Figure 1.3.8: Vulnerabilities Shown....1715.Figure 1.3.9: Vulnerabilities Shown as CSRF....1716.Figure 1.3.10 Final Report for CSRF....1817.Figure 1.4.1: DOS Starting Point.....2018.Figure 1.4.2: Entering MTN web address...2019.Figure 1.4.3: Finding Target.....2120.Figure 1.4.4: Login Web Scan..2121.Figure 1.4.5: Scan Began.....2222.Figure 1.4.6: Vulnerabilities Shown....2223.Figure 1.3.8: Definition of DOS......2324.Figure 1.4.8: Final Report for DOS Vulnerability...2325.Figure 2.1: First Bank Website.2826.Figure 2.2: First Bank Description of Customer Services....2827.Table 2.1: Use Case Index...2928.Diagram 2.1: Use Case List...2929.Diagram 2.1: Abuse Case List..3030.Diagram 2.1: Abuse Case Counter Measures.31
-
7/27/2019 Security in System Development
4/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 4
Question 1
Identify three (3) possible web (or cloud computing based) application vulnerabilities.
Write a report with the following headings:
- Description of vulnerabilities- Proof of Concept- Possible Counter Measures
Answer
1.0 INTRODUCTION
1.1 DESCRIPTION OF VULNERABILITIES
What is Vulnerability?
Vulnerability is a flaw or weakness in a system's design, implementation, or operation and
management that could be exploited to violate the system's security policy. A threat is a potential
attack that, by exploiting vulnerability may harm the assets owned by an application (resources
of value, such as the data in a database or in the file system). A test is an action that tends to
show vulnerability in the application. Web application vulnerability also refers to Weakness in
Custom Web Application, Architecture, Design, Configuration, or Code.
The Web ApplicationSecurity Gap (How Does It?)
- There is a lack of awareness of application vulnerabilities in security departments.- Security Departments scrutinize the desktop, the network, and even the web servers, but
the web application escapes their measures.
- Even in departments that want to audit for web application vulnerabilities, the lack ofeffective tools has made it impractical
- As a result, Certification and Accreditation programs rarely examine the web application
-
7/27/2019 Security in System Development
5/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 5
- In fact, the entire development cycle is usually missing from security procedures andcontrols
- This illustrates the fundamental gap between security and development, which createsthese web application vulnerabilities
Many traditional information security practitioners are ill-equipped to mitigate applicationsecurity issues
Little to no experience coding
No experience coding in modern enterprise environments like .NET and J2EE
Understand that there are risks, but not in a position to address them or no resources to managethe issues
How it Affect the System
Web Application vulnerabilities occur in different areas: Platform, Administration andApplication.
-The web server itself is subject to a variety of known vulnerabilities, all of which must bereadily patched for.
-
The actual administration and management of the server and contents is very important- A misconfigured server or poorly managed content can permit system file and sourcecode disclosure
- The application itself is of the utmost importance.- It too can inadvertently reveal source code and system files, and even allow full system
access.- It can mistakenly allow replay attacks against your customers.- It could allow a hacker to impersonate your customers.- In addition it is the web application that interacts with the database to manage and tracks
customer information and store business and transaction information .- One slip-up in the web application can expose the entire system and database, right
through a web browser, right over port 80.
-
7/27/2019 Security in System Development
6/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 6
Top Web Application Vulnerabilities and Security Threats
1. Unvalidated input
2. Broken access control
3. Broken authentication and Access Control
4. Cross-site scripting (XSS) Flaws
5. Buffer overflows
6. Injection flaws
7. Improper error handling
8. Insecure storage
9. Application denial-of-service
10. Insecure configuration management
11. SQL injection
12. Parameter tampering
13. Cookie poisoning
14. Buffer overflow
15. Malicious File Execution
16. Insecure Direct Object Reference
17. Cross Site Request Forgery (CSRF)
18. Information Leakage
19.Session Management
20. Insecure Cryptographic Storage
21. Insecure Communications
22. Failure to Restrict URL Access
23. Database Server
-
7/27/2019 Security in System Development
7/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 7
1.2 PROOF OF CONCEPT
I choose to check the following web vulnerabilities for my project
SQL Injection using www.facebook.com
Cross Site Request Forgery (CSRF) www.apple.com
Denial of Services (DOS) www.mtnonline.com
1.2.1 SQL Injection
SQL injection is a very old approach but it's still popular among attackers. This technique allowsan attacker to retrieve crucial information from a Web server's database. Depending on theapplication's security measures, the impact of this attack can vary from basic informationdisclosure to remote code execution and total system compromise. It has been rated fromModerate to Highly Critical
Previously vulnerable products:PHPNuke, MyBB, Mambo CMS, ZenCart, osCommerce
This attack applies to any database, but from an attacker's perspective there are a few "favorites."
MS SQL has the feature of an extended stored procedure call, which allows any system levelcommand to be executed via the MS SQL server such as adding a user. Also, the errormessages displayed by the MS SQL server reveals more information than a comparable MySQLserver. While MS SQL server is not especially prone to a SQL injection attacks, there aresecurity measures which should be implemented to make it secure and not allow the SQL serverto give out critical system information.
Here is an example of vulnerable code in which the user-supplied input is directly used in a SQLquery:
Name:
-
7/27/2019 Security in System Development
8/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 8
$query = "SELECT * FROM users WHERE username = 'steve'";
However, a malicious SQL injection query will result in the following attempt:
$query = "SELECT * FROM users WHERE username = '' or '1=1'";
As the "or" condition is always true, the mysql_query function returns records from the database.A similar example, using AND and a SQL command to generate a specific error message, isshown in the URL below in Figure 1.2.1
Figure 1.2.1
Base on the following Figures we will understand the SQL Injection testing on Facebook webserver using WebCruiser web application vulnerability scanner.
Figure 1.2.2 shows the beginning of how we launch the scanner
-
7/27/2019 Security in System Development
9/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 9
Figure 1.2.3entering the web address to be tested
Figure 1.2.4 beginning of the testing
-
7/27/2019 Security in System Development
10/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 10
Figure 1.2.5 Vulnerabilities shown
Figure 1.2.6 final report: the webcruiser trial version scanner is limited to generate the finalresults.
-
7/27/2019 Security in System Development
11/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 11
It is obvious that the error messages help an attacker to get a hold of the information which theyare looking for (such as the database name, table name, usernames, password hashes etc). Thusdisplaying customized error messages may be a good workaround for this problem, however,there is another attack technique known as Blind SQL Injection where the attacker is still able to
perform a SQL injection even when the application does not reveal any database server errormessage containing useful information for the attacker.
1.2.2 COUNTER MEASURES FOR SQL INJECTION
1. Avoid connecting to the database as a superuser or as the database owner. Always usecustomized database users with the bare minimum required privileges required toperform the assigned task.
2. If the PHP magic_quotes_gpc function is on, then all the POST, GET, COOKIE data isescaped automatically.
3. PHP has two functions for MySQL that sanitize user input: addslashes (an olderapproach) and mysql_real_escape_string (the recommended method). This functioncomes from PHP >= 4.3.0, so you should check first if this function exists and that you'rerunning the latest version of PHP 4 or 5. MySQL_real_escape_string prependsbackslashes to the following characters: \x00, \n, \r, \, ', "and \x1a.
-
7/27/2019 Security in System Development
12/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 12
1.3.1 CROSS SITE REQUEST FORGERY
A CSRF attack forces a logged-on victims browser to send a pre-authenticated request to a
vulnerable web application, which then forces the victims browser to perform a hostile action tothe benefit of the attacker. CSRF can be as powerful as the web application that it attacks inwhich he/she is currently authenticated. With a little help of social engineering (like sending alink via email/chat), an attacker may force the users of a web application to execute actions ofthe attacker's choosing. A successful CSRF exploit can compromise end user data and operationin case of normal user. If the targeted end user is the administrator account, this can compromisethe entire web application.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into loading a page thatcontains a malicious request. It is malicious in the sense that it inherits the identity and privilegesof the victim to perform an undesired function on the victim's behalf, like change the victim's e-
mail address, home address, or password, or purchase something. CSRF attacks generally targetfunctions that cause a state change on the server but can also be used to access sensitive data.
Applications are vulnerable if any of following: Does not re-verify authorization of action Default login/password will authorize action Action will be authorized based only on credentials which are automatically
submitted by the browser such as session cookie, Kerberos token, basicauthentication, or SSL certificate etc.
Eliminate any Cross Site Scripting vulnerabilities Not all CSRF attacks require XSS However XSS is a major channel for delivery of CSRF attacks
Generate unique random tokens for each form or URL, which are not automaticallytransmitted by the browser.
Do not allow GET requests for sensitive actions. For sensitive actions, re-authenticate or digitally sign the transaction.
In this way, the attacker can make the victim perform actions that they didn't intend to, such aslogout, purchase item, change account information, retrieve account information, or any otherfunction provided by the vulnerable website.
Sometimes, it is possible to store the CSRF attack on the vulnerable site itself. Suchvulnerabilities are called Stored CSRF flaws. This can be accomplished by simply storing anIMG or IFRAME tag in a field that accepts HTML, or by a more complex cross-site scripting
-
7/27/2019 Security in System Development
13/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 13
attack. If the attack can store a CSRF attack in the site, the severity of the attack is amplified. Inparticular, the likelihood is increased because the victim is more likely to view the pagecontaining the attack than some random page on the Internet. The likelihood is also increasedbecause the victim is sure to be authenticated to the site already.
CSRF attacks are also known by a number of other names, including XSRF, "Sea Surf", SessionRiding, Cross-Site Reference Forgery, Hostile Linking. Microsoft refers to this type of attack as
a One-Click attack in their threat modeling process and many places in their online
documentation.
Thefollowing sequence of figures describes how I tested the CSRF Vulnerability on Apple store
web site.
Figure 1.3.1
-
7/27/2019 Security in System Development
14/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 14
Figure 1.3.2 shows entering the apple web address
Figure 1.3.3 finding the target web
-
7/27/2019 Security in System Development
15/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 15
Figure 1.3.4 login the web site
Figure 1.3.5 complete login web site for vulnerability scan
-
7/27/2019 Security in System Development
16/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 16
Figure 1.3.6 scanning web began
Figure 1.3.7 elements of vulnerabilities shows
-
7/27/2019 Security in System Development
17/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 17
Figure 1.3.8 many vulnerabilities element
Figure 1.3.9 vulnerability definition as CSRF
-
7/27/2019 Security in System Development
18/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 18
Figure 1.3.10 Final Report results
1.3.2 COUNTER MEASURES FOR CSRF
Countermeasures for CSRF: Client/User
Logoff immediately after using a web application
Do not allow your browser TO SAVE Username/passwords, and do not allow sites to remember
your login
Do not use the same browser to access sensitive applications and to surf freely the Internet; if
you have to do both things at the same machine, do them with separate browsers.
Integrate HTML-enabled mail/browser, newsreader/browser environments pose additional risks
since simply viewing a mail message or a news message might lead to the execution of an attack
Countermeasures for CSRF: Developer
Add session-related information to the URL
Use POST instead of GET
Automatic logout mechanisms
Rely on referrer headers
-
7/27/2019 Security in System Development
19/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 19
1.4.1 DENIAL OF SERVICE
Denial-of-service attack (DOS) is a type of attack on a network that is designed to bring thenetwork resource to its knees by flooding it with useless traffic. Many DoS attacks, such as thePing of Death andTeardrop attacks, exploit limitations in the TCP/IP protocols. For all known
DoS attacks, there are software fixes that system administrators can install to limit the damagecaused by the attacks. But, like viruses, new DoS attacks are constantly being dreamed up byhackers. Another typically used DoS is to send packets with the SYN flag to a server, initiating asession, but not sending a packet with the ACK flag, thereby leaving the server in anunresponsive state as it waits for responses.
Primary goal of the attack is to deny the victim(s) access to a particular resource.Including information that may help you respond to such an attack.
A "denial-of-service" attack is characterized by an explicit attempt by attackers to preventlegitimate users of a service from using that service. Examples include
o attempts to "flood" a network, thereby preventing legitimate network traffico attempts to disrupt connections between two machines, thereby preventing access
to a serviceo attempts to prevent a particular individual from accessing a serviceo attempts to disrupt service to a specific system or person
Not all service outages, even those that result from malicious activity, are necessarily
denial-of-service attacks. Other types of attack may include a denial of service as a
component, but the denial of service may be part of a larger attack.
Illegitimate use of resources may also result in denial of service. For example, an intrudermay use your anonymous ftp area as a place to store illegal copies of commercialsoftware, consuming disk space and generating network traffic
Modes of Attack
Denial-of-service attacks come in a variety of forms and aim at a variety of services.There are three basic types of attack:
o Consumption of scarce, limited, or non-renewable resourceso Destruction or alteration of configuration informationo Physical destruction or alteration of network components
-
7/27/2019 Security in System Development
20/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 20
Figure 1.4.1 shows the starting point
Figure 1.4.2 entering the web site to be tested
-
7/27/2019 Security in System Development
21/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 21
Figure 1.4.3 target checking
Figure 1.4.4 complete login web site for vulnerability scan
-
7/27/2019 Security in System Development
22/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 22
Figure 1.4.5 beginning of scan
Figure 1.4.6 vulnerabilities shown
-
7/27/2019 Security in System Development
23/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 23
Figure 1.4.7 definition of DOS find on the MTN web site
Figure 1.4.8 Final vulnerability result report forwww.mtnonline.com
-
7/27/2019 Security in System Development
24/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 24
1.4.2 COUNTER MEASURES FOR DOS
Defending against Denial of Service attacks typically involves the use of a combination of attack
detection, traffic classification and response tools, aiming to block traffic that they identify asillegitimate and allow traffic that they identify as legitimate. A list of prevention and responsetools is provided below:
Firewalls
Firewalls have simple rules such as to allow or deny protocols, ports or IP addresses. Some DoSattacks are too complex for many firewalls, e.g. if there is an attack on port 80 (web service),packet filter firewalls cannot prevent that attack because they cannot distinguish good trafficfrom DoS attack traffic. Additionally, firewalls may be too deep in the network hierarchy.Routers may be affected before the traffic gets to the firewall. Nonetheless, firewalls can
effectively prevent users from launching simple flooding type attacks from machines behind thefirewall.
Switches
Most switches have some rate-limiting and ACL capability. Some switches provide automaticand/or system-wide rate limiting, traffic shaping, delayed binding (TCP splicing), deep packetinspection and Bogon filtering (bogus IP filtering) to detect and remediate denial of serviceattacks through automatic rate filtering and WAN Link failover and balancing.
These schemes will work as long as the DoS attacks are something that can be prevented by
using them. For example SYN flood can be prevented using delayed binding or TCP splicing.Similarly content based DoS can be prevented using deep packet inspection. Attacks originatingfrom dark addresses or going to dark addresses can be prevented using Bogon filtering.Automatic rate filtering can work as long as you have set rate-thresholds correctly andgranularly. Wan-link failover will work as long as both links have DoS/DDoS preventionmechanism.
Routers
Similar to switches, routers have some rate-limiting andACL capability. They, too, are manuallyset. Most routers can be easily overwhelmed under DoS attack. If you add rules to take flowstatistics out of the router during the DoS attacks, they further slow down and complicate thematter. Cisco IOS has features that prevent flooding.
Application front end hardware
Application front end hardware is intelligent hardware placed on the network before trafficreaches the servers. It can be used on networks in conjunction with routers and switches.
-
7/27/2019 Security in System Development
25/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 25
Application front end hardware analyzes data packets as they enter the system, and thenidentifies them as priority, regular, or dangerous. There are more than 25 bandwidth managementvendors. Hardware acceleration is key to bandwidth management.
IPS based prevention
Intrusion-Prevention Systems (IPS) are effective if the attacks have signatures associated withthem. However, the trend among the attacks is to have legitimate content but bad intent.Intrusion-prevention systems which work on content recognition cannot block behavior-basedDoS attacks.
An ASIC based IPS can detect and block denial of service attacks because they have theprocessing power and the granularity to analyze the attacks and act like a circuit breaker in anautomated way.
A rate-based IPS (RBIPS) must analyze traffic granularly and continuously monitor the traffic
pattern and determine if there is traffic anomaly. It must let the legitimate traffic flow whileblocking the DoS attack traffic.
DDS based defense
More focused on the problem than IPS, a DoS Defense System (DDS) is able to blockconnection-based DoS attacks and those with legitimate content but bad intent. A DDS can alsoaddress both protocol attacks (such as Teardrop and Ping of death) and rate-based attacks (suchas ICMP floods and SYN floods).
Like IPS, a purpose-built system, such as the well-known Top Layer IPS products, can detect
and block denial of service attacks at much nearer line speed than a software based system.
-
7/27/2019 Security in System Development
26/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 26
Question 2
You are to create use case and abuse case analysis; and counter measures for the abuse casesystem.
Your task:
Study an existing systems function.
Choose a function of the system and write a description of it (including print screens).
Create use-case list (use your slides as a guide of structure).
For each use-case create a list of abuse-case.
For each abuse-case, create a counter measures for it.
Answer
2.1 EXISTING SYSTEM FUNCTION
First Bank of Nigeria PLC is a Nigeria-based bank that offers a range of financial services. The
Bank is divided into three business segments: Corporate banking, Personal banking and e-
banking Services. Its products are targeted at corporate and individuals customers. The Bank
operates through several subsidiaries, providing a range of banking services, including corporate
banking, capital market operations, funds management, insurance brokerage, trusteeship,
registrar ship and pension custodianship.
2.2 DESCRIPTION OF CUSTOMER SERVICES
First Bank offer banking services to individuals, consumer banking is also provision of products
and services to meet the financial needs of individuals with a steady and verifiable income flow.Here are some of our Consumer Banking Products;
U-First
U-First is a suite of retail and consumer loan products designed for individuals and smallbusinesses to enable them meet their business and personal needs.
-
7/27/2019 Security in System Development
27/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 27
Generic Savings Account
It is a hybrid savings account that runs on a savings platform with current account features foryour convenience.
Generic Current Account
With FirstBanks current account, you just cant go wrong. You can carry out unlimited 3rdparty transactions seamlessly and enjoy the inherent benefits.
FirstPremium Term Deposit Account
FirstPremium Term Deposit is a value-added term deposit product which offers higher interestrates than the conventional term deposit
First Savings Plus Account
It is a hybrid savings account that runs on a savings platform with current account features foryour convenience.
First Hi-Fi (Children) Account
This is a special account designed for children from age 0 18 years to sensitize and cultivatesavings culture within this age bracket and to help parents plan towards the future of theirchildren and wards.
FirstCurrent Plus (Zero COT Account)
Withdrawal is limited to five (5) times in a month, where a customer exceeds the number ofwithdrawals, the account will default to N5.00/mille COT on the total customer inducedtransactions for that month
FirstCurrent Business Account
A fee-based current account that allows customers carry out numerous transactions withoutpaying COT.
FirstDom Account
Are you upwardly mobile? Then First Dom Plus is designed for you. It is an account thatencourages you to save your foreign currency while still giving you the opportunity to earnhigher interest on account balances.
-
7/27/2019 Security in System Development
28/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 28
FirstInstant Account
The FirstInstant Account is savings product designed for the unbanked and underbanked toenhance financial inclusion
Figure 2.1 First Bank Web Site
Figure 2.1 First Bank Description of Customer Services
-
7/27/2019 Security in System Development
29/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 29
2.3 BANK USE CASE LIST
In software and systems engineering, a use case is a list of steps, typically defining interactionsbetween a role (known in Unified Modelling Language UML as an "Actor") and a system, toachieve a goal. The actor can be a human or an external system.
In systems engineering, use cases are used at a higher level than within software engineering,often representing missions or stakeholder goals. The detailed requirements may then becaptured in SysML or as contractual statements
Use-Case List
Bank Officer
Bank Customer Session/Counter
Perform
transaction
Keep Account
Data Up to date
Withdrawal
Inquiry
Deposit
Transfer
Integrity of
transaction
Perform
online
transaction
Pay
Money
Use-Case Index
Use case ID Use case Name Primary Actor Scope Priority
1 Update account data Bank officer In 1
2 Deposit Bank customer In 1
3 Withdrawal Bank customer Out 1
4 Inquiry Bank customer Out 2
-
7/27/2019 Security in System Development
30/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 30
2.4 BANK ABUSE-CASE LIST
Abuse-case is a process of intentional use of computer system to crack unauthorized datafrom government computer database, financial centers and school information systems.
Computers as a tools like any other tools can be used by people with intent of causingdamage or carrying out some form of illegal activities. There are a number of ways inwhich computers can be used by attacker for crime. For e.g. real world crimes such asforgery, fraud, piracy, damaging or modifying computerised systems. Computers and theInternet are complex, but they function on a very narrow set of technical principles. Thisprovides great flexibility, but makes it very difficult for activity of one without affectingothers and to categorise the misuse of any one of them.
Abuse-Case List
Bank Officer
Attacker
Bank CustomerSession/Counter
Perform
transaction
Keep Account
Data Up to date
Withdrawal
Inquiry
Deposit
Transfer
Integrity of
transaction
Perform
online
transaction
Unsecure
network
medium
Intercept
Money
Change
details of
transaction
Transfer Money
to another
account
Money transfer toUnintended account
-
7/27/2019 Security in System Development
31/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 31
2.5 BANK ABUSE-CASE COUNTER MEASURES
Abuse-Case Countermeasures address vulnerabilities to reduce the probability of attacks or theimpacts of threats. They do not directly address threats; instead, they address the factors thatdefine the threats, and can have a different impact on attacks. A countermeasure can alleviate theeffect of a vulnerability, patch it, or prevent malicious tasks or systems functionalities that bringthe vulnerabilities. These impacts are modeled through alleviate, patch, and prevent linksrespectively. The following diagram will show how links are protected in order to stop attackersgaining access customers bank details.
Abuse-Case Counter Measures
Bank Officer
Attacker
Bank CustomerSession/Counter
Perform
transaction
Keep Account
Data Up to date
Withdrawal
Inquiry
Deposit
Transfer
Integrity of
transaction
Perform
online
transaction
Use secure
network
Protocol
Make online
service
unavailable
Change
details of
transaction
Transfer Moneyto another
account
Install IP Filtering &
Firewall
Ensure
Account
Privacy
Apply
Cryptographic
Procedure
Diagram 2.4
-
7/27/2019 Security in System Development
32/33
Y USI F SU L E I MA N [2308-0703-0223]
CSM202 SECURITY IN SYSTEM DEVELOPMENT Page 32
3.1 REFERENCE
1. Justin Seitz (2009). Gray Hat Python: Python Programming for Hackersand Reverse Engineers. Immunity, Inc 1st edition.
2. Marcus Pinto (2011). The Web Application Hacker's Handbook: Findingand Exploiting Security Flaws. 2ndedition
3. Ahmed, N., Matuleviius, R., Mouratidis, H. (2012) A ModelTransformation from Misuse Cases to Secure Tropos. In: Proc of theCAiSE12 Forum at the 24th International Conference
4. Wikipedia the free encyclopedia. (2012)http://en.wikipedia.org/wiki/Use_case
5. Wiki Answer Copyright 2012.http://wiki.answers.com/Q/What_is_Denial_of_Service_attackAnswers.com Denial of Service attack. Answers Corporation
6. Webopedia(2012). http://www.webopedia.com/TERM/D/DoS_attack.html7. CERT/CC(2012) http://www.cert.org/tech_tips/denial_of_service.html
CERT Coordination Center, Software Engineering Institute,CarnegieMellon University
8. Mark Dowd, John McDonald, Justin Schuh (2006). The Art of SoftwareSecurity Assessment: Identifying and Preventing Software Vulnerabilities.Addison-Wesley Professional; 1 edition
9. Cadoree, Michelle. (1994). Computer Crime and Security. Washington,D.C.: LC Science Tracer Bullet
-
7/27/2019 Security in System Development
33/33
Filename: CSM202Proj
Directory: C:\Users\YUSUF
Template: C:\Users\YUSUF\AppData\Roaming\Microsoft\Templates\Normal.dotm
Title:
Subject:
Author: compaq
Keywords:
Comments:
Creation Date: 10/24/2012 10:39:00 AM
Change Number: 27
Last Saved On: 10/25/2012 9:51:00 PM
Last Saved By: YUSUF
Total Editing Time: 2,036 Minutes
Last Printed On: 11/6/2012 10:05:00 AM
As of Last Complete Printing
Number of Pages: 32
Number of Words: 4,487 (approx.)
Number of Characters: 25,578 (approx.)