The Importance of Secure by Design
“System architects and engineers dealing with secure systems have a critical responsibility to ensure that software, whether purchased, newly developed, or modified, has been built and tested using best practices to eliminate security flaws” (Home, 2018, p. 345).
I was first introduced to the concept of “Secure by Design” while watching a CISA video about protecting critical infrastructure. The speaker emphasized that the responsibility for ensuring security and proper use should lie with the software producer, not the end user. This means features like Multi-Factor Authentication (MFA) and Single Sign-On (SSO) should be required out of the box.
This idea interested me, especially considering the many CyberWire episodes I’ve heard discussing breaches. Often, threat actors infiltrate the most vulnerable accounts – those without multi-factor authentication – and escalate privileges from there.
As I though about how to improve my understanding and implementation of these principles, I also considered potential projects for our cybersecurity club. Starting this club was important to me, but I wanted to ensure members would gain something valuable for themselves. It is important to take everyone’s desires and interests into account.
One piece of feedback we received was the desire for “projects to be able to add to our GitHub to show our understanding of topics.” I realized we could address both the GitHub aspirations of our club members and my desire for us to learn about secure design by creating an application together.
To kickstart our project and avoid stunting our initial productivity at the beginning of the semester when everyone’s classes were starting, I individually built a baseline application. This standard application will serve as our starting point, allowing the club to collectively alter and improve it throughout the semester.
Our project is a file-sharing application with baseline secure design principles. We plan to add more security features and principles as we progress, guided by the cybersecurity club. Those interested in penetration testing can audit the app, while those more focused on building secure systems can work on improvements based on these audits. Ultimately, we should all have a product we can be proud of.
Implementing these features required me to research their importance. While I’ve included some brief information here, further research will provide a deeper understanding of these security measures.
The principles we’re keeping in mind come from “Protecting Information with Cybersecurity” by John M. Borky and Thomas H. Bradley (2019):
- Deploy software that is inherently hard to attack, free of exploitable flaws, with prompt patching of discovered vulnerabilities.
- Deploy software in a robust layered defense environment that minimizes the chances of an attacker gaining access.
01
Password length requirements
Password length requirements are crucial for secure by design principles as they enforce a minimum level of complexity in user credentials. Longer passwords are exponentially harder to crack through brute force attacks, significantly enhancing the overall security of user accounts.
02
Secure password hashing using PBKDF2 with SHA-256
Secure password hashing is essential in protecting user credentials even if the database is compromised. PBKDF2 with SHA-256 is a robust hashing algorithm that adds computational complexity, making it extremely difficult for attackers to reverse-engineer passwords from stored hashes.
03
CSRF protection (Cross-Site Request Forgery prevention)
CSRF protection is a key secure by design principle that prevents attackers from tricking users into performing unintended actions on a web application. By implementing CSRF tokens, the application ensures that requests originate from legitimate sources, maintaining the integrity of user actions.
04
Encryption of files on input and decryption only upon download
Encrypting files on input and decrypting only upon download is crucial for protecting sensitive data at rest and in transit. This approach ensures that even if unauthorized access to the storage system occurs, the data remains unreadable without the proper decryption keys.
The Cybersecurity Club’s Focus
Penetration Testing Team
- Including risk-based security vulnerability testing and scanning during development and system testing.
- Retesting regularly for security and patching any discovered or reported vulnerabilities.
- Performing penetration testing during system test and operations.
Software Development Team
- Including security risk analysis in requirements, architecture, and design.
- Incorporating testable security functions and features in requirements.
- Including security functions and features in the design.
- Integrating vulnerability detection in design and code reviews.
- Implementing software on secure, hardened servers with no programmer access to the production environment.
By integrating these principles, we should learn a lot over the semester. While I’m unsure of specific timelines, you can keep up with our progress by following the GitHub repository. The baseline project I’ve created provides a solid foundation, and I’m excited to see how our club members will collectively enhance and secure it further.