A survey of static analysis methods for identifying security vulnerabilities in software systems <s> ACCESS-CONTROL SYSTEMS <s> This paper describes the new security architecture that has been implemented aspart of JDK1.2, the forthcoming JavaTM Development Kit. In going beyond the sandbox security model in the original release of Java, JDK1.2 provides fine-grained access control via an easily configurable security policy. Moreover, JDK1.2 introduces the concept of protection domain and a few related security primitives that help to make the underlying protection mechanism more robust. <s> BIB001 </s> A survey of static analysis methods for identifying security vulnerabilities in software systems <s> ACCESS-CONTROL SYSTEMS <s> From the Book: ::: PREFACE: Preface ::: Java is fashionable, but is it reliable? Java is entertaining, but is it secure? Java is useful, but is it safe? ::: ::: The purpose of this book is to answer those questions, from the point of view of people who want to use Java, but want to do so reliably, securely and safely. That makes this book different from much recent writing on Java, which focuses, perfectly legitimately, on how a Java system can be broken into and how to avoid those dangers. On the contrary, this book focuses on how Java can be made secure and how to exploit its strengths. The goal is to provide practical help to the various groups involved in making a Java-based application or Web site into an industrial-strength commercial proposition. ::: ::: Various groups have different needs and different skills, which this book meets in its different parts. ::: ::: The first part is aimed at the intelligent non-specialist who oversees system management or application development, or incorporates Java into the security policy. Only a basic understanding of computers and a limited exposure to Java is assumed, but all the themes of Java security are introduced in a context that stresses over and over again how Java security must be seen as an integral part of system security. The second part goes into more detail on how Java security works, and is aimed more at system and network administrators and programmers, who need to know more of what is going on. The third part looks at the broader context in which Java operates, including some extensions to Java security and some aspects of its future. ::: ::: This book explains the evolution of the Java security model, andthenfocuses on the Java 2 security architecture and its revolutionary domains of protection. It offers a very large number of examples to give you a better understanding of the technology involved. ::: The Team That Wrote This Redbook ::: This redbook was produced by a team of specialists from around the world working at the International Technical Support Organization Raleigh Center.The leader of this project was Marco Pistoia. ::: ::: Marco Pistoia is a Network Security Specialist, working as a project leader at the International Technical Support Organization, Raleigh Center. He writes extensively and teaches IBM classes worldwide on all areas of the e-business Application Framework, WebSphere, Java and Internet security. Marco holds a degree with honors in Pure Mathematics from the University of Rome and a masters degree in Computer Science. Before joining the ITSO, he was a System Engineer in IBM Italy. He received an Outstanding Technical Achievement Award in 1996. ::: ::: Duane F. Reller is a Senior Software Engineer in the System/390 Programming Laboratory in Endicott, New York, USA. He has 25 years of experience in System/390 Hardware and Software development. He has served in technical and management positions. He holds a Bachelor's degree in Electrical Technology and a Master of Science degree in Computer Science from the State University of New York at Binghamton. His areas of expertise include Hardware and Software System's Architecture and Management. ::: ::: Deepak Gupta is a Senior Software Engineer in IBM, India. He has two and a half years of experience in Internet technologies. He holds a degree in Electronics and Communications from the University of Roorkee, India. His areas of expertise include Internet security and Electronic Commerce. Deepak was involved in IBM India's largest e-Commerce project and in India's first secured e-Commerce site allowing Rupee-based transactions, for which he was conferred the Employee of the Month Award. He has also given several talks on Internet security and e-Commerce. ::: ::: Milind Nagnur is a Senior Associate in the Operations and Systems Risk Management (OSRM) group of Price Waterhouse Coopers in Mumbai, India. He has a couple of years of exposure in Internet technologies, with emphasis on security and control issues in real business applications. He holds a degree in Mechanical Engineering from the Indian Institute of Technology in Bombay, India, and an MBA from the Indian Institute of Management in Calcutta, India.Ashok K. Ramani is a Senior Software Engineer in IBM India. He has two and a half years of experience in Internet technologies. He holds a degree in MSc.(Tech.) Information Systems from the Birla Institute of Technology and Science, Pilani, India. His areas of expertise include Internet security and Electronic Commerce. Ashok was involved in IBM India's largest e-Commerce project and in India's first secure e-Commerce site allowing Rupee-based transactions for which he was conferred the Employee of the Month Award. He has won special recognition awards at IBM India for his contribution to e-Commerce projects. He has also presented several talks on Internet security and e-Commerce. ::: Comments Welcome ::: Your comments are important to us! ::: ::: We want our redbooks to be as helpful as possible. Please send us your comments about this or other redbooks in one of the following ways: ::: ::: Fax the evaluation form found in "ITSO Redbook Evaluation" on page 713 to the fax number shown on the form. Use the online evaluation form found at ... <s> BIB002
Software systems must enforce access control policies for security-sensitive resources and operations. Among the many access-control mechanisms available, SBAC and RBAC have recently gained in popularity and have been adopted for use in both the Java** and .NET Common Language Runtime (CLR) platforms. In this section we describe the basics of SBAC and RBAC and the associated security challenges. SBAC systems SBAC was introduced in 1997 BIB001 to enforce access control in multi-component systems. In an SBAC system, when a program attempts to access a restricted resource, the runtime system checks that all callers currently on the thread's stack satisfy a set of permission requirements. SBAC was designed to prevent untrusted code from gaining access to restricted resources by invoking (or being invoked by) more trusted code. Many SBAC systems grant permissions to code components declaratively in a policy database. For example, in Java Standard Edition (Java SE)-formerly known as Java 2, Standard Edition (J2SE**)-an administrator can grant a FilePermission to a Java archive (JAR) file, and all the classes in that JAR file will hold that FilePermission at runtime. BIB002 Each permission guards access to a particular resource or resource set and may specify a particular access mode. For example, a FilePermission may specify the resource as a file or a set of files and an access mode as any combination of read, write, delete, and execute. When a Java library method attempts to access a restricted resource, an underlying SecurityManager calls the AccessController.checkPermission service, passing a Permission parameter p representing the access being attempted. The checkPermission function traverses the stack of execution backward, verifying that all calling methods currently on the call stack are authorized to access the resource guarded by p. As an example, the createSocket method in the Library Java class of Figure 1 opens a network connection on behalf of its client, and on doing so, records the operation in a log file. Both the operations of opening a network connection and writing to a file are security sensitive. Therefore, the client invoking createSocket must hold the SocketPermission to open a network connection and the FilePermission to write to the file system. Configuring a SBAC security policy can be complicated because permission requirements depend on the dynamic program behavior of various components in various contexts. Typically, practitioners