보안기능의 무력화 공격을 예방하기 위한 위협분석 기반 소프트웨어 보안 테스팅
Threat Analysis based Software Security Testing for preventing the Attacks to Incapacitate Security Features of Information Security Systems
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
정보보안시스템을 무력화하는 공격이 나타남에 따라, 정보보안제품의 취약성을 분석하는 보안 테스팅에 대한 관심이 높아지고 있다. 보안제품 개발의 주요 단계인 침투 테스팅은, 공격자가 악용할 수 있는 취약성을 찾기 위해 컴퓨터 시스템을 실제적으로 테스팅하는 것이다. 침투 테스팅과 같은 보안 테스팅은 대상 시스템에 대한 정보 수집, 가능한 진입점 식별, 침입 시도, 결과 보고 등의 과정을 포함한다. 따라서 취약성 분석 및 보안 테스팅에서 일반성, 재사용성, 효율성을 극대화하는 것이매우 중요하다. 본 논문에서는, 정보보호제품이 자신의 보안 기능을 무력화하거나 우회하는 공격에 대응할 수 있는 자체보호기능 및 우회불가성을 제공하는 가를 평가할 수 있는 위협분석 기반의 소프트웨어 보안 테스팅을 제안한다. 위협분석으로 취약성을 식별한 후, 보안 테스팅의 재사용성과 효율성을 개선하기 위해 소프트웨어 모듈과 보안 기능에 따라 테스팅 전략을수립한다. 제안기법은 위협 분석 및 테스팅 분류, 적절한 보안테스팅 전략 선정, 보안 테스팅으로 구성된다. 사례연구와 보안테스팅을 통해 제안 기법이 보안 시스템을 체계적으로 평가할 수 있음을 보였다.
Abstract
As attackers try to paralyze information security systems, many researchers have investigated security testing to analyze vulnerabilities of information security products. Penetration testing, a critical step in the development of any secure product, is the practice of testing a computer systems to find vulnerabilities that an attacker could exploit. Security testing like penetration testing includes gathering information about the target before the test, identifying possible entry points, attempting to break in and reporting back the findings. Therefore, to obtain maximum generality, re-usability and efficiency is very useful for efficient security testing and vulnerability hunting activities. In this paper, we propose a threat analysis based software security testing technique for evaluating that the security functionality of target products provides the properties of self-protection and non-bypassability in order to respond to attacks to incapacitate or bypass the security features of the target products. We conduct a security threat analysis to identify vulnerabilities and establish a testing strategy according to software modules and security features/functions of the target products after threat analysis to improve re-usability and efficiency of software security testing. The proposed technique consists of threat analysis and classification, selection of right strategy for security testing, and security testing. We demonstrate our technique can systematically evaluate the strength of security systems by analyzing case studies and performing security tests.
참고문헌 (35)
- Gartner, "Now is the time for security atApplication Level", ~ (2005)
- G. McGraw, "Software assurance forsecurity", IEEE Computer, 32, pp.103~105 (1999)
- G. McGraw, "SoftwareSecurity Testing", IEEE Security and Privacy, 2, pp.81~85 (2004)
- B. Arkin, "Software penetration testing", IEEESecurity & Privacy, 3, pp.84~87 (2005)
- D.P. Gilliam, "Software Security Checklistfor the Software Life Cycle", Proceedingsof the Twelfth International Workshop onEnabling Technologies: Infrastructurefor Collaborative Enterprises, pp.243~ (2003)
- X. Zhang, "A NovelMethod of Software VulnerabilityDetection based on Fuzzing Technique", Proceedings of the 2008 InternationalConference on Apperceiving Computingand Intelligence Analysis : ICACIA 2008, pp.270~273 (2008)
- V. Ganesh, "Taint-based directed whitebox fuzzing", Proceedings of the 2009 InternationalConference on Software Engineering :ICSE 2009, pp.474~484 (2009)
- Exposing Vulnerabilities inMedia Software, "D. Thiel", Tech. Rep., BlackHatUSA, ~ (2007)
- 김동진, "멀티미디어 플레이어에 대한 퍼징기반 취약점 분석", 정보과학회논문지 : 컴퓨팅의 실제 및 레터, 17(2), pp.98~107 (2011), 한국정보과학회
- "CVSS(Common Vulnerability ScoringSystem)home page"[URL]
- "CWSS(Common Weakness Scoring System)home page"[URL]
- "CVE(Common Vulnerabilities Enumeration)home page"[URL]
- "CWE(Common Weakness Enumeration)home page"[URL]
- Common Criteria, "Common Criteria forInformation Technology Security Evaluation-Part 3: Security assurancecomponents, Version 3.1" (2007)
- K. Bang, "Classification Criteria and ApplicationMethodology for Evaluating ITSecurity Products", Journal of Korea Knowledge Information Technology Society, 6(5) (2011)
- "Fortify Software, Inc. home page"[URL]
- J.A. Kupsch, "First Principles VulnerabilityAssessment", Proceedings of the2010 ACM workshop on Cloud computingsecurity workshop, pp.87~92 (2010)
- Y. Son, "A Study on Software Vulnerabilityof Programming LanguagesInteroperability", Proceedings of theAdvanced Computer Science andInformation Technology Communicationsin Computer and InformationScience, 195, pp.123~131 (2011)
- D. Kim, "An Analysis ofDomestic and Foreign Security VulnerabilityManagement Systems basedon a National Vulnerability Database", Journal of Internet and Information Security, 1(2), pp.130~147 (2010)
- D. Kim, "AnEfficient Vulnerability ManagementSystem for Utilization of New InformationTechnologies-related SecurityVulnerabilities", Proceedings of the 37thKIISE Fall Conference, 37(2(B)), pp.66~71 (2010)
- G. Kim, "Fuzzing of WebApplication Server Using KnownVulnerability Information and ItsVerification", Proceedings of the KIISEKorea Computer Congress, 38(1(B)), pp.181~184 (2011)
- "디아블로3 사용자 계정 탈취용 악성파일 국내 등장" (2012), 보안뉴스[URL]
- "SANS Institute Reading Room web page"[URL]
- ""Practical Threat Analysis for InformationSecurity Experts, "web page"[URL]
- "NVD(National Vulnerability Database)home page"[URL]
- "Anti-Malware Test Lab"[URL]
- C.S. Collberg, "Watermarking, tamper-proofing, andobfuscation - tools for software protection", IEEE Transactions on SoftwareEngineering, 28, pp.735~746 (2002)
- M. Kim, "Design andPerformance Evaluation of Binary CodePacking for Protecting EmbeddedSoftware against Reverse Engineering", Proceedings of the IEEE InternationalSymposium on Object, Service-Oriented Real-Time DistributedComputing 2010, pp.2010[DOI]
- S. Jana, "Abusing fileprocessing in malware detectors for funand profit", Proceedings of the IEEESymposium on Security and Privacy 2012, pp.80~94 (2012)
- M. Bauer, "New covert channels in HTTP:adding unwitting Web browsers toanonymity sets", Proceedings of the 2003ACM workshop on Privacy in theelectronic society, pp.72~78 (2003)
- S. J. Murdoch, "Embe- ddingcovert channels into TCP", IP, 2005, 247~261
- C. Seifert, "True Positive Cost Curve: A Cost-BasedEvaluation Method for High-InteractionClient Honeypots", in Proceedings of the2009 Third International Conference onEmerging Security Information, Systemsand Technologies, pp.63~69 (2009)
- "SecurityFocus home page"[URL]
- "Process Explorer home page"[URL]
- "Windows Sysinternals Suite home page"[URL]