The Role of Architectural Risk Analysis in Software Security

• By Gary McGraw
• Mar 3, 2006
• Sample Chapter is provided courtesy of Addison-Wesley Professional

This chapter is from the book
Software Security: Building Security In

Architecture is the learned game, correct and magnificent, of forms assembled in the light.

—Le Corbusier

^[1]Design flaws account for 50% of security problems. You can’t find design defects by staring at code—a higher-level understanding is required. That’s why architectural risk analysis plays an essential role in any solid software security program. By explicitly identifying risk, you can create a good general-purpose measure of software security, especially if you track risk over time. Because quantifying impact is a critical step in any risk-based approach, risk analysis is a natural way to tie technology issues and concerns directly to the business. A superior risk analysis explicitly links system-level concerns to probability and impact measures that matter to the organization building the software.

The security community is unanimous in proclaiming the importance of a risk-based approach to security. “Security is risk management” is a mantra oft repeated and yet strangely not well understood. Nomenclature remains a persistent problem in the security community. The term risk management is applied to everything from threat modeling and architectural risk analysis to large-scale activities tied up in processes such as RMF (see Chapter 2).

As I describe in Chapter 1, a continuous risk management process is a necessity. This chapter is not about continuous risk management, but it does assume that a base process like the RMF exists and is in place. ^[2] By teasing apart architectural risk analysis (the critical software security best practice described here) and an overall RMF, we can begin to make better sense of software security risk.

Common Themes among Security Risk Analysis Approaches

Risk management has two distinct flavors in software security. I use the term risk analysis to refer to the activity of identifying and ranking risks at some particular stage in the software development lifecycle. Risk analysis is particularly popular when applied to architecture and design-level artifacts. I use the term risk management to describe the activity of performing a number of discrete risk analysis exercises, tracking risks throughout development, and strategically mitigating risks. Chapter 2 is about the latter.

A majority of risk analysis process descriptions emphasize that risk identification, ranking, and mitigation is a continuous process and not simply a single step to be completed at one stage of the development lifecycle. Risk analysis results and risk categories thus drive both into requirements (early in the lifecycle) and into testing (where risk results can be used to define and plan particular tests).

Risk analysis, being a specialized subject, is not always best performed solely by the design team without assistance from risk professionals outside the team. Rigorous risk analysis relies heavily on an understanding of business impact, which may require an understanding of laws and regulations as much as the business model supported by the software. Also, human nature dictates that developers and designers will have built up certain assumptions regarding their system and the risks that it faces. Risk and security specialists can at a minimum assist in challenging those assumptions against generally accepted best practices and are in a better position to “assume nothing.” (For more on this, see Chapter 9.)

A prototypical risk analysis approach involves several major activities that often include a number of basic substeps.

• Learn as much as possible about the target of analysis.
  • Read and understand the specifications, architecture documents, and other design materials.
  • Discuss and brainstorm about the target with a group.
  • Determine system boundary and data sensitivity/criticality.
  • Play with the software (if it exists in executable form).
  • Study the code and other software artifacts (including the use of code analysis tools).
  • Identify threats and agree on relevant sources of attack (e.g., will insiders be considered?).
• Discuss security issues surrounding the software.
  • Argue about how the product works and determine areas of disagreement or ambiguity.
  • Identify possible vulnerabilities, sometimes making use of tools or lists of common vulnerabilities.
  • Map out exploits and begin to discuss possible fixes.
  • Gain understanding of current and planned security controls. ^[3]
• Determine probability of compromise.
  • Map out attack scenarios for exploits of vulnerabilities.
  • Balance controls against threat capacity to determine likelihood.
• Perform impact analysis.
  • Determine impacts on assets and business goals.
  • Consider impacts on the security posture.
• Rank risks.
• Develop a mitigation strategy.
  • Recommend countermeasures to mitigate risks.
• Report findings.
  • Carefully describe the major and minor risks, with attention to impacts.
  • Provide basic information regarding where to spend limited mitigation resources.

A number of diverse approaches to risk analysis for security have been devised and practiced over the years. Though many of these approaches were expressly invented for use in the network security space, they still offer valuable risk analysis lessons. The box Risk Analysis in Practice lists a number of historical risk analysis approaches that are worth considering.

My approach to architectural risk analysis fits nicely with the RMF described in Chapter 2. For purposes of completeness, a reintroduction to the RMF is included in the box Risk Analysis Fits in the RMF.