diff --git a/Cargo.lock b/Cargo.lock index 545f622..ed72313 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -837,6 +837,10 @@ version = "0.1.0" name = "w2l1-lesson-reflections" version = "0.1.0" +[[package]] +name = "w2l2-lesson-reflections" +version = "0.1.0" + [[package]] name = "walkdir" version = "2.4.0" diff --git a/Cargo.toml b/Cargo.toml index e059891..e85ab8c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -34,6 +34,6 @@ members = [ "week-2/Lesson 1 - Rust Safety and Security Features/w2l1-lesson-reflections", "week-2/Lesson 2 - Security Programming with Rust/rust-crypto_hashes", "week-2/Lesson 2 - Security Programming with Rust/rust-software-security", - "week-2/Lesson 2 - Security Programming with Rust/decoder-ring", + "week-2/Lesson 2 - Security Programming with Rust/decoder-ring", "week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections", ] resolver = "2" diff --git a/week-2/Lesson 2 - Security Programming with Rust/Makefile b/week-2/Lesson 2 - Security Programming with Rust/Makefile index be2bbbb..814880b 100644 --- a/week-2/Lesson 2 - Security Programming with Rust/Makefile +++ b/week-2/Lesson 2 - Security Programming with Rust/Makefile @@ -1,10 +1,10 @@ SHELL := /bin/bash -.PHONY: help all rust-crypto-hashes rust-software-security decoder-ring +.PHONY: help all rust-crypto-hashes rust-software-security decoder-ring w2l2-lesson-reflections help: @grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' -all: rust-crypto-hashes rust-software-security decoder-ring ## Build all projects +all: rust-crypto-hashes rust-software-security decoder-ring w2l2-lesson-reflections ## Build all projects rust-crypto-hashes: ## Build rust-crypto-hashes project make -C "rust-crypto_hashes" clean test build @@ -13,4 +13,7 @@ rust-software-security: ## Build rust-software-security project make -C "rust-software-security" clean test build decoder-ring: ## Build decoder-ring project - make -C "decoder-ring" clean test build \ No newline at end of file + make -C "decoder-ring" clean test build + +w2l2-lesson-reflections: ## Build w2l2-lesson-reflections project + make -C "w2l2-lesson-reflections" clean test build \ No newline at end of file diff --git a/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/Cargo.toml b/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/Cargo.toml new file mode 100644 index 0000000..065a760 --- /dev/null +++ b/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/Cargo.toml @@ -0,0 +1,8 @@ +[package] +name = "w2l2-lesson-reflections" +version = "0.1.0" +edition = "2021" + +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] diff --git a/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/Makefile b/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/Makefile new file mode 100644 index 0000000..80a40fd --- /dev/null +++ b/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/Makefile @@ -0,0 +1,39 @@ +SHELL := /bin/bash +.PHONY: help clean lint format test doc build run bump + +help: + @grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' + +clean: ## Remove all build artifacts + cargo clean + +lint: ## Lint code + @rustup component add rustfmt 2> /dev/null + cargo clippy + +format: ## Format code + @rustup component add rustfmt 2> /dev/null + cargo fmt + +test: ## Run tests + cargo test + +doc: ## Generate documentation + cargo doc --no-deps + +bench: ## Run benchmarks + cargo bench + +build: ## Build + cargo build + +all: clean lint format test doc build ## Build and run + +run: ## Run + cargo run + +bump: ## Bump version + @echo "Current version: $$(cargo pkgid | grep -o '#.*' | cut -d# -f2)" + @read -p "Enter new version: " new_version && \ + sed -i "s/version = \".*\"/version = \"$$new_version\"/" Cargo.toml && \ + echo "Updated to new version: $$(cargo pkgid | grep -o '#.*' | cut -d# -f2)" diff --git a/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/src/main.rs b/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/src/main.rs new file mode 100644 index 0000000..3a6218e --- /dev/null +++ b/week-2/Lesson 2 - Security Programming with Rust/w2l2-lesson-reflections/src/main.rs @@ -0,0 +1,191 @@ +//! Reflection Questions: +//! +//! # How could you improve security for a high availability system? +//! +//! Improving security for a high availability system involves multiple layers of +//! defense to ensure that the system can resist various attack vectors while +//! remaining available. Here are some strategies: +//! +//! - **Redundancy**: Implement redundant systems and failover mechanisms to +//! handle hardware or software failures without downtime. +//! +//! - **Regular Updates**: Keep all components updated with the latest security +//! patches to mitigate known vulnerabilities. +//! +//! - **Firewalls and Intrusion Detection Systems**: Deploy firewalls and IDS to +//! monitor and filter out malicious traffic. +//! +//! - **Load Balancers**: Use load balancers to evenly distribute traffic and +//! prevent Denial of Service (DoS) attacks from overwhelming a single point. +//! +//! - **Security Audits**: Conduct regular security audits to identify and +//! remediate potential weaknesses. +//! +//! - **Access Controls**: Enforce strict access controls and authentication +//! mechanisms to limit access to sensitive systems and data. +//! +//! - **Encryption**: Use encryption for data at rest and in transit to protect +//! against data breaches and eavesdropping. +//! +//! - **Monitoring and Logging**: Implement comprehensive monitoring and logging +//! to detect and respond to security incidents quickly. +//! +//! - **Disaster Recovery Plan**: Have a robust disaster recovery plan in place +//! to restore operations quickly after a security incident. +//! +//! - **Employee Training**: Educate employees on security best practices and +//! potential social engineering attacks. +//! +//! - **DDoS Protection Services**: Employ DDoS protection services to mitigate +//! the impact of large-scale attacks. +//! +//! By integrating these practices, a high availability system can be fortified +//! against a range of security threats while maintaining continuous operation. +//! +//! # What are some differences between classical vs modern encryption? +//! +//! Classical and modern encryption differ in various ways, from the complexity +//! of their algorithms to the level of security they provide. Here are some key +//! differences: +//! +//! - **Algorithm Complexity**: Classical encryption often uses simpler +//! algorithms like substitution ciphers, while modern encryption uses complex +//! mathematical algorithms such as AES and RSA. +//! +//! - **Key Length**: Modern encryption uses much longer keys, providing a higher +//! level of security against brute force attacks compared to the shorter keys +//! of classical encryption. +//! +//! - **Computational Power**: Modern encryption is designed to be secure even +//! against attackers with significant computational power, which was not a +//! concern for classical encryption. +//! +//! - **Purpose**: Classical encryption was primarily for confidentiality in +//! written communication, while modern encryption also ensures integrity, +//! authentication, and non-repudiation in digital communications. +//! +//! - **Symmetric vs Asymmetric**: Classical encryption typically involves +//! symmetric key algorithms, where the same key is used for both encryption +//! and decryption. Modern encryption includes both symmetric and asymmetric +//! algorithms, the latter using a public key for encryption and a private key +//! for decryption. +//! +//! - **Cryptanalysis Resistance**: Modern encryption is designed to resist +//! sophisticated cryptanalysis techniques, whereas classical encryption can +//! often be broken with basic frequency analysis. +//! +//! - **Standardization**: Modern encryption methods are standardized and +//! scrutinized by the cryptographic community, unlike the proprietary or +//! ad-hoc methods of classical encryption. +//! +//! - **Applications**: While classical encryption was used for messages and +//! relatively small amounts of data, modern encryption secures everything from +//! online transactions to entire databases and communication systems. +//! +//! The evolution from classical to modern encryption reflects the advancements +//! in mathematics, computer science, and our understanding of cryptography. +//! +//! # What Rust capabilities help prevent software vulnerabilities? +//! +//! Rust offers several capabilities designed to prevent common software +//! vulnerabilities, enhancing security and safety. These include: +//! +//! - **Ownership and Borrowing**: Rust's ownership system, along with rules for +//! borrowing, prevents dangling pointers and data races at compile time. +//! +//! - **Lifetime Management**: Lifetimes ensure that references do not outlive +//! the data they point to, preventing use-after-free errors. +//! +//! - **Type Safety**: Rust's strong type system helps catch bugs at compile +//! time that might otherwise lead to vulnerabilities. +//! +//! - **Memory Safety**: Rust guarantees memory safety by ensuring that all +//! accesses are valid and preventing buffer overflows without needing a +//! garbage collector. +//! +//! - **Concurrency Safety**: The language's concurrency model prevents data +//! races, a common source of errors in concurrent programming. +//! +//! - **Minimal Runtime**: Rust's minimal runtime and lack of a garbage collector +//! reduce the attack surface of applications. +//! +//! - **Error Handling**: Rust's `Result` and `Option` types encourage explicit +//! handling of error cases, avoiding silent failures. +//! +//! - **Macro System**: Rust's macros reduce the risk of code injection attacks +//! by performing code generation at compile time with strict syntax and type +//! checking. +//! +//! - **Immutable by Default**: Variables in Rust are immutable by default, +//! reducing the chances of side effects and unintended changes to data. +//! +//! - **Pattern Matching**: Rust's pattern matching helps in exhaustive checks, +//! ensuring that all possible values are handled, which prevents bugs related +//! to unhandled cases. +//! +//! - **No Null**: Rust does not have null values, eliminating null pointer +//! dereferences, which are a common vulnerability in other languages. +//! +//! These features contribute to Rust's ability to deliver more secure software +//! by mitigating many of the common sources of vulnerabilities found in other +//! programming languages. +//! +//! # What best practices should be used for crypto in Rust? +//! +//! Implementing cryptographic solutions in Rust should be guided by best +//! practices to ensure the highest levels of security: +//! +//! - **Use Established Libraries**: Opt for well-maintained cryptographic +//! libraries that are widely used and have been security audited, such as +//! *ring*, *sodiumoxide*, or *rust-crypto*. +//! +//! - **Keep Libraries Updated**: Stay current with the latest versions of +//! cryptographic libraries to benefit from security patches and +//! improvements, protecting against newly discovered vulnerabilities. +//! +//! - **Avoid Rolling Your Own Crypto**: Custom cryptographic implementations +//! are prone to errors. Rely on established libraries that have been tested +//! and reviewed by security experts. +//! +//! - **Secure Key Management**: Use secure methods and tools like hardware +//! security modules (HSMs) or operating system key stores to protect and +//! manage cryptographic keys. +//! +//! - **Use Strong Algorithms and Keys**: Select algorithms and key lengths +//! that comply with current security standards to withstand future +//! cryptanalytic advancements. +//! +//! - **Test for Side-Channel Attacks**: Protect against side-channel attacks +//! that could compromise secret data through indirect means such as timing, +//! power consumption, electromagnetic, or acoustic analysis. Ensure that +//! the cryptographic implementation does not inadvertently leak information +//! through these channels. This can involve constant-time processing for +//! cryptographic algorithms, avoiding branch conditions based on secret +//! values, and careful memory management. +//! +//! - **Secure Random Number Generation**: Use cryptographically secure +//! pseudo-random number generators (CSPRNGs) for generating keys, nonces, +//! and other random components in cryptographic operations to prevent +//! predictability and ensure randomness. +//! +//! - **Follow Cryptographic Best Practices**: Implement protocols with correct +//! use of initialization vectors (IVs), salts, padding schemes, and other +//! cryptographic constructs to maintain security. +//! +//! - **Perform Security Audits**: Have cryptographic implementations reviewed +//! by experienced security professionals to identify and rectify potential +//! weaknesses. +//! +//! - **Monitor for Cryptographic Breakthroughs**: Keep abreast of the latest +//! developments in cryptographic research to anticipate and respond to new +//! threats and advancements in the field. +//! +//! Adhering to these best practices helps Rust developers leverage the language's +//! inherent safety features while ensuring that their cryptographic code remains +//! secure against a wide range of potential attacks, including those that exploit +//! subtle side-channel vulnerabilities. +//! + +fn main() { + println!("Week 2 Lesson 2 Reflection"); +}