Secure App 5

Here is your Teaching Note, Quiz, and Answer Key for Section 5: Detailed Design for Secure Systems from the Fundamentals of Secure Application Development course.

🧑‍🏫 Teaching Note – Section 5: Detailed Design for Secure Systems

🎯 Learning Objectives

By the end of this section, students should be able to:

• Understand how insecure detailed design decisions lead to vulnerabilities.
• Apply 8 classic secure design principles to software design.
• Mitigate known issues such as TOCTOU and input validation flaws.
• Recognize the value of security-focused design reviews.

🧭 Lesson Plan Outline (60 minutes)

1. Kick-off Discussion (5 min)

• Ask: "What’s more dangerous: a coding error or a design flaw?"
• Explain: Many vulnerabilities originate from how the design was conceived, not just coding mistakes.

2. 8 Secure Design Principles (15 min)

• Introduce the foundational principles by Saltzer & Schroeder:

  1. Economy of mechanism
  2. Fail-safe defaults
  3. Complete mediation
  4. Open design
  5. Separation of privilege
  6. Least privilege
  7. Least common mechanism
  8. Psychological acceptability

• 🧠 Discuss real-world examples for each.

3. Wrappers & Handling Unsafe Components (10 min)

• Define “wrappers” for unsafe legacy or third-party components.
• Emphasize risk mitigation when ideal secure components aren’t available.

4. Input Validation Design (10 min)

• Four steps: canonicalization → normalization → sanitization → validation.
• Teach whitelisting > blacklisting.
• 💬 Activity: Show an example of insecure and secure input design.

5. TOCTOU and Related Timing Vulnerabilities (10 min)

• Define TOCTOU, TOATOU, TORTOU.
• Demonstrate how these non-atomic operations create race conditions.
• Explain real-world security incidents caused by these bugs.

6. Secure Design Reviews (10 min)

• Discuss peer reviews, architecture review, QA checks, and why they're worth the cost.

📝 Quiz – Section 5: Detailed Secure Design

🧠 Multiple Choice

1. Which principle advises that systems should grant no access by default? A. Open design B. Fail-safe defaults C. Least privilege D. Separation of privilege

2. A wrapper program is used to: A. Improve UI design B. Log user activity C. Block unwanted cookies D. Protect against flaws in known-vulnerable components

3. Canonicalization in input validation refers to: A. Logging input sources B. Reducing input to a standard known form C. Encrypting user input D. Blocking all special characters

4. TOCTOU is a type of vulnerability caused by: A. Improper password storage B. Weak encryption algorithms C. Timing issues between a check and a use D. Buffer overflows in runtime libraries

5. Which principle emphasizes designing software so users can use it securely without effort? A. Separation of privilege B. Economy of mechanism C. Psychological acceptability D. Open design

✅ True/False

1. ___ The “Open Design” principle suggests that keeping design secret improves security.
2. ___ TOCTOU can allow attackers to modify objects between validation and use.
3. ___ Whitelisting is generally preferred over blacklisting in input validation.
4. ___ Design flaws are usually easier to fix than coding bugs.
5. ___ Design reviews should be conducted only by the original developer.

✏️ Short Answer

1. Name two secure design principles and explain how they help avoid vulnerabilities.
2. Give one real-world example where a wrapper could help protect a system.
3. What’s the danger of non-atomic operations in security-sensitive designs?
4. Describe a simple input validation strategy that incorporates canonicalization and whitelisting.
5. Why are secure design reviews considered a good investment?

✅ Answer Key – Section 5 Quiz

Multiple Choice

1. B
2. D
3. B
4. C
5. C

True/False

1. False
2. True
3. True
4. False
5. False

Short Answer – Sample Answers

11.

• Least Privilege: Limits access to only what’s necessary, reducing risk of misuse.
• Fail-Safe Defaults: Denies access unless explicitly allowed, minimizing unintentional exposure.

12.

Wrapping a legacy file-upload component to check file types, sizes, and sanitize filenames before the upload is processed.

13.

Because a malicious actor can change the object after the system checks it but before it uses it—leading to unauthorized actions.

14.

Take input, convert to standard form (e.g., file path without ..), check only allowed characters (e.g., letters, numbers), reject anything else.

15.

Because design-level changes prevent classes of vulnerabilities early—fixing them later is much more expensive and risky.

Would you like a visual classroom handout or checklist version of the 8 design principles or input validation flow?