Chapter 11: Managing Application Security

One of the main tasks that the cybersecurity team deals with is the management of applications used within the company, to ensure that they have no vulnerabilities and have been hardened. In this chapter, you will learn to deploy and manage applications effectively and select the appropriate development life cycle. You will learn about secure coding techniques, quality control, and testing. Let's begin by looking at implementing hosts and ensuring that they are secure before rolling them out.

In this chapter, we will cover the following topics:

• Implementing Host or Application Security
• Understanding the Security Implications of Embedded and Specialist Systems
• Understanding Secure Application Development, Deployment, and Automation

Implementing Host or Application Security

Within an organization, we use laptops, desktops, servers, and mobile devices such as tablets that can be used externally in unsecured environments such as hotels and airports. We, therefore, need to harden endpoints and their Operating System (OS) to ensure that they are as secure as we can possibly make them. There are various aspects that we need to look at, depending on the functionality of the device and where it is used. Let's look at all of the aspects that we need to take into consideration, starting with a system booting up.

Boot Integrity

When hosts are booting up, we need to ensure that they are protected as much as possible. We rely on them for being able to boot up securely before they are fully operational, and all of their protections are in place. We will now look at the UEFI and boot attestation:

• Unified Extensible Firmware Interface (UEFI): The UEFI is a modern version of the Basic Input/Output System...

Understanding the Security Implications of Embedded and Specialist Systems

An embedded system has its own software built into the device hardware. Some are programmable and some are not. Embedded systems are found in consumer products used for health monitoring, automotive, medical, and household products. Some examples follow in the next section.

Internet of Things (IoT)

IoT comprises small devices, such as ATMs, small robots, and wearable technologies, that can use an IP address and connect to internet-capable devices. We must ensure that we change the default usernames and passwords for these devices to prevent someone from hacking them. From a security point of view, supporting IoT items is a nightmare because of the diversity of the devices. Most users of IoT devices are not aware that they have default usernames and passwords, and so they are vulnerable to attack. You should change the default settings immediately after purchase.

Let's look at some of these devices...

Understanding Secure Application Development, Deployment, and Automation

There are two main models of the Software Development Life Cycle (SDLC), the first being an older version that is called Waterfall, where each stage is completed before the next stage commences. This is known as a cascade model. The newer, faster, and more flexible model is called Agile, which is similar to Scrum, where several stages of development can occur simultaneously. Agile is customer-focused, and each part of the project is called a sprint that has many tasks assigned to it. If you have three stages, then there are three sprints. Say each sprint has three tasks. The project concludes when all tasks within each sprint are complete, making that sprint complete. The whole project is complete when all of the sprints are complete.

Before applications can be used in a production environment, we must ensure that they are as secure as possible so that we mitigate the risk of being attacked by an outside agency...

Review Questions

Now it's time to check your knowledge. Answer the questions, and then check your answers, which can be found in the Solutions section at the end of the book:

1. Name three types of mobile device connection methods
2. What is an embedded electronic system? Give two examples.
3. What is the purpose of a SCADA system?
4. What category of devices are smart TV and wearable technology?
5. What is home automation?
6. What is the purpose of SoC?
7. If a process does not suffer buffer overflow but fails within a specified period of time, which causes the process to fail, what method are you using?
8. What is the most likely way an attacker would gain control of an MFP?
9. What is the purpose of the security team controlling the HVAC in a data center?
10. Someone at work has suffered a cardiac arrest and the first aid delegate takes out a defibrillator that gives instructions of the steps to take. What had been built into the device to give these instructions...