Thirteen things that need to be good to make a secure Cross Domain Solution (CDS).
Pages
Page 4 of 15
Content based attack protection
A CDS should provide a strong level of protection against attacks which use malicious content contained, even concealed, in data files, or other data constructs. Such attacks could adversely affect data processing on the receiving network, or the correct operation of the CDS itself.
In designing a CDS capable of defending against content based attacks, you should take into consideration the susceptibilities of the target system to content based attack. For instance, the complexity of the data formats being used.
Your design should take into account the capabilities and likelihood of any attacker performing such an attack. You should employ appropriate mitigations.
The potential for content based attacks on the CDS itself should also be kept in mind. For instance, the parsers that the CDS itself uses to process content should be robustly designed and implemented.
Defensive techniques
Complex data types should be transformed into simple, verifiable data types.
Simple data types should be processed in one of the following ways:
Using a hardware verification engine. The hardware should be specifically designed to verify each part of the simple data type, ensuring it is structurally correct and that each data field is valid for the end application.
Using a hybrid software and hardware verification engine. A hybrid verification engine uses a hardware verification engine to ensure the data structure is valid, and then a software verification engine to check that each data field is valid for the end application.
Using a software-only verification engine. This should only be used where strong confidence can be gained in the correct functioning of the software at all times. To gain this level of confidence requires detailed evaluation of the software itself, all underlying libraries and its operating system. This level of confidence is usually unachievable for complex parsing software and libraries, so is not recommended.
Embedded data types or those recursively included, such as documents in archives, should be expanded, transformed and verified, using similar processing as for simple data types.
For systems which process multiple types of data, mechanisms should be in place to reliably determine the data type.
When non-conforming data is detected, appropriate action should be taken, such as notification of errors, logging or alerts.
