Security Questions

Network Install-Time Security Questionaire

Copyright 2005-2006 Sun Microsystems

Policy Synopsis

The Security SWG wants to extend the scope, detail, and depth of security-related information reviewed by the ARC's during a project's inception and commitment reviews. By gathering this additional information the ARCs will be better able to determine the security implications of the project under review.

The Security SWG recommends that a reference to this policy be included within each ARC's 20 questions, replacing any security questions that may currently exist.

Contents

• Applicability
• Audience
• Policy

Overview

Applicability

All projects

Audience

Project leads, ARCs, PACs

Policy

• Applies to All projects
• Authority SAC
• Effective All projects starting the ARC review process after 2003/08/12
• Policy  Project Case Materials must include a thorough description of the security assumptions, capabilities and any potential risks (possible attack points) being introduced by your project.

  Projects must highlight information for the following important areas:

  • • What features are newly visible on the network and how are they protected from exploitation (e.g. unauthorized access, eavesdropping)
    • If the project makes decisions about which users, hosts, services, ... are allowed to access resources it manages, how is the requestor's identity determined and what data is used to determine if the access granted. Also how this data is protected from tampering.
    • If this project uses any privileged operations beyond what a common user (e.g. "noaccess") can perform, why those are necessary and how they are granted.
    • What parts of the project are active upon default install and how they can be turned off.
• Details  This Security Questionnaire is designed to collect detailed information regarding the security implications of changes to SMI's product lines.

  When answering all of the following questions please describe when an environmental security assumption is the basis for an "Not Applicable" answer.

  1. Are there any security requirements documented for this project?

     [_?_] Yes	1) Describe what version of the requirements document was used and where it can be found. [ answer ]  2) List those requirements met by the project. [ answer ]  3) Are there any specific security requirements which your project does not plan to meet? [ answer ]
     [_?_] No	1) What security issues are being addressed or potentially introduced by your project. [ answer ]

  2. For each network (e.g., RPC over IP, TCP/IP, Serial, etc.) used by a project describe the following:
     1. describe the protocol stack being used

        [ answer ]

     2. list the service/application to which this project will communicate and the mechanism used (if IP based list static/dynamic ports used)

        [ answer ]

     3. describe what information will flow and/or be made available over this network connection

        [ answer ]

     4. describe how each network service that is created, installed, used or depended upon is compliant with the Network Install-Time Security policy.
        1. Specifically, how does each outbound service meet the protection requirements using: SVC1, SVC2, or SVC[3,4] including how OUT[1-3] protection is enforced.

           [ answer ]

        2. Specifically, how does each inbound service meet the protection requirements using: SVC1, SVC2, or SVC[3,4] including how IN[1,2] protection is enforced.

           [ answer ]

        3. How are the other aspects of the policy met (e.g. warning about install options which are non-compliant to administrator?)

           [ answer ]

     5. Describe how to disable each network service from your project and the side effects (e.g. dependencies) of doing so.

        [ answer ]

     6. For each network service, discuss how it protects its communications from network-based: theft, replay, content change and user impersonation within the following sub-sections:
        1. Does your service make decisions based on user, host or service identities?

           [_?_] Yes

           1) Describe how your project authenticates or discover the host, user, or services identity? [ answer ]  2) If authentication is done by another component explain how you obtain this information and why you believe its authentic. [ answer ]  3) If your project authenticates, explain the authentication process including any standards or existing components used. [ answer ]  4) In addition, describe what happens if the authentication process fails. [ answer ]  5) If passwords or passphrases are used, discuss how they are protected from host or network-based theft, protected if stored beyond authentication, how they can be changed, and any validity checking which occurs. [ answer ]

           [_?_] No

        2. Does your project make decisions about whether a requestor may access a particular resource?

           [_?_] Yes	Explain how this occurs for both successful and unsuccessful access requests. [ answer ]
           [_?_] No

        3. Does your project protect its communications from passive listeners on the network?

           [_?_] Yes	Explain the techniques used to accomplish this. [ answer ]
           [_?_] No	Explain why not. [ answer ]

        4. Describe how network-based access control is provided

           (e.g., this could be provided through technologies such as host-based firewalls/IPsec or application-level controls such as TCP Wrappers).
           [ answer ]

        5. Does your service protect the integrity of its communications over the network?

           [_?_] Yes	Explain the techniques used to accomplish this. [ answer ]
           [_?_] No	Explain why not. [ answer ]

        6. Describe how this network communication is protected against replay attacks in which a partial record of an earlier network exchange is replayed

           [ answer ]

        7. Describe how your network communications could be exploited by a denial of service (DoS) attack.

           (For instance, what resources are allocated during session setup before the requestor has been authenticated)
           [ answer ]

  3. Does this project use secret information (e.g. passwords, passphrases, PINs or equivalent authenticators) during authentication and/or authorization?

     [_?_] Yes

     Describe all methods for how this secret information can be obtained (e.g. user prompted interactively.) [ answer ] If the secret information can be obtained via command line or environment variable, explain how the project complies with the SAC Reusable Passwords [ answer ] If the secret information can be obtained from persistent storage (e.g. file), explain how the storage is protected and compliant with the SAC Storing Reusable Passwords Policy [ answer ] Describe how the secret information is: created, provisioned, updated, revoked, and checked for policies regarding its content (e.g. password strength checks.) [ answer ] How is this secret information expunged from the project's memory after use (e.g. so it doesn't appear in core files?) [ answer ]

     [_?_] No

  4. Does a non-privileged (e.g., not having access equivalent to uid 0 on pre-RBAC/Least Privilege OEs) user have access to all project functionality?

     [_?_] Yes	Describe why there are no potential RASS (Reliability, Availability, Serviceability, and Security) reasons to restrict non-privileged access. [ answer ]
     [_?_] No	Describe how/where authentication and authorization checks are done. [ answer ]  List the roles, rights, and authorizations needed to access the functionality included in this project. [ answer ]  Does your project perform authorization checking itself or does it use another component? If itself, explain how this occurs and why this project has its own authorization system. [ answer ]

  5. Except for networking (discussed above), does this project use cryptography for any purpose?

     [_?_] Yes

     For each use of cryptography in this project, describe the algorithms, key sizes and design for how it is being used.  If any non-standard cryptographic algorithms or protocols are used, describe why that algorithm and protocol was selected. [ answer ] For each use of cryptographic keys or certificates specify: what types of keys and/or certificates are used, [ answer ] what they are used for, [ answer ] how they are created, updated, and deleted, [ answer ] where they are stored, and [ answer ] what the secure backup and recovery method is. [ answer ] Export classification: What crypto export classification will the project and product have? [ answer ] For projects and products with a non-retail crypto export classification, what design features are incorporated to allow for the substitution of a cipher which has retail approval. [ answer ]

     [_?_] No

  6. Is any privileged user or group account (e.g., suid root, or other privileged setting mechanism) software part of your project?

     [_?_] Yes	Describe how the principle of least privilege (e.g. daemon dropping privileges once no longer needed) has been applied. [ answer ]  In addition, list all privileges required for this software. [ answer ]
     [_?_] No

  7. Are any log, error, FMA, or audit events generated?

     Note - this question applies to all auditing mechanisms, whether implemented in Solaris auditing, J2SEs logging facility, or Windows event logging

     [_?_] Yes

     List all security error events that may be generated and their causes. [ answer ] Will this project generate any audit records?  [_?_] Yes   List those events for which you will generate audit records. [ answer ]  [_?_] No   Describe why not. [ answer ]  [_?_] No

     1. Will this project run on Solaris?

        [_?_] Yes	What is the smallest sized Solaris installation Meta Cluster (e.g. Solaris 10 "Reduced Networking" (PSARC 2002/254)) on which it has been tested? [ answer ]  If it will not run on the Reduced Networking Meta Cluster, what additional packages are necessary? Are these included in the appropriate package dependency files? [ answer ]
        [_?_] No

     2. Will the project undergo a security evaluation/certification by itself or as part of a larger product (e.g. Solaris releases are certified against the Common Criteria's CAPP at EAL4)?

        [_?_] Yes

        Against which standards will it be evaluated?  [_?_] Common Criteria: which protection profiles (e.g., CAPP) and to what assurance level (e.g., EAL4)? [ answer ]  [_?_] FIPS 140-2: what level (1 to 4) is the evaluation? [ answer ]  [_?_] Other: Provide specific details [ answer ] What already-evaluated mechanisms (e.g., auditing) will your project be using to make this possible and as simple as possible? [ answer ] What already-evaluated mechanisms was your project not able to leverage and why? [ answer ]

        [_?_] No

     3. How does the project provide for failsafe defaults such that the security is not compromised?

         (For example, how does the project ensure that the security of the product isn't compromised by corrupted or missing configuration files)
        [ answer ]