M7 infracstructure as code (IAC)

This is the second to the last module in the ALAMOSE workshop

https://sites.google.com/view/alamose-v1/m7-iac?authuser=0

 

M7-SECURITY WEAKNESS IN INFRASTRUCTURE AS CODE (IAC) SCRIPTS

Infrastructure as code (IAC)

automated resource management

Common security weakness in IAC
  misconfigurations such as hard coded password
  hardcoded secrets such as API keys

 guessable user: admin, root, ubutnu
 parts are open (micro services API and search engine etc)

 resources (database) accessible from outside etc

 did not hide server and tech stack information

Glitch https://github.com/sr-lab/GLITCH 

Glitch is a framework which detects IAC smells automatically

detects different security smells written in Ansible, Puppert of Chef

M7-SECURITY WEAKNESS IN INFRASTRUCTURE AS CODE (IAC) SCRIPTS

Description

Identifying security weaknesses, such as hard-coded passwords, hard coded secrets, weak crypto, full permission in of files etc in chef, puppet, ansible, terraform, SaltStack scripts, which are used to automatically set up and manage the infrastructure of technology systems is called infrastructure as code (IaC).

Courses Where This Module Is Integrated

• Software Quality Assurance (Auburn University, Spring 2023, Fall 2023)

Activities 

Pre-lab Content Dissemination

A security weakness is an error, a flaw such as an insecure coding pattern that can lead to vulnerability. A security weakness, such as a hard-coded secret, can be propagated to other parts of the program. A flow analysis is a process to identify how security weaknesses, such as insecure coding patterns in a program, can propagate security weaknesses within a software system.

In-class Hands-on Experience(using Mac)

1. Install Python by brew install python if you have not installed it in your machine.

2. Download or clone the source code of GLITCH: https://github.com/sr-lab/GLITCH

3. Go to this directory via terminal

4. Install the tools using the commands as follows

brew install poetry

poetry install

5. Create an YAML file named test.yaml and paste the following source code in the file and save it.

---

- name: create an app with full permission

  file:

    path: /app

    owner: foo

    group: foo

    mode: "0777"

6. Run the tool using the command

poetry run glitch --tech ansible --csv test.yaml

Post Lab Experience

The use of specific keywords such as hack, fixme, todo, bug, later, and bug in comments can reveal missing security functionality and the presence of bugs (CWE-546). In the following figure, we demonstrated steps for automatically identifying suspicious comments in Ansible scripts.

 

 

 this is the second module in the ALAMOSE WORKSHOP

https://sites.google.com/view/alamose-v1/m4-forensics?authuser=0

M4 - AUTOMATED FORENSICABILITY FOR SOFTWARE

Description

Integrate forensics into software source code. 

Courses Where This Module Is Integrated

1. Software Quality Assurance (Auburn University, Spring 2023, Fall 2023)

2. Mobile Security (Tuskegee University, Fall 2023)

3. Information Security Administration (Kennesaw State University, Spring 2023)

Activities 

Pre-lab Content Dissemination 

We first need to know what to log and how to log. Let us use the following heuristics. 

1. Heuristics on what to log

   • Resources: Logging resource-related information helps monitor the system's utilization and availability of critical assets, including data about memory usage, CPU usage, disk space, network activity, and other resource-related metrics. Resource logs aid in detecting performance bottlenecks, resource leaks, and overall system health. They provide insights into whether the system operates within expected resource thresholds or requires optimization.

   • Exceptions: Logging exceptions and errors is crucial for analyzing and troubleshooting issues within the application. These logs capture details about unexpected behaviors, software bugs, and runtime errors. Exception logs often include stack traces, error messages, error codes, and contextual information to help developers pinpoint the root causes of problems and facilitate quicker resolution.

   • Change Issues: Logging changes and events in the system provides an audit trail of actions taken within the application, including user actions, configuration modifications, database updates, and other significant events. Change issue logs are valuable for tracking the history of system changes, diagnosing security breaches, and ensuring compliance with regulatory requirements. They offer transparency into who did what and when.

2. Heuristics on how to log

   • Include the name of the identity provider or security realm that vouched for the username if that information is available.

   • Include the affected system component or other object (such as a user account, data resource, or file).

   • Include the status that says if the object succeeded or failed.

   • Include the application context, such as the initiator and target systems, applications, or components.

   • Include “from where” for network connectivity or distributed application operation messages.

   • Include the time stamp and time zone to help answer “when.” The time zone is essential for distributed applications.

In-class Hands-on Experience

1. Go to the URL- https://docs.python.org/3/library/logging.html for a detailed Python logging mechanism. You can find a basic example here.

2. Learn about the common logging methods using Python.

3. A code for a custom logger is shared using screenshots. 

Post Lab Experience

Imagine this scenario: Dolly, a data science specialist at Auburn University. University has written machine learning (ML) code in `workshop9.py`. The output is correct, but she just learned about adversarial machine learning, which discusses how ML code can be attacked. She realized that ML models are susceptible to security issues:  

1. `poisoning attacks` are introduced by passing in erroneous dataset files into ML code 

2. `model tricking` results from models being attacked, which gives false results. Incorrect prediction performance is an indicator of ML models being attacked. 

Assist Dolly by writing logging code in the correct locations in `workshop8.py` with comments so that the two issues, as mentioned earlier, are logged for all provided ML functions. After writing the code, put in comments to justify your code, save `workshop9.py`. 

1. You must add at least find and add logging code to seven locations with comments.

2. Complete the survey at_ https://auburn.qualtrics.com/jfe/form/SV_6W19tf7NcRt5y4K.

Sample Input/Output:

Input: workshop8.py

Expected Output: Code and Comments

iris = datasets.load_iris()

'''

Inserted logging statement because data can be poisoned.

'''

simpleLogger.info('Generic information: getting results: %s', str(res))

Module 5 Git hooks

This is the first module in the Auburn ALAMOSE workshop

M5 - GIT HOOKS TO FACILITATE AUTOMATED SECURITY STATIC ANALYSIS
https://sites.google.com/view/alamose-v1/m5-hooks?authuser=0

=>What is Git

=>Why Git

=>Basic Git commands: git init, clone, add, commit, push, pull, status

=>What is Git Hooks? 
 customizable scripts triggers by Git events

=>Security benefit of Git Hooks
 code quality checks, enforce coding standards, run linters and static cocde analyers to indentify potential vulnerabilities. 
 Access control. 

=>Scope and types of Git Hooks
local, remote sides 

=> Use cases: pre-commit hook, commit-msg hook, post-commit hook, pre-receive hook, post-receive hook. 

M5 - GIT HOOKS TO FACILITATE AUTOMATED SECURITY STATIC ANALYSIS

Description

Use an existing tool and Git Hooks to activate a static analysis tool for a popular repository.

Courses Where This Module Is Integrated

Software Quality Assurance (Auburn University, Spring 2023, Fall 2023)
Mobile Security (Tuskegee University, Fall 2023)

Activities 

Pre-lab Content Dissemination

One negative perception of software quality assurance (SQA) is that it prohibits rapid deployment of software. That is why practitioners advocate SQA activities to be integrated into the software development and deployment process. To that end, in modern software engineering, practitioners prefer automated pipelines for security analysis. Instead of asking practitioners to look for security problems themselves, tools should do that for them. 

In that spirit, we as a class will build a mini tool that automatically runs static security analysis for NumCPP, (https://github.com/dpilger26/NumCpp), a popular library developed in C++ that contains a lot of data structure-related implementations. For this workshop, you will use "cppcheck" (https://cppcheck.sourceforge.io/) and `git hooks`. You will build a Git Hook that will help in identifying known security weaknesses automatically for practitioners who develop and use `NumCPP`.  

In-class Hands-on Experience 

Create a GitHub account if you haven't yet 

Install CPPCheck on your computer 

Fork the `NumCPP` repository with your GitHub account

Clone the forked repository on your computer  

Go to `.git/hooks/` in the cloned repository 

Run cp pre-commit.sample pre-commit.

Open `pre-commit` 

Edit `pre-commit` to run `cppcheck -h`

Familiarize yourself with `cppcheck` using any or all of the following links:

https://linux.die.net/man/1/cppcheck 

http://cppcheck.sourceforge.net/manual.pdf 

https://www.mankier.com/1/cppcheck 

Modify any `.c` or `.cpp` file 

Commit the modified file to see the effects of the modified `pre-commit` hook   

A recording of the hands-on experience is available here. 

Post Lab Experience

Modify your `pre-commit` file so that it can scan your `NumCPP` repository whenever you commit any file.

Grab your output by capturing the screenshots.

Modify any CPP file in the `NumCPP` repository.

Complete the survey here: https://auburn.qualtrics.com/jfe/form/SV_bryx8vonSvVmW5o. 

ALAMOSE dev op security

 

ALAMOSE dev op security

https://sites.google.com/view/alamose-v1/home?authuser=0

https://github.com/paser-group/ALAMOSE-PASER/tree/ALAMOSE

terra quantum info

 

Reuben Brasher

https://github.com/rbattq

https://github.com/terra-quantum-public/benchmarking/tree/main/QPU%20notebooks