CSS321 IP2.docx - 3/11/2020 Software Assurance Guidelines...

3/11/2020
Morgan leFaye Becker
COLORADO TECHNICAL UNIVERSITY
Software Assurance
Guidelines Document
CSS321-2001B-01: Software Assurance

Software Assurance Guidelines Document
Table of Contents
Turtle Love Refuge .......................................................................................................................... 3
Security in the Development LifeCycle (SDL) ............................................................................... 5
Core Security Training ................................................................................................................. 5
Requirements ............................................................................................................................... 6
Design .......................................................................................................................................... 7
Implementation ............................................................................................................................ 7
Verification .................................................................................................................................. 7
Release ......................................................................................................................................... 8
Response ...................................................................................................................................... 8
Software Assurance Techniques .................................................................................................... 10
Software applications of TLR and possible risks ...................................................................... 10
GPS tracking database and program .......................................................................................... 10
Turtle Love Resort website ........................................................................................................ 10
Turtle Medical Records Database .............................................................................................. 11
Types of attacks and guidelines to prevent attacks .................................................................... 12
Human error/sabotage ................................................................................................................ 12
Structure Query Language (SQL) injection attack .................................................................... 12
Denial-of-Service Attack (DoS) ................................................................................................ 13
Session Hijacking ...................................................................................................................... 14
Security in Nontraditional Development Models .......................................................................... 16
Big bang Model ......................................................................................................................... 16
Big Bang Deployment ............................................................................................................... 17
Software Assurance Policies and Processes .................................................................................. 20
Bibliography .................................................................................................................................. 21
1

Software Assurance Guidelines Document
Turtle Love Refuge
Turtle Love Refuge (TLR) is a turtle medical facility that assists with the recovery and
tracking of endangered turtle species off the coast of Panglao, Philippines. These guidelines are
implemented throughout the refuge and staffing. This facility is equipped with medical supplies
and staff to assist with the care and security of the animals that have been or are being cared for
at the refuge. There are two herpetologists, a veterinary assistant, and one intern who specialize
in a range of sea turtles and other reptiles of the region. Their responsibilities will include the
care and treatment of the reptiles. Occasionally they will need to attach a GPS tracking device to
the shells of a turtle.
The IT specialist is responsible for the care and maintenance of the IT equipment and the
security of the data of the facility. The tech team (of 2 members) will maintain the servers,
medical database of the species treated, the data collected from the GPS tracking devices, and
upkeep of the equipment in the facility. Equipment follows as:
 4-5 PCs or Laptops
o 1 desktop is designated for the GPS tracking database
 GPS tracking database software.
 Used for the website. The items on the website:
 Last GPS location of the turtles being tracked
 Donations can be made on the site
 General information on turtles in the region
 Video feed provided from tracking devices
o 2 laptops and 1 desktop in the medical lab.
 Medical records of reptiles seen at the facility
 Medical database of treatment and procedures
 8 GPS tracking devices
o 4 are active
o 1 is lost (tracking and reporting have failed)
o 3 are inactive for repairs or a new specimen.
2

Software Assurance Guidelines Document
 1 wireless tablet
 1 Router
o Located in IT office
 2 wireless amplifiers
o Used to amplify coverages to the beach
The IT team is responsible for developing the databases for the collected data, assigning
appropriate access to the medical staffing to allow input to the database, running scheduled scans
and vulnerability assessments to verify the integrity of the company, repairing and maintaining
threats that occur, and to provide training on updates that impact daily functions of the refuge
facility. The IT specialist will have access to all systems and data to provide consistent updates to
the facility. They will report to the head of the facility of any compromised data.