Upload
others
View
13
Download
0
Embed Size (px)
Citation preview
FEDERAL CASE STUDY
Ready, Aim, Fortify! U.S. Army Deploys Application Security Regimen for its Munitions System
THE DEPARTMENT | The U.S. Army uses the Total Ammunition Management Information
System (TAMIS) to manage conventional munitions requirements.
Case BackgroundThe Total Ammunition Management Information System (TAMIS) is the U.S. Army
application that manages conventional munitions for wartime, training and testing
operations across the U.S. Armed Forces – the Army, Marine Corps, National Guard as
well as the Navy and Air Force when operating on Army installations.
TAMIS handles approximately 350,000 ammunition transactions per month from units
located all around the world, supporting more than 7,000 authorized personnel who
request, approve and manage munitions. The web-enabled system calculates combat
load requirements, validates and routes electronic requests, collects expenditures, and
prepares forecasts. More than 50,000 munitions reports are generated each month on
the nearly $3 billion in conventional ammunition authorizations managed each year.
The primary objectives of TAMIS are to improve munitions governance and to provide
military personnel with essential analytical tools that enable a trained and ready armed
force. The TAMIS application supports the Army’s training and operational strategies
by providing an essential web-enabled capability throughout all phases of the military’s
spectrum of operations. Employing a design structured for centralized management and
decentralized execution, the system develops, calculates and prioritizes requirements,
ensures requisition and authorization data is accurate, and then makes this information
available and usable on demand to authorized users without wait time.
TAMIS is managed by the Department of the Army G-37, Munitions Management
Division. Maintaining training superiority and achieving readiness objectives required the
Army to transform its business practices and information management processes as
part of the overarching “Net-Centric Data Strategy” of the U.S. Department of Defense
(DOD). TAMIS is not a new system. It was originally launched on a mainframe, migrated
to Windows NT, and then to its present browser-driven application environment.
TAMIS operates in the Mission Assurance Category II sensitive level. As a result, much time
and effort has been devoted to TAMIS development and network “hardening” solutions
U.S. ARMY TAMIS QUICK STATS
• Handles350,000ammunition transactions per month from units locatedacrosstheglobe
• Supportsmorethan7,000authorizedpersonnelwhorequest,approveandmanage munitions
• Generates50,000+munitionsreportseach month
• Manages$3billioninconventionalammunitionauthorizationsannually
KEY CHALLENGES • Implement an application security regimen on an already deployed web application
• Provide military personnel with essential, automated analytical tools to enable a trained, armed force
• Prevent attacks to the TAMIS system by accurately measuring security risk level and fixing application vulnerabilities in TAMIS
• Progress the TAMIS team away from a “checklist mentality” toward a more holistic approach to risk management
• Train programmers to secure coding practices and monitor future performance
FORTIFY CASE STUDY WWW.FORTIFY.COM
designed to prevent attacks against the application. However, application
security wasn’t always the highest priority for the TAMIS development
team over the years, between rolling deadlines and user demands for
new features. Eliminating vulnerabilities was regarded as a task best
performed in the testing phase or at the end of development, if at all.
The Mission: a Holistic Approach to Software Risk ManagementBefore the TAMIS application security project, few in the wider U.S.
Army community were thinking seriously about application security.
While IT security as a practice has always been “non-negotiable” in
matters of national security, the approach had been largely network-
centric and had given little attention to software vulnerabilities present
in many of the applications already in use throughout the DOD. The two
bodies responsible for TAMIS network security included the U.S. Army
Information Management Center, responsible for intrusion detection
and firewalls, and the Pentagon’s Vulnerability Assessment Branch,
which periodically scans Army servers for necessary updates and fixes.
On the other hand, application code review was still manual and labor
intensive, with few resources directed to application threat modeling or
risk management during development. Training for software developers
on vulnerability mitigation through secure coding practices was largely
nonexistent. Still, TAMIS had a history of being specifically targeted
in malicious attacks on a few occasions originating from China, India,
even Boston.
Then TAMIS Project Manager Bob Torche attended a workshop as part
of a strategic initiative on Software Security Assurance conducted by the
National Cyber Security Division of the U.S. Department of Homeland
Security. The program helped him put his own project in perspective
and armed him with the skills and disciplines necessary to implement
source code analysis in TAMIS within his project’s cost structure.
The TAMIS team had some specific requirements for its application
security solution provider, which needed to be able to:
• Measure present vulnerability levels to ascertain risk profile of
the application
• Automate the source code analysis process
• Understand where and how the application was vulnerable, and
prioritize the results
• Operate within the TAMIS Visual Studio integrated development
environment to remediate fixes
• Illustrate quantitative reductions in vulnerability level over time,
demonstrated by executive level reporting
• Progress the TAMIS team away from a “checklist mentality”
toward a more holistic approach to risk management
• Train its .NET and C+ programmers on secure coding practices in
their application environment, and monitor their future performance
Regulatory compliance mandates were also a huge consideration for
the TAMIS team. Specifically, any chosen solution needed to help
them meet the requirements set forth by the following initiatives:
1. The Defense Information Systems Agency’s Application
Security Technical Implementation Guides, or DISA-STIGs for
short, is a set of application configuration standards that promote
the development, integration and updating of secure applications
required under DOD policy. All military software applications must
comply with these standards as a matter of national security.
2. The National Institute of Standards and Technology 800 Series
details federal government computer security policies, procedures
and guidelines. These guidelines assess and document threats and
vulnerabilities and for implementing security measures to minimize
the risk of adverse events.
3. The Federal Information Security Management Act (FISMA)
requires each federal agency to develop, document, and implement
an agency-wide program to provide information security for the
information and information systems that support the operations
and assets of the agency.
4. The DOD Information Assurance Certification and Accreditation
Process (DIACAP) is the process followed that ensures risk
management is applied on all DOD information systems. DIACAP
defines a formal and standard set of activities, general tasks and
a management structure for the certification and accreditation of
systems such as TAMIS that maintain an information assurance
posture throughout their life cycle.
TAMIS needed to select an application security solution provider
who understood each and every one of these regulatory directives,
and who could dynamically respond to address them.
Fortify® 360 Secure Your SoftwareFortify360isasuiteofintegratedsolutionsforidentifying,prioritizingand
fixingsecurityvulnerabilitiesinsoftwareandmanagingthebusinessof
ensuring application security.
FORTIFY CASE STUDY
Fortify engineers assisted with the installation process to tune the
product for the TAMIS environment. TAMIS also engaged Fortify
Software’s support services to help review initial scan results with its
developers, as the team needed some help prioritizing initial findings
to isolate the most serious threats. The team found tuning Fortify 360
for the individual application was a bit time consuming, but essential
to its success. Finally, Fortify also completed two days of in-depth
product training with ten TAMIS developers.
Bob Torche firmly believes that expert support is essential to
the success of a Software Security Assurance effort involving
ongoing development on an application already in production. He
elaborates, “We found Fortify’s support services to be first class
from knowledgeable installation to informative staff training. Their
involvement proved invaluable to both a stable deployment as well
as maintaining our deployment schedule. Problems were quickly
resolved, resulting in an overall smooth and stable rollout within the
planned timeframe.”
TAMIS operates under an agile software development approach,
but still the combination of maintaining the system (which is actually
hosted by another Army agency), fixing bugs, and deploying new
capabilities is a challenging balancing act. Today, the TAMIS team is
responsible for understanding the application’s ongoing risk profile,
identifying real or emerging threats, and assuring all stakeholders
that all potentially exploitable vulnerabilities are mitigated. TAMIS
developers are tasked with actually fixing security issues while
balancing the ongoing demands of a live system demanding
functionality, data integrity and availability. This frees the TAMIS
project management team to focus upfront not only on functional
requirements but also on security requirements.
The Results: Leading the App Sec Charge inside the DODBob Torche believes, “It is this balancing act between fix and function
that must be continually orchestrated for ongoing secure operations.
The challenges of implementing an application security regimen on an
already deployed web application – one that’s undergoing continual
development, mind you – required a cultural shift be incorporated
into our development process. Once the commitment is made, I
recommend that organizations going down our road pursue change
The Strategy: Why Fortify 360?Promoting greater software assurance practices was now regarded
inside TAMIS as essential to reducing overall risk to the munitions
management system. To accomplish this, the TAMIS team began a
review of leading industry source code analyzers. Fortify made the
short list. Initial market research identified six products to review,
including Fortify, KlocWork, and IBM/Ounce, among others. They
focused their evaluations on fixing, prioritizing, viewing and reporting
capabilities, as well as how well each product would integrate with its
environment. In the end, it came down to Fortify and Ounce.
Bob Torche was impressed by what he had learned of Fortify and
its Fortify 360 SCA product at the cyber security workshop, but not
convinced. He had his team run a test of Fortify 360 SCA directly
against TAMIS code, not only to examine its results but to also to
understand how the product would respond to their environment. He
was overwhelmed by the number of vulnerabilities first detected, and
soon realized the amount of effort that would be needed to address
them. Further evaluation revealed that Fortify 360 offered benefits
beyond just static code analysis.
Torche explains, “Fortify offered a comprehensive application security
approach that included detection and protection capabilities in a
single package. In addition to SCA, we realized the power of dynamic
analysis for an application that is up and running, which TAMIS clearly
is. We also understood that the run-time protection afforded by a
full Software Security Assurance solution in the end would put us
on the best possible footing. We became convinced that the best
solution would address both our immediate needs as well as any
future requirements that would emerge throughout the software
development lifecycle.”
The Attack: Divide & Conquer with Expert SupportAfter the selection of Fortify, the TAMIS team still had some hurdles
to clear. Implementation involved installing Fortify 360 SCA on each of
the machines that developers use to run static analysis on their code
and to upload results to the Fortify 360 Server. Fortify 360 Server was
used to maintain the rules pack, to scan pre-release code during QA,
and to generate reports.
FORTIFY BENEFITS
• IdentifiedtheTAMISapplication’sriskprofile
• ReducedriskfortheTAMISproject,withinitsfundingandresourcelevel
• AffectedaculturalshiftintheTAMISdevelopmentprocess
• Establishedadevelopmentlifecycleapproachtosoftwaresecurity
• EnhancedtheU.S.Army’ssecurityposturewithahigherlevelofconfidence
WWW.FORTIFY.COM
© 2010 Fortify Software Inc.
360FORTIFY
quickly, adopt best practices, and then follow through. It’s about ultimately building a stronger application,
but the challenge is keeping the wheels on the bus even as you improve the bus. That’s the secret of our
success with Fortify 360.”
With Fortify, TAMIS has:
• Identified its risk profile. Specifically, Fortify is helping to reduce risk for the TAMIS project, within its
funding and resource level.
• Enhanced its security posture. TAMIS has attained a higher level of confidence that its software is free
from major vulnerabilities, which is the ultimate goal of software security assurance.
• Established a software development life cycle approach. Security is now built into the TAMIS
application from the beginning with established processes and procedures. According to a study by the
National Institute of Standards and Technology (NIST), the cost and effort expended fixing security
vulnerabilities in production software is up to thirty times more than addressing them during development.
As the U.S. Army strives to deliver net-centric information that enables superior war fighter decision-making,
it continually adapts and refines TAMIS capabilities to meet the threat of the operational environment. Over
the last three years, the system’s sponsors have consolidated data and automated processes to align its
munitions requirements processes with the Single Army Logistics Enterprise (SALE) effort. TAMIS is three-
quarters of the way through its transformation. Next steps are to interface the system with the Global
Combat Support System-Army and the Logistics Modernization Program – which are both essentially
enterprise resource planning implementation projects.
TAMIS was the third successful implementation of Fortify at the U.S. Army, which is also using Fortify in
its Communications and Electronics Command (CECOM) and Tank-Automotive & Armament Command
(TACOM) systems. The Army now has 15 additional instances of Fortify 360 up and running out of 25 total
active projects. It has led to a sea change in acceptance for Software Security Assurance best practices at
the DOD. Torche states its impact most succinctly when he says, “Static application security testing should
be a mandatory requirement for all IT organizations that develop or procure applications.”
About Fortify Software, Inc.
Fortify®’s Software Security Assurance products and services protect companies from the threats posed
by security vulnerabilities in business–critical software applications. Its software security suite – Fortify
360 – drives down costs and security risks by automating key processes of developing and deploying secure
applications. Fortify Software’s customers include government agencies and FORTUNE 500 companies in a
wide variety of industries, such as financial services, healthcare, e–commerce, telecommunications, pub-
lishing, insurance, systems integration and information management. The company is backed by world–
class teams of software security experts and partners. More information is available at www.fortify.com
or visit our blog.