| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 1.74 MB | Adobe PDF |
Authors
Advisor(s)
Abstract(s)
Atualmente, security by design tornou-se um desafio notável, ou seja, a criação de sistemas de
software que sejam seguros desde as etapas iniciais do desenvolvimento apresenta-se como uma
tarefa difícil. Infelizmente, muitos dos sistemas e software disponíveis são desenvolvidos sem
preocupações acerca da segurança ou apenas seguem um processo de engenharia de segurança
fraco, nomeadamente sistemas pertencentes à área de Internet of Things (IoT).
Este novo mundo inovador que começa a surgir e a ganhar destaque nas tecnologias do futuro
possibilita que muitos dispositivos, alguns deles sendo retratados como objetos físicos da vida
quotidiana com computadores embutidos, apresentem uma conexão entre eles através da Internet, transmitindo dados automaticamente. Contudo, a conexão de todos estes modernos
dispositivos e sistemas tem um efeito colateral: um maior risco no que diz respeito à existência
de potenciais ataques e vulnerabilidades.
A implementação destes tipo de sistemas é complexa e árdua e, devido a estes fatores, a integração da segurança por vezes é ignorada ou adicionada no final do desenvolvimento como
um recurso extra. A consequência destas ações traduz-se na existência de erros / bugs desde
as fases iniciais, que podem levar entidades maliciosas a explorar as vulnerabilidades existentes, provocando assim falhas de seguranças, algumas das quais podem gerar um impacto muito
negativo. De forma a colmatar este problema, existe uma clara necessidade de encontrar uma
solução que permita guiar arquitetos de sistema, fabricantes e programadores a integrar e implementar segurança no sistema desde o início do desenvolvimento.
Deste modo, esta dissertação descreve o trabalho direccionado para o design e desenvolvimento
de uma ferramenta, na linguagem de programação Python que, através de perguntas simples e
intuitivas, produza um relatório contendo boas práticas de segurança sobre vários temas a adotar durante a implementação de um sistema. O trabalho inclui a identificação das perguntas e
a definição do fluxo de execução. Esta ferramenta possibilita o fornecimento de documentação
necessária para aplicar um nível considerado de segurança no sistema a implementar desde as
etapas iniciais, auxiliando assim arquitetos de sistema e developers, mesmo aqueles que têm
pouco ou nenhum conhecimento de segurança. De uma forma rápida e simplista, esta ferramenta permite que o utilizador responda a uma série de questões sobre o sistema a desenvolver
e, em troca, receba documentação estruturada sobre boas práticas seguras a adotar, possibilitando assim a redução de vulnerabilidades, e servindo como um utensílio de apoio no que diz
respeito à integração de segurança de um sistema de software.
Security by design has now become a remarkable challenge, which means that creating software systems that are secure from early stages of development is a daunting task. Unfortunately, many of the available software systems are always developed without security concerns or just follow a weak security engineering process, namely systems that belong to the Internet of Things (IoT) area. This new world that is emerging and gaining prominence in technologies of the future enables many devices, some of them being portrayed as physical objects of everyday life with embedded computers, to have a connection between them over the Internet and transmit data automatically. However, the connection of all these modern devices and systems has one side effect: a greater risk for potential vulnerabilities. Implementing these types of systems is complex and arduous, and because of these factors, security integration is sometimes ignored or added at the end of development as an extra feature. The consequence of these actions is the existence of errors / bugs from the early stages, which may lead to malicious entities exploiting existing vulnerabilities, thus leading to security breaches, some of which may have a very negative impact. In order to address this problem, there is a clear need to find a solution that will guide system architects and developers to integrate security into a system to be implemented from the beginning of development. Thus, this dissertation describes the work directed to the design and development of a tool, in Python, which, through simple and intuitive questions, produces a report containing good security practices on various topics, to be adopted during implementation of a system. This work included the identification of the questions and the definition of the execution flow. By assisting system architects and developers, even those with little or no security knowledge, this tool provides the necessary documentation to apply a considered level of security into the system from the earliest stages of development. Quickly and simply, this tool allows the user to answer a set of questions about the system to be developed, and in return, receive structured documentation of best practices to adopt, thereby reducing vulnerabilities. and serving as a support tool for security integration in a software system.
Security by design has now become a remarkable challenge, which means that creating software systems that are secure from early stages of development is a daunting task. Unfortunately, many of the available software systems are always developed without security concerns or just follow a weak security engineering process, namely systems that belong to the Internet of Things (IoT) area. This new world that is emerging and gaining prominence in technologies of the future enables many devices, some of them being portrayed as physical objects of everyday life with embedded computers, to have a connection between them over the Internet and transmit data automatically. However, the connection of all these modern devices and systems has one side effect: a greater risk for potential vulnerabilities. Implementing these types of systems is complex and arduous, and because of these factors, security integration is sometimes ignored or added at the end of development as an extra feature. The consequence of these actions is the existence of errors / bugs from the early stages, which may lead to malicious entities exploiting existing vulnerabilities, thus leading to security breaches, some of which may have a very negative impact. In order to address this problem, there is a clear need to find a solution that will guide system architects and developers to integrate security into a system to be implemented from the beginning of development. Thus, this dissertation describes the work directed to the design and development of a tool, in Python, which, through simple and intuitive questions, produces a report containing good security practices on various topics, to be adopted during implementation of a system. This work included the identification of the questions and the definition of the execution flow. By assisting system architects and developers, even those with little or no security knowledge, this tool provides the necessary documentation to apply a considered level of security into the system from the earliest stages of development. Quickly and simply, this tool allows the user to answer a set of questions about the system to be developed, and in return, receive structured documentation of best practices to adopt, thereby reducing vulnerabilities. and serving as a support tool for security integration in a software system.
Description
Keywords
Boas Práticas Engenharia de Segurança Guias de Segurança Internet das Coisas Modelação de Ameaças Segurança de Sistemas