Open Reference Architecture for Security and Privacy¶
Warning
This 2018 version is still work in progress and NOT yet available as hard-copy.
Note
This eBook is also available as hard-copy, see here. This CURRENT (2018) version is not yet published and ready as hard-copy!!!!
This reference architecture is built around information that helps you creating security or privacy solution architectures. This reference architecture is created to improve security and privacy designs in general. In our opinion it is time to stop reinventing the wheel when it comes down to creating architectures and designs for security and privacy solutions.
The reference architecture is not just another security book. Since libraries and book stores are filled with decent books on security and privacy we wanted to create a book that is all about reuse.
(c) 2015,2016,2017,2018 Asim Jahan and Maikel Mardjan
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Use of these materials is permitted only in accordance with license rights granted. Materials provided “AS IS”; no representations or warranties provided. User assumes all responsibility for use, and all liability related thereto, and must independently review all materials for accuracy and efficacy.
Content¶
- Foreword
- Introduction
- Creating a Solution
- Security Models
- Introduction
- Common attack vectors
- Hosting, hardware, firmware and other invisible threats
- Security Personas
- Threat Models
- Privacy Management Reference Model
- Privacy Management Model
- NIST Security framework
- Jericho Security Model
- Security Architecture Landscape (OSA)
- Software Assurance Maturity Model (SAMM)
- Security within the SDLC process
- IoT Threat Model
- NIST Cloud Computing Security model
- Mobile Threat model
- DDoS model
- OAuth 2.0 Threat Model
- Hacking Reference Models
- Security and Privacy Principles
- Security Principles
- Address Privacy & Security
- Always consider the users
- Asset protection and resilience
- Assume that external systems are insecure
- Audit information provision to consumers
- Authenticate users and processes
- Authorize after you authenticate
- Avoid security by obscurity
- Check the return value of functions
- Clearly delineate the physical and logical security boundaries
- Compartmentalise
- Compile with all warnings enabled
- Complete mediation
- Computer security is constrained by societal factors
- Computer Security Requires a Comprehensive and Integrated Approach
- Computer Security Responsibilities and Accountability Should Be Made Explicit
- Computer Security Should Be Cost-Effective
- Computer Security should be periodically reassessed
- Computer Security Supports the Mission of the Organization
- Data in transit protection
- Data is always protected
- Declare data objects at the smallest possible level of scope
- Defense in depth
- Design and implement audit mechanisms
- Design and operate an IT system to limit damage and to be resilient in response.
- Design for secure updates
- Design for security properties changing over time
- Design reviews
- Design security to allow for regular adoption of new technology
- Develop and exercise contingency or disaster recovery procedures to ensure appropriate availability
- Do not implement unnecessary security mechanisms.
- Don’t trust infrastructure
- Don’t trust services (from others)
- Earn or give, but never assume or trust
- Economy of mechanism
- Ensure proper security in the shutdown or disposal of a system
- Ensure that developers are trained in how to develop secure software.
- Establish a sound security policy as the“foundation” for design.
- Establish secure defaults
- External interface protection
- Fail Safe Defaults
- Fail-safe default settings for security and access
- Formulate security measures to address multiple overlapping information domains
- Governance framework
- HTTP header use
- Identify and prevent common errors and vulnerabilities
- Identify potential trade-offs
- Identity and authentication
- Implement layered security (Ensure no single point of vulnerability).
- Implement least privilege
- Implement tailored system security measures to meet organizational security goals.
- Isolate public access systems from mission critical resources
- Least common mechanism
- Least privilege
- Limit the use of pointers
- Limit the use of the preprocessor to file inclusion and simple macros
- Logging secrets
- Minimize secrets
- Minimize the system elements to be trusted.
- Open design
- Operational security
- Personnel security
- Protect information while being processed, in transit, and in storage.
- Provide assurance that the system is, and continues to be, resilient in the face of expected threats.
- Psychological acceptability
- Reduce risk to an acceptable level.
- Risk Based Approach to Security
- Secure use of the service by the consumer
- Security by Design
- Sensitive Data
- Sensitive data must be identified
- Separation between consumers
- Separation of privilege
- Session lifetime
- Strive for operational ease of use.
- Strive for simplicity
- Supply chain security
- Systems Owners Have Security Responsibilities Outside Their Own Organizations
- Treat security as an integral part of the overall system design.
- Use an authentication mechanism that cannot be bypassed
- Use only Secure Protocols
- Use standard solutions
- Use unique identities to ensure accountability
- Where possible, base security on open standards for portability and interoperability.
- Privacy Principles
- EU GDPR privacy principles
- Other privacy principles
- Access to Personal data
- Data anomyzation
- Collection Limitation Principle
- Collection of personal data
- Defensive data collection
- Design reviews
- Disclosure to third parties
- Don’t trust infrastructure
- Don’t trust services (from others)
- Individual Participation Principle
- Management Responsibility
- Monitoring and enforcement
- Purpose Specification Principle
- Security for privacy
- Security Safeguards
- Use Limitation Principle
- Integrating privacy requirements (GDPR)
- Security and Privacy designs
- Using Open Source for security and privacy protection
- OSS Security and Privacy System Building Blocks
- OSS Security Applications
- American fuzzy lop
- Bandit
- Bosun
- Bro
- Cameradar
- Data Seal
- Datastream
- Deeptracy
- Diffoscope
- Duplicity
- Fail2ban
- FIDO (Fully Integrated Defense Operation)
- FourOneOne
- GNUnet
- Gryffin
- Hammertime
- Hashcat
- Httpswatch
- Kali
- Kismet
- Libreswan
- Lightbulb
- Lynis
- Magic Wormhole
- Malspider
- Mantra
- Mitmproxy
- ModSecurity
- Mozilla HTTP Observatory
- Mythril
- OpenVAS
- ORY Hydra
- osquery
- OWASP ZCR Shellcoder
- OWASP Zed Attack Proxy (ZAP)
- Phpseclib (PHP Secure Communications Library)
- Radare
- Requests: HTTP for Humans
- RIPS (code analyser)
- RouterSploit
- SecLists
- Security Monkey
- SigPloit
- SIMP (The System Integrity Management Platform)
- Simplify
- Sonarqube
- Streisand
- Stunnel
- Suricata
- SWAMP (Software Assurance Marketplace)
- Tamper Chrome
- Threat Dragon
- Tlsfuzzer
- Tor
- Unfurl
- Vault
- VERIS
- VSAQ: Vendor Security Assessment Questionnaire
- w3af (Web Application Attack and Audit Framework)
- Wapiti
- Wifite 2
- WireGuard
- YARA
- OSS Privacy Applications
- OSS Security Software Repositories
- References
- General information on information security
- Attacks methods
- Thread Models
- Security Frameworks
- Privacy References Architectures and Models
- Open Access Privacy Journals
- Transactions on Data Privacy
- Guide to data protection
- Open Foundations on security & Privacy
- Checklists
- Vulnerability Databases
- Learning and training resources
- Other References
- References:Secure Coding Guidelines
- About the authors
- Licensing
- Contributing