SEN2008 · Week 11 · Security Fundamentals (II): Software Security, Information Assurance, Sources of Software Nontechnical security issues, Example Security Technologies

Software security, information assurance and security technologies

The difference between software security and information assurance, non-technical problems such as social engineering and policy, reading a firewall rule table, IDS/IPS and base-rate calculation, VPN. Rule-table and false-alarm questions are exam favorites.

software securityinformation assurancebugdesign flawsocial engineeringpretextingtailgatinginsider threatsecurity policyfirewallpacket filterstateful inspectionapplication proxydefault denyrule shadowingIDSIPSsignature-basedanomaly-basedfalse positivebase-rate fallacyVPNIPsecdefense in depth

Last week you learned the language of attacks. This week we cross to the other side: how security is built, and which technical and non-technical measures are used. The exam will certainly have two types of calculation: reading a firewall rule table line by line and finding what fraction of IDS alerts are real. Golden rules:

A firewall applies the first matching rule. Read from top to bottom; stop when one matches.
For a match, all fields must match. Protocol, source, destination, port. If even one doesn’t match, move on to the next rule.
Default deny. At the end of the table there is “deny everything”; anything not allowed is forbidden.
For a rare event, false alarms dominate. Calculate precision with $TP / (TP + FP)$ , don’t trust intuition.
Technology alone is not enough. People and policies are also part of the security system.

Software security

Software security means designing and building software so that it works correctly even under malicious attack. It is not like network security, “building a wall around the perimeter afterwards”; security is built in from the start as a property of the software (build security in). The reasoning is simple: if the application behind the firewall is open to SQL injection, the attack gets in the moment the firewall allows port 443.

Security problems in software are of two kinds:

Bug: at the implementation level, in code. Example: a strcpy that doesn’t check the buffer size.
Flaw: at the design level. Example: carrying the session token in the URL, doing the authorization check only on the client.

Code review and static analysis tools catch bugs; to find flaws you need architectural risk analysis and threat modeling (week 13). The earlier they are found, the cheaper they are to fix: changing a sentence at the requirements stage costs far less than patching a live system.

Information assurance

Information assurance (IA) is a broader framework: ensuring that information and information systems can be used reliably. Five goals are often listed: confidentiality, integrity, availability, authentication and non-repudiation. IA manages three resources together: people, process, technology. Risk management, backups, a disaster recovery plan, auditing and training are parts of IA.

Availability calculation

Availability is usually given as a percentage. The allowed downtime per year:

$\text{downtime} = (1 - A) \times 8760 \text{ hours}$

Availability	Downtime per year
99.9%	8.76 hours
99.95%	4.38 hours
99.99%	about 52.6 minutes

It can also be calculated from failure statistics: $A = MTBF / (MTBF + MTTR)$ . For a system that runs 990 hours on average without failure and is repaired in 10 hours, $A = 990 / 1000 = 0.99$ .

Non-technical security problems

Most attacks start with a human error. That is why “nontechnical issues” has its own place in the course plan.

Social engineering plays on people’s trust, fear or helpfulness:

Technique	How it works
Pretexting	A made-up scenario: “I’m calling from IT support, I need to verify your password”
Phishing / spear phishing	A fake email; the targeted version is tailored to the person
Vishing / smishing	Phishing by phone or SMS
Baiting	Bait: a USB stick labelled “Salaries 2026”
Quid pro quo	Offering something in return: “a gift for filling in the survey, with your login details”
Tailgating	Passing through a door behind an authorized person

Insider threat: deliberate or careless harm by an employee with authorized access. It never has to get past the outer firewall. Countermeasures: least privilege, separation of duties, auditing access logs, closing an account immediately when someone leaves.

Security policy: puts in writing what the organization allows and what it forbids. Examples: acceptable use policy, password policy, data classification, incident response procedure. Without a policy, it is unclear what a technical control is protecting. For a policy to work, training, auditing and enforcement are needed. Legal regulations (for example personal data protection laws) and physical security also fall under this heading.

Example security technologies

Firewall

A firewall sits between two networks and passes or drops packets according to a rule table. Its three basic types:

Type	What it looks at	Pros / cons
Packet filter (stateless packet filter)	IP addresses, protocol, ports; each packet on its own	Fast, simple; doesn’t know the context
Stateful inspection	The above + a connection table	Recognizes reply packets automatically
Application proxy (application gateway)	Application content (HTTP request, commands)	The most detailed control; slow, protocol-specific

Reading a rule table. The table below protects the internal network (10.0.0.0/24). 10.0.0.5 is the web server, 10.0.0.53 is the DNS server.

#  action   proto  source            destination    port
1  allow    tcp    any            -> 10.0.0.5       443
2  allow    tcp    any            -> 10.0.0.5       80
3  deny     tcp    203.0.113.0/24 -> any            22
4  allow    tcp    198.51.100.0/24-> 10.0.0.0/24    22
5  allow    udp    any            -> 10.0.0.53      53
6  deny     any    any            -> any            any

Example 1. tcp, 192.0.2.10 → 10.0.0.5, port 443. All fields of rule 1 match: allow. Evaluation ends there.

Example 2. tcp, 203.0.113.9 → 10.0.0.7, port 22. The destination of rules 1 and 2 is 10.0.0.5, no match. Rule 3: the source is inside 203.0.113.0/24, destination any, port 22. Deny. Rule 4 is never looked at.

Example 3. udp, 192.0.2.10 → 10.0.0.53, port 53. Rules 1-4 are tcp, no match. Rule 5 matches: allow.

The CIDR check is as in week 5: /24 means the first 24 bits, that is, the first three octets must be the same. The address 10.0.1.9 does not belong to the 10.0.0.0/24 network.

PITFALL · shadowing. If “allow tcp any → 10.0.0.0/24 port 22” is added at the very top of the table, SSH from 203.0.113.0/24 is now accepted before it can reach rule 3. The general rule kills the specific rule below it. Order the rules from specific to general.

IDS and IPS

An intrusion detection system (IDS) monitors traffic or host events and alerts on suspicious activity. An intrusion prevention system (IPS) sits in the path of the traffic (inline) and blocks suspicious packets. They are divided into NIDS, which watches the network, and HIDS, which watches a single host.

Two detection approaches:

Signature-based (misuse): looks for known attack patterns. Few false alarms, but can’t see a new attack.
Anomaly-based: looks for deviation from a normal behaviour profile. It can catch a new attack, but it has many false alarms.

Four outcomes: true positive (TP, attack and alert), false positive (FP, normal but alert), false negative (FN, attack but no alert), true negative (TN).

Base-rate example. There are $10^6$ events a day, 0.1% of which are attacks. The IDS catches 99% of the attacks and raises a false alarm on 1% of the normal events.

attacks     = 1 000 000 × 0.001 = 1 000      normal = 999 000
TP          = 1 000 × 0.99      = 990        FN = 10
FP          = 999 000 × 0.01    = 9 990
precision   = 990 / (990 + 9 990) ≈ 0.090

Only about 9% of the alerts of a “99% accurate” system are real. The analyst wastes 10 out of every 11 alerts and, over time, stops taking alerts seriously. The fix: lower the false alarm rate, tune the rules, filter alerts by correlation.

VPN

A virtual private network (VPN) sets up an encrypted tunnel over an insecure network (the Internet). Two uses: site-to-site (joining two office networks) and remote access (connecting an employee at home to the company network).

The most common technologies are IPsec and TLS-based VPNs. IPsec has two protocols: AH (integrity and authentication, no encryption) and ESP (encryption + integrity). There are two modes: transport mode leaves the original IP header in clear and protects the payload; tunnel mode encrypts the entire packet and wraps it with a new IP header. A VPN provides confidentiality and integrity but does not stop malware at the endpoint.

Defense in depth

No control is perfect. Defense in depth puts in several independent layers: firewall, IDS, up-to-date patches, in-application input validation, backups. For an attack to succeed it has to get through all of them. If the layers are independent:

$P(\text{gets through}) = m_1 \times m_2 \times \dots \times m_k$

For three layers with miss probabilities 0.1, 0.2 and 0.3, $0.1 \times 0.2 \times 0.3 = 0.006$ ; 99.4% of attacks are stopped. None of them individually exceeds 90%.

TIP · multiply probabilities, don’t add percentages. Adding like “90% + 80% + 70%” is meaningless. Multiply each layer’s miss probability, then subtract from 1.

Common mistakes

Wrong idea	Correct
A firewall picks the best-fitting rule	It applies the first matching rule, in order
If destination and port match, the rule matches	The protocol and source must match too
10.0.1.9 is inside 10.0.0.0/24	/24 fixes the first three octets; 10.0.1.x is outside
The end doesn’t need a default deny	Everything not allowed must be explicitly denied
The alerts of a 99% accurate IDS are 99% real	For a rare attack, precision can be very low
A signature-based IDS catches zero-days	Only the anomaly-based approach can
IDS and IPS are the same	An IDS alerts, an IPS sits in the path and blocks
A VPN protects everything	It doesn’t protect the ends of the tunnel; malware passes through
Security is only a technical job	Social engineering and missing policy are the most common entry points

Test yourself

Exam-style questions. Solve them on paper first, then reveal the answer.

Question 1easy

The firewall evaluates rules top to bottom and applies the first match. What happens to a TCP packet from 203.0.113.7 to 10.0.0.5, destination port 80?

1 allow tcp  any             -> 10.0.0.5     port 443
2 allow tcp  any             -> 10.0.0.5     port 80
3 deny  tcp  203.0.113.0/24  -> any          port 22
4 allow tcp  198.51.100.0/24 -> 10.0.0.0/24  port 22
5 allow udp  any             -> 10.0.0.53    port 53
6 deny  any  any             -> any          any

Show answer

Allowed by rule 2

Rule 1: the destination is 10.0.0.5 but the port is 443, no match.

Rule 2: tcp, source any, destination 10.0.0.5, port 80. Everything matches: allow, stop.

It doesn't matter that the source is in 203.0.113.0/24; rule 3 is only for port 22, and we never even got there.

Question 2medium

Same rule table. A TCP packet goes from 198.51.100.20 to 10.0.0.9, destination port 22. Which rule decides, and what is the action?

1 allow tcp  any             -> 10.0.0.5     port 443
2 allow tcp  any             -> 10.0.0.5     port 80
3 deny  tcp  203.0.113.0/24  -> any          port 22
4 allow tcp  198.51.100.0/24 -> 10.0.0.0/24  port 22
5 allow udp  any             -> 10.0.0.53    port 53
6 deny  any  any             -> any          any

Show answer

Rule 4, allow

Rules 1 and 2: the destination is not 10.0.0.5, no match.

Rule 3: the source 198.51.100.20 is not in the 203.0.113.0/24 network, no match.

Rule 4: the source is inside 198.51.100.0/24 (the first 24 bits are 198.51.100), the destination 10.0.0.9 is also inside 10.0.0.0/24, port 22. Allow.

Question 3medium

Same rule table. A TCP packet goes from 198.51.100.20 to 10.0.1.9, destination port 22. Which rule decides, and what is the action?

1 allow tcp  any             -> 10.0.0.5     port 443
2 allow tcp  any             -> 10.0.0.5     port 80
3 deny  tcp  203.0.113.0/24  -> any          port 22
4 allow tcp  198.51.100.0/24 -> 10.0.0.0/24  port 22
5 allow udp  any             -> 10.0.0.53    port 53
6 deny  any  any             -> any          any

Show answer

Rule 6, deny

It looks the same as the previous one, but the destination is 10.0.1.9. The 10.0.0.0/24 network runs from 10.0.0.0 to 10.0.0.255; since the third octet is 1, it is outside. Rule 4 does not match.

Rule 5 is for udp, no match. What remains is the default rule 6: deny. Misreading the CIDR boundary is the classic trap of these questions.

Question 4medium

Same rule table. A UDP packet goes from 198.51.100.20 to 10.0.0.5, destination port 443. What happens?

1 allow tcp  any             -> 10.0.0.5     port 443
2 allow tcp  any             -> 10.0.0.5     port 80
3 deny  tcp  203.0.113.0/24  -> any          port 22
4 allow tcp  198.51.100.0/24 -> 10.0.0.0/24  port 22
5 allow udp  any             -> 10.0.0.53    port 53
6 deny  any  any             -> any          any

Show answer

Denied by rule 6

The destination and port of rule 1 match, but the protocol is tcp; the packet is udp. For a match, all fields must match.

Rules 2, 3 and 4 are tcp; the destination of rule 5 is 10.0.0.53. None matches, and it is denied by rule 6. Someone who skips the protocol field says "rule 1 allows it" and gets it wrong.

Question 5hard

An administrator inserts a new rule 0 at the TOP of the table. Now a TCP packet from 203.0.113.7 to 10.0.0.9, port 22 arrives. What is the decision, and what problem does this reveal?

0 allow tcp  any             -> 10.0.0.0/24  port 22
1 allow tcp  any             -> 10.0.0.5     port 443
2 allow tcp  any             -> 10.0.0.5     port 80
3 deny  tcp  203.0.113.0/24  -> any          port 22
4 allow tcp  198.51.100.0/24 -> 10.0.0.0/24  port 22
5 allow udp  any             -> 10.0.0.53    port 53
6 deny  any  any             -> any          any

Show answer

Allowed by rule 0; rules 3 and 4 are shadowed for that subnet

Rule 0: tcp, source any, destination 10.0.0.9 (inside 10.0.0.0/24), port 22. It matches, allow, and evaluation stops.

Previously this packet was denied by rule 3. Now rule 3 can never act for destinations in 10.0.0.0/24; rule 4 also becomes redundant. This is called shadowing: a general rule neutralizes a more specific rule that comes after it. The right order: specific rules at the top, general rules at the bottom, and the default deny at the very end.

Question 6easy

Which type of firewall keeps a table of established connections, so that reply packets of an allowed outgoing connection are accepted without a separate inbound rule?

Stateless packet filter
Stateful inspection firewall
Application-level proxy
Personal antivirus

Show answer

B) Stateful inspection firewall

A stateful firewall keeps a connection table: it records a TCP connection that goes out from inside, and accepts the returning reply packets by consulting this record. A stateless packet filter evaluates each packet on its own and needs a separate rule for reply traffic. An application proxy terminates the connection itself and inspects the content (for example HTTP).

Question 7hard

An IDS monitors 100,000 benign connections and 40 malicious ones per day. Its detection rate is 95% and its false positive rate is 0.2%. Of all the alerts it raises, what fraction are real attacks?

Show answer

38 / 238 ≈ 16.0%

True positives: $TP = 40 \times 0.95 = 38$ . Missed: $FN = 2$ .

False positives: $FP = 100000 \times 0.002 = 200$ .

Total alerts $38 + 200 = 238$ . Precision: $38 / 238 \approx 0.160$ .

So only about one in six alerts is real. A 0.2% false alarm rate looks small, but because attacks are so rare, it drowns the alerts. This is called the base-rate fallacy.

Question 8medium

A company wants its IDS to detect a brand-new attack for which no pattern has been published yet. Which detection approach can, in principle, catch it?

Signature-based detection
Anomaly-based detection
Port scanning
Hash whitelisting of signatures

Show answer

B) Anomaly-based detection

Signature-based detection looks for known attack patterns; it can't see a zero-day attack that has no signature. Anomaly-based detection builds a profile of normal behaviour and raises an alert on deviations; it can catch the new attack. The cost is a higher false alarm rate.

Question 9medium

Two independent defensive layers miss an attack with probabilities 0.05 and 0.1. What is the probability that the attack is stopped? If a third independent layer with miss probability 0.4 is added, what is the new probability that the attack gets through?

Show answer

0.995; 0.002

An attack succeeds only if it gets through all the layers. For independent layers the probabilities are multiplied:

$P(\text{gets through}) = 0.05 \times 0.1 = 0.005$ , so the probability of being stopped is $1 - 0.005 = 0.995$ .

Third layer: $0.005 \times 0.4 = 0.002$ . Even a layer that is weak on its own (60% catch) reduced the total risk by a factor of 2.5. This is the logic of defense in depth. In reality the layers are not fully independent, so the result gives the idea of an upper bound.

Question 10medium

A service level agreement promises 99.95% availability. What is the maximum allowed downtime per (365-day) year, in hours?

Show answer

4.38 hours

The allowed downtime fraction is $1 - 0.9995 = 0.0005$ .

A year is $365 \times 24 = 8760$ hours. $8760 \times 0.0005 = 4.38$ hours.

For comparison: 8.76 hours for 99.9%, about 52.6 minutes for 99.99%. Each extra "9" reduces the downtime tenfold.

Question 11easy

An attacker without a badge waits at the office entrance and walks in right behind an employee who opens the door. This social engineering technique is called:

Pretexting
Baiting
Tailgating
Vishing

Show answer

C) Tailgating

Tailgating (piggybacking) is entering a physical area right behind an authorized person. Pretexting is asking for information with a made-up scenario, baiting is leaving bait (for example a USB stick left in a parking lot), and vishing is phishing by phone. Countermeasures: turnstiles, a "don't hold the door for the person behind you" policy, awareness training.

Question 12medium

In IPsec tunnel mode, what does ESP protect?

Only the TCP header
Only the payload, keeping the original IP header in clear
The entire original IP packet, which is placed inside a new IP packet
Only the MAC address of the sender

Show answer

C) The entire original IP packet, which is placed inside a new IP packet

In tunnel mode, the whole original IP packet, header included, is encrypted and placed inside a new IP header. The new header carries the addresses of the VPN gateways, and the addresses of the internal network are hidden. In transport mode the original IP header stays in the clear and only the payload is protected. Site-to-site VPNs use tunnel mode.

Verification: Firewall decisions were computed with a node rule engine using the first-match rule (CIDR masks with BigInt); IDS TP/FP/FN/precision, layered defense probabilities and availability times were computed with node (verify/SEN2008/11.mjs). Definition questions are conceptual.

Review card

Software security: build the software secure from the start (bug = code error, flaw = design error) Information assurance (IA): C, I, A + authentication + non-repudiation of information; people + process + technology Social engineering: pretexting, baiting, tailgating, phishing/vishing; countermeasure: training + policy + MFA Firewall: the first matching rule applies, default deny at the bottom All fields must match: protocol, source, destination, port. /24 = first 3 octets the same Specific rule on top, general rule at the bottom; the reverse = shadowing Packet filter (stateless) / stateful (connection table) / proxy (application content) IDS alerts, IPS blocks (in the path, inline). NIDS network, HIDS host Signature: catches the known, misses zero-day. Anomaly: catches the new, many FP TP = attacks × TPR FP = normal × FPR precision = TP / (TP + FP) Rare attack + small FPR = most alerts are false (base-rate fallacy) Defense in depth: P(gets through) = miss1 × miss2 × ... Downtime/year = (1 − A) × 8760 hours 99.9% → 8.76 h 99.99% → 52.6 min IPsec ESP: transport = protects the payload; tunnel = wraps the whole packet in a new IP header