The Devils Behind Web Application Vulnerabilities
|
|
- Marjorie Marsh
- 5 years ago
- Views:
Transcription
1 The Devils Behind Web Application Vulnerabilities Defending against Web Application Vulnerabilities IEEE Computer, February 2012 Nuno Antunes, Marco Vieira {nmsa, Postgrad Colloquium Software and Systems Engineering Centre for Informatics and Systems of the University of Coimbra
2 Outline n Background and Motivation n Developing Secure Code n Detecting Vulnerabilities n Detecting Attacks n What are we doing about it? n Conclusions 2
3 Security in Web Applications 3
4 Security Vulnerabilities... n Faults that leave space to an exploitation or a corruption of a system n Web applications are widely exposed n Hackers moved their focus from the network to application s code n Injection and Cross-Site Scripting (XSS) are the two most common vulnerabilities 4
5 are an important problem... n Create and feed an underground economy n Companies are aware of that: n OWASP Security Spending Benchmarks 2009 shows that investment in security is increasing n However... 5
6 this is not getting better! n NTA Web Application Security Reports show that Web Security is decreasing n According to WhiteHat Security Website Security Statistics Report, 63% of assessed websites are vulnerable n Something is wrong in the development of web applications! 6
7 The Solution n a defense-in-depth approach, with overlapping protections, can help secure Web applications [Howard02] 7
8 Security in Software Development Lifecycle Initialization Speci.ication and Design Implementation Testing Decommissioning Deployment 8
9 Developing Secure Code n The characteristics of Web applications suggest the use of three distinct lines of defense: n Input validation n Hotspot protection n Output validation 9
10 Input Validation n Reduce an application s input domain n All inputs are malicious until proven otherwise n Starts with normalization of the inputs n Uses filtering strategies to reject values outside the domain domain can allow malicious data: n e.g. in the case of SQL injection 10
11 Hotspot Protection n Each type of attack targets a hotspot: n Hotspot: a set of statements that is prone to specific types of vulnerabilities. n This line of defense focuses on protecting only key hotspots n e.g. SQL injection attacks use quotes ( or ): n Character Escaping n Parameterized commands/queries 11
12 Output Validation n Prevents users from receiving restricted information as: n Internal Exceptions that can lead to other attacks n Credit card numbers n Encoding is a example of output validation n Avoids XSS vulnerabilities 12
13 Why don t developers follow these practices? n Training and education n Security is boring and uninteresting n Someone else should take care of security n Security limits application functionality 13
14 Detecting Vulnerabilities n White-box analysis n Black-box testing n Limitations of Vulnerability Detection 14
15 White-Box Analysis n Analyze the code without actually executing it n Looks for potential vulnerabilities n Among other types of software defects n Requires access to the source code or bytecode n Automated tools provide an automatic way for highlighting possible coding errors Ignore the runtime perspective 15
16 Black-Box Testing n A specialization of Robustness Testing n Analyzes the program execution in the presence of malicious inputs, searching for vulnerabilities. n Does NOT require access to the source code or bytecode n Automated tools provide an automatic way to search for vulnerabilities n Avoid a large number of manual tests Ignore the internals of the application 16
17 Limitations of Vulnerability Detection n [Antunes09a] % Coverage % False Positives 17
18 Detecting Attacks n Consists of identifying deviations from the correct behavior n In runtime n Anomaly detection tools usually require a training phase with non-malicious requests n Signature-based tools look for patterns of a predefined set of rules or signatures 18
19 Limitations of Attack Detection [Elia10] n Tools only perform well in specific scenarios: n Anomaly-detection better for simpler applications n Signature-based better for complex applications n Achieve low detection coverage n less than 20 percent in many cases n Report many false alarms n as high as 50 percent of the alarms generated n Developers often lack the training required to create adequate configurations 19
20 What are we doing about it? n New vulnerability detection tools n Penetration Testing [Antunes09b] n Attack Signatures & Interface Monitoring n Runtime Anomaly Detection n Benchmarking vulnerability detection tools n Focused in Web Services 20
21 Sign-WS [Antunes11] Penetration Testing does not require access to the code Vulnerability detection can only rely on the analysis of the output n Effectiveness is limited by the lack of visibility on the internal behavior of the service n Solution: Using Interface Monitoring together with Attack Signatures n It is possible to obtain the information necessary to improve the Penetration Testing process n without accessing or modifying the internals of the application! 21
22 Experimental Results Tool Detection Coverage False Positive Rate Sign-WS 74.05% 0.00% VS % 54.46% VS % 61.22% VS3 1.90% 0.00% 22
23 CIVS-WS [Antunes09c] n A new Runtime Anomaly Detection Approach n To find SQL/XPath Injection Vulnerabilities n Combine the analysis of services responses with the analysis of the runtime behavior n Two phases: Profiling and Detection n Vulnerabilities are identified by comparing the structure of commands executed in the presence of attacks to the ones learned in the absence of attacks 23
24 Experimental Evaluation n Using the same set of Web Services Penetration testing Static Code Analysis 70" 60" 50" 40" 30" 20" 10" 0" 0# #False"Posi9ves" #Vulnerabili9es"detected" 5# 1# 65# 31# 22# 0# 6# VS1" VS2" VS3" CIVS.WS" 40" 35" 30" 25" 20" 15" 10" 5" 0" #"False"Posi8ves" 10# #"Vulnerable"Lines" 7# 0# 23# 28# 4# 28# 11# SA1" SA2" SA3" CIVS-WS" Tool False Positives % Coverage % Tool False Positives % Coverage % VS1 14% 47.7% SA1 23% 82.1% VS2 4% 33.8% SA2 26% 100.0% VS3 0% 9.2% SA3 27% 39.3% CIVS-WS 0% 100.0% CIVS-WS 0% 100.0% 24
25 Benchmarking Vuln. Detection Tools n [Antunes10] n Proposed an approach to benchmark the effectiveness of V. D. tools in web services n Procedures and measures were specified n A concrete benchmark was implemented n Targeting tools able to detect SQL Injection n A benchmarking example was conducted n Results show that the benchmark can be used to assess and compare different tools 25
26 Benchmarking Vuln. Detection Tools Tool % TP % FP CIVS 79% 0% SA1 55% 7% SA2 100% 36% SA3 14% 67% Results for CIVS-WS and static analysis Results for Penetration Testing Tool % TP % FP VS1 32% 54% VS2 24% 61% VS3 2% 0% VS4 24% 43% Benchmarked Tools Ranking 26
27 Conclusions n Developers must always consider security: n Use best practices in coding; n security testing; n use attack-detection systems; n Developers need help with training and the tools n Researchers should propose new tools: n New security testing tools n Possibly compile-time fixing of vulnerabilities 27
28 Questions More about this in: Nuno Antunes Department of Informatics Engineering University of Coimbra 28
29 References n n n n n n n [Antunes09a] Antunes, N. and Vieira, M., Comparing the Effectiveness of Penetration Testing and Static Code Analysis on the Detection of SQL Injection Vulnerabilities in Web Services, IEEE 15th Pacific Rim International Symposium on Dependable Computing (PRDC 09), Shanghai, China, November [Antunes09b] Antunes, N. and Vieira, M., Detecting SQL Injection Vulnerabilities in Web Services, Fourth Latin-American Symposium on Dependable Computing (LADC 2009), João Pessoa, Paraíba, Brazil, September [Antunes09c] Antunes, N. and Laranjeiro, N. and Vieira, M. and Madeira, H., "Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services", IEEE International Conference on Services Computing (SCC 2009), Bangalore, India, September [Antunes10] Antunes, N. and Vieira, M., Benchmarking Vulnerability Detection Tools for Web Services, IEEE 8th International Conference on Web Services (ICWS 2010), Miami, Florida, USA, July [Antunes11] Antunes, N. and Vieira, M., Enhancing Penetration Testing with Attack Signatures and Interface Monitoring for the Detection of Injection Vulnerabilities in Web Services, IEEE 8th International Conference on Services Computing (SCC 2011), Washington, D.C., USA, 4-9 July [Howard02] M. Howard and D.E. Leblanc, Writing Secure Code, Redmond, Washington: Microsoft Press, [Elia10] I.A. Elia, J. Fonseca, and M. Vieira, Comparing SQL Injection Detection Tools Using Attack Injection: An Experimental Study, Proc. 21st IEEE Int l Symp. Software Reliability Engineering (ISSRE 2010), IEEE CS, 2010, p
Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services
SCC 2009 Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services Nuno Antunes, Nuno Laranjeiro,, Henrique Madeira {nmsa, cnl, mvieira, henrique}@dei.uc.pt CISUC Department of Informatics
More informationBenchmarking Vulnerability Detection Tools for Web Services
Benchmarking Vulnerability Detection Tools for Web Services, Marco Vieira {nmsa, mvieira}@dei.uc.pt ICWS 2010 CISUC Department of Informatics Engineering University of Coimbra, Portugal Outline The problem
More informationProtecting Database Centric Web Services Against SQL/XPath Injection Attacks
Protecting Database Centric Web Services Against SQL/XPath Injection Attacks Nuno Laranjeiro, Marco Vieira, Henrique Madeira CISUC, Department of Informatics Engineering University of Coimbra, Portugal
More informationOctober, 2012 Vol 1 Issue 8 ISSN: (Online) Web Security
ISSN: 2278 0211 (Online) Web Security Katkar Anjali S. M.E.(Pursuing) in computer science and engineering walchand institute of technology, Sholapur, India Kulkarni Raj B. PhD in computer science Assistance
More informationPractical Guide to Securing the SDLC
Practical Guide to Securing the SDLC Branko Ninkovic Dragonfly Technologies Founder Agenda Understanding the Threats Software versus Security Goals Secure Coding and Testing A Proactive Approach to Secure
More informationOUTLINE PERFORMANCE BENCHMARKING 7/23/18 SUB BENCHMARKING THE SECURITY OF SOFTWARE SYSTEMS OR TO BENCHMARK OR NOT TO BENCHMARK
BENCHMARKING THE SECURITY OF SOFTWARE SYSTEMS OR TO BENCHMARK OR NOT TO BENCHMARK mvieira@dei.uc.pt Department of Informatics Engineering University of Coimbra - Portugal QRS 2018 Lisbon, Portugal July
More informationWeb Security Vulnerabilities: Challenges and Solutions
Web Security Vulnerabilities: Challenges and Solutions A Tutorial Proposal for ACM SAC 2018 by Dr. Hossain Shahriar Department of Information Technology Kennesaw State University Kennesaw, GA 30144, USA
More informationCity, University of London Institutional Repository
City Research Online City, University of London Institutional Repository Citation: Algaith, A., Elia, I. A., Gashi, I. & Vieira, M. R. (207). Diversity with Intrusion Detection Systems: An Empirical Study.
More informationAnalyzing & Defining Web Application Vulnerabilities With Dynamic Analysis And Web Mining
Analyzing & Defining Web Application Vulnerabilities With Dynamic Analysis And Web Mining 1 Deepak B. Jadhav, 2 Sachin K. Sanap, 3 Ramesh C. Ghuge, 4 Deore Somnath 1,2,3,4 UG Student, Department Of Computer
More informationINTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY
INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY A PATH FOR HORIZING YOUR INNOVATIVE WORK WEB SECURED VULNERABILITIES OF WEAK PROGRAMMING LANGUAGE MAYURA SHARAD PATIL, NILIMA
More informationVulnerability & Attack Injection for Web Applications
Vulnerability & Attack Injection for Web Applications José Fonseca Marco Vieira Henrique Madeira DSN, Estoril, Portugal, 30/06/2009 University of Coimbra, Portugal Presentation Outline Research problem
More informationStudents should have an understanding and a working knowledge in the following topics, or attend these courses as a pre-requisite:
Secure Java Web Application Development Lifecycle - SDL (TT8325-J) Day(s): 5 Course Code: GK1107 Overview Secure Java Web Application Development Lifecycle (SDL) is a lab-intensive, hands-on Java / JEE
More informationMATERIALS AND METHOD
e-issn: 2349-9745 p-issn: 2393-8161 Scientific Journal Impact Factor (SJIF): 1.711 International Journal of Modern Trends in Engineering and Research www.ijmter.com Evaluation of Web Security Mechanisms
More informationW e b A p p l i c a t i o n S e c u r i t y : T h e D e v i l i s i n t h e D e t a i l s
W e b A p p l i c a t i o n S e c u r i t y : T h e D e v i l i s i n t h e D e t a i l s Session I of III JD Nir, Security Analyst Why is this important? ISE Proprietary Agenda About ISE Web Applications
More informationn Explain penetration testing concepts n Explain vulnerability scanning concepts n Reconnaissance is the first step of performing a pen test
Chapter Objectives n Explain penetration testing concepts n Explain vulnerability scanning concepts Chapter #4: Threats, Attacks, and Vulnerabilities Vulnerability Scanning and Penetration Testing 2 Penetration
More informationBlind XPath Injection Attack: A Case Study
Article can be accessed online at http://www.publishingindia.com Blind XPath Injection Attack: A Case Study Jyoti Lakhani* Abstract Extensible Mark-up Language (XML) is adopted by different organizations
More informationContinuously Discover and Eliminate Security Risk in Production Apps
White Paper Security Continuously Discover and Eliminate Security Risk in Production Apps Table of Contents page Continuously Discover and Eliminate Security Risk in Production Apps... 1 Continuous Application
More informationShiftLeft. Real-World Runtime Protection Benchmarking
ShiftLeft Real-World Runtime Protection Benchmarking Table of Contents Executive Summary... 02 Testing Approach... 02 ShiftLeft Technology... 04 Test Application... 06 Results... 07 SQL injection exploits
More informationProduct Security Program
Product Security Program An overview of Carbon Black s Product Security Program and Practices Copyright 2016 Carbon Black, Inc. All rights reserved. Carbon Black is a registered trademark of Carbon Black,
More informationSecurity Testing. John Slankas
Security Testing John Slankas jbslanka@ncsu.edu Course Slides adapted from OWASP Testing Guide v4 CSC 515 Software Security What is Security Testing? Validate security controls operate as expected What
More informationNOTHING IS WHAT IT SIEMs: COVER PAGE. Simpler Way to Effective Threat Management TEMPLATE. Dan Pitman Principal Security Architect
NOTHING IS WHAT IT SIEMs: COVER PAGE Simpler Way to Effective Threat Management TEMPLATE Dan Pitman Principal Security Architect Cybersecurity is harder than it should be 2 SIEM can be harder than it should
More informationUnit Level Secure by Design Approach
Unit Level Secure by Design Approach Abstract Authors: Vasantharaju MS & Joshua Cajetan Rebelo Vasantharaju_MS@McAfee.com Joshua.Rebelo@Siemens.com With cyber-attacks on the rise and high-profile breaches
More informationImplementation Ids for Web Security Mechanism against Injection and Multiple Attacks
Implementation Ids for Web Security Mechanism against Injection and Multiple Attacks Ms. Anupriya Mishra SDCOE, Selulake, Wardha pleasureanu@gmail.com Ms.Megha Bhalkar SDCOE,Selukate, Wardha Meghabhlkar1993@gmail.com
More informationIs Your Web Application Really Secure? Ken Graf, Watchfire
Is Your Web Application Really Secure? Ken Graf, Watchfire What we will discuss today Pressures on the application lifecycle Why application security defects matter How to create hacker resistant business
More informationJohn Coggeshall Copyright 2006, Zend Technologies Inc.
PHP Security Basics John Coggeshall Copyright 2006, Zend Technologies Inc. Welcome! Welcome to PHP Security Basics Who am I: John Coggeshall Lead, North American Professional Services PHP 5 Core Contributor
More informationMaximum Security with Minimum Impact : Going Beyond Next Gen
SESSION ID: SP03-W10 Maximum Security with Minimum Impact : Going Beyond Next Gen Wendy Moore Director, User Protection Trend Micro @WMBOTT Hyper-competitive Cloud Rapid adoption Social Global Mobile IoT
More informationComparing SQL Injection Detection Tools Using Attack Injection: An Experimental Study
Comparing SQL Injection Detection Tools Using Attack Injection: An Experimental Study Ivano Alessandro Elia Department for Technologies, University of Naples Parthenope Naples, Italy ivano.elia@uniparthenope.it
More informationIntegrated Web Application Firewall (WAF) & Distributed Denial Of Service (DDoS) Mitigation For Today s Enterprises
Integrated Web Application Firewall (WAF) & Distributed Denial Of Service (DDoS) Mitigation For Today s Enterprises AI-driven website & network protection service that secures online businesses from today's
More informationOWASP Top David Caissy OWASP Los Angeles Chapter July 2017
OWASP Top 10-2017 David Caissy OWASP Los Angeles Chapter July 2017 About Me David Caissy Web App Penetration Tester Former Java Application Architect IT Security Trainer: Developers Penetration Testers
More informationApplication Security Use Cases. RASP, WAF, NGWAF, What The Hell is The Difference.
Application Security Use Cases RASP, WAF, NGWAF, What The Hell is The Difference. Acronym Soup July 29, 2016 2 July 29, 2016 3 Definition of Terms WAF Web Application Firewall / waf / noun 1. An appliance,
More informationUsing Threat Analytics to Protect Privileged Access and Prevent Breaches
Using Threat Analytics to Protect Privileged Access and Prevent Breaches Under Attack Protecting privileged access and preventing breaches remains an urgent concern for companies of all sizes. Attackers
More information90% of data breaches are caused by software vulnerabilities.
90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with
More informationEngineering Your Software For Attack
Engineering Your Software For Attack Robert A. Martin Senior Principal Engineer Cyber Security Center Center for National Security The MITRE Corporation 2013 The MITRE Corporation. All rights reserved.
More informationOWASP 5/07/09. The OWASP Foundation OWASP Static Analysis (SA) Track Session 1: Intro to Static Analysis
Static Analysis (SA) Track Session 1: Intro to Static Analysis Eric Dalci Cigital edalci at cigital dot com 5/07/09 Copyright The Foundation Permission is granted to copy, distribute and/or modify this
More informationSOLUTION BRIEF. Enabling and Securing Digital Business in API Economy. Protect APIs Serving Business Critical Applications
Enabling and Securing Digital Business in Economy Protect s Serving Business Critical Applications 40 percent of the world s web applications will use an interface Most enterprises today rely on customers
More informationCSCE 813 Internet Security Case Study II: XSS
CSCE 813 Internet Security Case Study II: XSS Professor Lisa Luo Fall 2017 Outline Cross-site Scripting (XSS) Attacks Prevention 2 What is XSS? Cross-site scripting (XSS) is a code injection attack that
More informationUC Secure Software Development Standard
UCOP ITS Systemwide CISO Office Systemwide IT Policy UC Secure Software Development Standard Revision History Date: By: Contact Information: Description: 04/02/18 Robert Smith robert.smith@ucop.edu Initial
More informationProvide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any
OWASP Top 10 Provide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any tester can (and should) do security testing
More informationIBM Rational Software
IBM Rational Software Development Conference 2008 Our Vision for Application Security David Ng Rational Software Security, Asean IBM Software Group 2008 IBM Corporation Agenda Application Security Defined
More informationGenerating String Attack Inputs Using Constrained Symbolic Execution. presented by Kinga Dobolyi
Generating String Attack Inputs Using Constrained Symbolic Execution presented by Kinga Dobolyi What is a String Attack? Web applications are 3 tiered Vulnerabilities in the application layer Buffer overruns,
More informationGOING WHERE NO WAFS HAVE GONE BEFORE
GOING WHERE NO WAFS HAVE GONE BEFORE Andy Prow Aura Information Security Sam Pickles Senior Systems Engineer, F5 Networks NZ Agenda: WTF is a WAF? View from the Trenches Example Attacks and Mitigation
More informationCS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 12 Week of April 24, 2017 Question 1 Detection strategies (20 min) Suppose you are responsible for detecting attacks on the UC Berkeley network, and
More informationUnder the hood testing - Code Reviews - - Harshvardhan Parmar
Under the hood testing - Code Reviews - - Harshvardhan Parmar In the news September 2011 A leading bank s Database hacked (SQLi) June 2011 Sony hack exposes consumer passwords (SQLi) April 2011 Sony sites
More informationDetecting XSS Based Web Application Vulnerabilities
Detecting XSS Based Web Application Vulnerabilities M.S.Jasmine M.Tech (ISCF).Student, Department of Information Technology SRM University, TamilNadu,India jasmine.srakj@gmail.com Kirthiga Devi Assistant
More informationA SURVEY ON ROUTINE DETECTION OF WEB APPLICATION DEFENCE FLAWS
A SURVEY ON ROUTINE DETECTION OF WEB APPLICATION DEFENCE FLAWS 1 M.S.THARA DEVI, 2 S.SELVANAYAKI 1, 2 Vel Tech Multi Tech Dr.Rangarajan Dr.Sakunthala Engineering College, Chennai, Tamil Nadu, India. ABSTRACT
More informationPresentation of a Pattern to Counteract the Attacks of XSS Malware
Presentation of a Pattern to Counteract the Attacks of XSS Malware Abbas Ali Najjari Department of Computer, Zanjan Branch Islamic Azad University, Zanjan, Iran Nasser Modiri Department of Computer, Zanjan
More informationBuilding Security Into Applications
Building Security Into Applications Cincinnati Chapter Meetings Marco Morana Chapter Lead Blue Ash, July 30 th 2008 Copyright 2008 The Foundation Permission is granted to copy, distribute and/or modify
More informationSimple Overflow. #include <stdio.h> int main(void){ unsigned int num = 0xffffffff;
Simple Overflow 1 #include int main(void){ unsigned int num = 0xffffffff; printf("num is %d bits long\n", sizeof(num) * 8); printf("num = 0x%x\n", num); printf("num + 1 = 0x%x\n", num + 1); }
More informationCIS 4360 Secure Computer Systems XSS
CIS 4360 Secure Computer Systems XSS Professor Qiang Zeng Spring 2017 Some slides are adapted from the web pages by Kallin and Valbuena Previous Class Two important criteria to evaluate an Intrusion Detection
More information"Charting the Course to Your Success!" Securing.Net Web Applications Lifecycle Course Summary
Course Summary Description Securing.Net Web Applications - Lifecycle is a lab-intensive, hands-on.net security training course, essential for experienced enterprise developers who need to produce secure.net-based
More informationProtect your apps and your customers against application layer attacks
Protect your apps and your customers against application layer attacks Development 1 IT Operations VULNERABILITY DETECTION Bots, hackers, and other bad actors will find and exploit vulnerabilities in web
More informationVulnerability Discovery with Attack Injection
Vulnerability Discovery with Attack Injection IEEE Transactions on Software Engineering (2010) Joa o Antunes, Nuno Neves, Miguel Correia, Paulo Verissimo,and Rui Neves Park, Ji Hun 2010.08.17 Introduction
More informationTraining and Certifying Security Testers Beyond Penetration Testing
Training and Certifying Security Testers Beyond Penetration Testing Randall W. Rice, CTAL (Full), CTAL-SEC Director, ASTQB Board of Directors www.astqb.org Most organizations do not know the true status
More informationOWASP TOP Release. Andy Willingham June 12, 2018 OWASP Cincinnati
OWASP TOP 10 2017 Release Andy Willingham June 12, 2018 OWASP Cincinnati Agenda A quick history lesson The Top 10(s) Web Mobile Privacy Protective Controls Why have a Top 10? Software runs the world (infrastructure,
More informationAn Introduction to the Waratek Application Security Platform
Product Analysis January 2017 An Introduction to the Waratek Application Security Platform The Transformational Application Security Technology that Improves Protection and Operations Highly accurate.
More informationCYSE 411/AIT 681 Secure Software Engineering. Topic #6. Seven Software Security Touchpoints (III) Instructor: Dr. Kun Sun
CYSE 411/AIT 681 Secure Software Engineering Topic #6. Seven Software Security Touchpoints (III) Instructor: Dr. Kun Sun Reading This lecture [McGraw]: Ch. 7-9 2 Seven Touchpoints 1. Code review 2. Architectural
More information4. Risk-Based Security Testing. Reading. CYSE 411/AIT 681 Secure Software Engineering. Seven Touchpoints. Application of Touchpoints
Reading This lecture [McGraw]: Ch. 7-9 CYSE 411/AIT 681 Secure Software Engineering Topic #6. Seven Software Security Touchpoints (III) Instructor: Dr. Kun Sun 2 Seven Touchpoints Application of Touchpoints
More informationMitigating Security Breaches in Retail Applications WHITE PAPER
Mitigating Security Breaches in Retail Applications WHITE PAPER Executive Summary Retail security breaches have always been a concern in the past, present and will continue to be in the future. They have
More informationLecture 4: Threats CS /5/2018
Lecture 4: Threats CS 5430 2/5/2018 The Big Picture Attacks are perpetrated by threats that inflict harm by exploiting vulnerabilities which are controlled by countermeasures. Once Upon a Time Bugs "bug":
More informationDevelopment*Process*for*Secure* So2ware
Development*Process*for*Secure* So2ware Development Processes (Lecture outline) Emphasis on building secure software as opposed to building security software Major methodologies Microsoft's Security Development
More informationCSWAE Certified Secure Web Application Engineer
CSWAE Certified Secure Web Application Engineer Overview Organizations and governments fall victim to internet based attacks every day. In many cases, web attacks could be thwarted but hackers, organized
More informationSECURE CODING PART 1 MAGDA LILIA CHELLY ENTREPRENEUR CISO ADVISOR CYBERFEMINIST PEERLYST BRAND AMBASSADOR TOP 50 CYBER CYBER
SECURE CODING PART 1 MAGDA LILIA CHELLY ENTREPRENEUR CISO ADVISOR CYBERFEMINIST PEERLYST BRAND AMBASSADOR TOP 50 CYBER INFLUENCER @RESPONSIBLE CYBER 1 AGENDA 1. Introduction: What is security? How much
More informationCyber Hygiene: Uncool but necessary. Automate Endpoint Patching to Mitigate Security Risks
Cyber Hygiene: Uncool but necessary Automate Endpoint Patching to Mitigate Security Risks 1 Overview If you analyze any of the recent published attacks, two patterns emerge, 1. 80-90% of the attacks exploit
More informationAguascalientes Local Chapter. Kickoff
Aguascalientes Local Chapter Kickoff juan.gama@owasp.org About Us Chapter Leader Juan Gama Application Security Engineer @ Aspect Security 9+ years in Appsec, Testing, Development Maintainer of OWASP Benchmark
More informationTHE CONTRAST ASSESS COST ADVANTAGE
WHITEPAPER THE CONTRAST ASSESS COST ADVANTAGE APPLICATION SECURITY TESTING COSTS COMPARED WELCOME TO THE ERA OF SELF-PROTECTING SOFTWARE CONTRASTSECURITY.COM EXECUTIVE SUMMARY Applications account for
More informationEXECUTIVE REPORT ADOBE SYSTEMS, INC. COLDFUSION SECURITY ASSESSMENT
EXECUTIVE REPORT ADOBE SYSTEMS, INC. COLDFUSION SECURITY ASSESSMENT FEBRUARY 18, 2016 This engagement was performed in accordance with the Statement of Work, and the procedures were limited to those described
More informationOWASP Top 10 The Ten Most Critical Web Application Security Risks
OWASP Top 10 The Ten Most Critical Web Application Security Risks The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain
More informationApplication Security through a Hacker s Eyes James Walden Northern Kentucky University
Application Security through a Hacker s Eyes James Walden Northern Kentucky University waldenj@nku.edu Why Do Hackers Target Web Apps? Attack Surface A system s attack surface consists of all of the ways
More informationVulnerability Assessment with Application Security
Vulnerability Assessment with Application Security Targeted attacks are growing and companies are scrambling to protect critical web applications. Both a vulnerability scanner and a web application firewall
More informationWEB APPLICATION SCANNERS. Evaluating Past the Base Case
WEB APPLICATION SCANNERS Evaluating Past the Base Case GREG OSE PATRICK TOOMEY Presenter Intros Overview An overview of web application scanners Why is it hard to evaluate scanner efficacy? Prior Work
More informationNET 311 INFORMATION SECURITY
NET 311 INFORMATION SECURITY Networks and Communication Department Lec12: Software Security / Vulnerabilities lecture contents: o Vulnerabilities in programs Buffer Overflow Cross-site Scripting (XSS)
More informationBuilding Secure Systems
Building Secure Systems Antony Selim, CISSP, P.E. Cyber Security and Enterprise Security Architecture 13 November 2015 Copyright 2015 Raytheon Company. All rights reserved. Customer Success Is Our Mission
More informationSecure Development Lifecycle
Secure Development Lifecycle Strengthening Cisco Products The Cisco Secure Development Lifecycle (SDL) is a repeatable and measurable process designed to increase Cisco product resiliency and trustworthiness.
More informationProtect Your Application with Secure Coding Practices. Barrie Dempster & Jason Foy JAM306 February 6, 2013
Protect Your Application with Secure Coding Practices Barrie Dempster & Jason Foy JAM306 February 6, 2013 BlackBerry Security Team Approximately 120 people work within the BlackBerry Security Team Security
More informationCertified Secure Web Application Engineer
Certified Secure Web Application Engineer ACCREDITATIONS EXAM INFORMATION The Certified Secure Web Application Engineer exam is taken online through Mile2 s Assessment and Certification System ( MACS ),
More informationPreventing Injection Vulnerabilities through Context-Sensitive String Evaluation (CSSE)
IBM Zurich Research Laboratory Preventing Injection Vulnerabilities through Context-Sensitive String Evaluation (CSSE) Tadeusz Pietraszek Chris Vanden Berghe RAID
More informationDisclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitme
NET3420BU Introducing VMware s Transformative Data Center Endpoint Security Solution Vijay Ganti Director, Product Management VMware Christopher Frenz Director of Infrastructure Interfaith Medical Center
More informationApplication vulnerabilities and defences
Application vulnerabilities and defences In this lecture We examine the following : SQL injection XSS CSRF SQL injection SQL injection is a basic attack used to either gain unauthorized access to a database
More informationSECURITY TESTING. Towards a safer web world
SECURITY TESTING Towards a safer web world AGENDA 1. 3 W S OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS ate: 2013-14 Few Security Breaches September
More informationStudents should have an understanding and a working knowledge in the following topics, or attend these courses as a pre-requisite:
Securing Java/ JEE Web Applications (TT8320-J) Day(s): 4 Course Code: GK1123 Overview Securing Java Web Applications is a lab-intensive, hands-on Java / JEE security training course, essential for experienced
More informationSDLC Maturity Models
www.pwc.com SDLC Maturity Models SecAppDev 2017 Bart De Win Bart De Win? 20 years of Information Security Experience Ph.D. in Computer Science - Application Security Author of >60 scientific publications
More informationSecurity Engineering for Software
Security Engineering for Software CS996 CISM Jia An Chen 03/31/04 Current State of Software Security Fundamental lack of planning for security Most security issues come to light only after completion of
More informationSecuring Your Web Application against security vulnerabilities. Alvin Wong, Brand Manager IBM Rational Software
Securing Your Web Application against security vulnerabilities Alvin Wong, Brand Manager IBM Rational Software Agenda Security Landscape Vulnerability Analysis Automated Vulnerability Analysis IBM Rational
More informationThe Top 6 WAF Essentials to Achieve Application Security Efficacy
The Top 6 WAF Essentials to Achieve Application Security Efficacy Introduction One of the biggest challenges IT and security leaders face today is reducing business risk while ensuring ease of use and
More informationn Learn about the Security+ exam n Learn basic terminology and the basic approaches n Implement security configuration parameters on network
Always Remember Chapter #1: Network Device Configuration There is no 100 percent secure system, and there is nothing that is foolproof! 2 Outline Learn about the Security+ exam Learn basic terminology
More informationSample Exam ISTQB Advanced Test Analyst Answer Rationale. Prepared By
Sample Exam ISTQB Advanced Test Analyst Answer Rationale Prepared By Released March 2016 TTA-1.3.1 (K2) Summarize the generic risk factors that the Technical Test Analyst typically needs to consider #1
More informationImproving Security in the Application Development Life-cycle
Improving Security in the Application Development Life-cycle Migchiel de Jong Software Security Engineer mdejong@fortifysoftware.com March 9, 2006 General contact: Jurgen Teulings, 06-30072736 jteulings@fortifysoftware.com
More informationWebapps Vulnerability Report
Webapps Vulnerability Report Tuesday, January 12, 2010 Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE IMPACT during this
More informationWeb Application Firewall Subscription on Cyberoam UTM appliances
On-Appliance Reporting Web Application Firewall Subscription on Cyberoam UTM appliances Protecting Web Applications from hackers Application Visibility and Control Bandwidth Management Firewall Web Application
More informationOutline STRANGER. Background
Outline Malicious Code Analysis II : An Automata-based String Analysis Tool for PHP 1 Mitchell Adair 2 November 28 th, 2011 Outline 1 2 Credit: [: An Automata-based String Analysis Tool for PHP] Background
More informationMetrics, Methods and Tools to Measure Security and Trustworthiness
Metrics, Methods and Tools to Measure Security and Trustworthiness Henrique Madeira, University of Coimbra, Portugal Doctoral Symposium in Informatics Engineering FEUP, January 28 th - 29 th, 2010 University
More informationMeeting PCI DSS 3.2 Compliance with RiskSense Solutions
Meeting PCI DSS 3.2 Compliance with Solutions Platform the industry s most comprehensive, intelligent platform for managing cyber risk. 2018, Inc. What s Changing with PCI DSS? Summary of PCI Business
More informationSecure Application Development. OWASP September 28, The OWASP Foundation
Secure Application Development September 28, 2011 Rohini Sulatycki Senior Security Consultant Trustwave rsulatycki@trustwave.com Copyright The Foundation Permission is granted to copy, distribute and/or
More informationPT Unified Application Security Enforcement. ptsecurity.com
PT Unified Application Security Enforcement ptsecurity.com Positive Technologies: Ongoing research for the best solutions Penetration Testing ICS/SCADA Security Assessment Over 700 employees globally Over
More informationBUILDING APPLICATION SECURITY INTO PRODUCTION CONTAINER ENVIRONMENTS Informed by the National Institute of Standards and Technology
BUILDING APPLICATION SECURITY INTO PRODUCTION CONTAINER ENVIRONMENTS Informed by the National Institute of Standards and Technology ebook BUILDING APPLICATION SECURITY INTO PRODUCTION CONTAINER ENVIRONMENTS
More informationDouble Guard: Detecting intrusions in Multitier web applications with Security
ISSN 2395-1621 Double Guard: Detecting intrusions in Multitier web applications with Security #1 Amit Patil, #2 Vishal Thorat, #3 Amit Mane 1 amitpatil1810@gmail.com 2 vishalthorat5233@gmail.com 3 amitmane9975@gmail.com
More informationChapter 5: Database Security
i Chapter 5: Comp Sci 3600 Outline i 1 2 i 3 4 5 Outline i 1 2 i 3 4 5 What is a i Structured collection of data stored for use by one or more applications Contains the relationships between data items
More informationThe Need for Confluence
The Need for Confluence The Essential Role of Incident Response in Secure Software Development Why do security incidents occur? What is the root cause? Faulty software (more often than not) What is the
More informationA Novel Approach to Detect and Prevent Known and Unknown Attacks in Local Area Network
International Journal of Wireless Communications, Networking and Mobile Computing 2016; 3(4): 43-47 http://www.aascit.org/journal/wcnmc ISSN: 2381-1137 (Print); ISSN: 2381-1145 (Online) A Novel Approach
More informationMalicious Code Analysis II
Malicious Code Analysis II STRANGER: An Automata-based String Analysis Tool for PHP Mitchell Adair November 28 th, 2011 Outline 1 STRANGER 2 Outline 1 STRANGER 2 STRANGER Credit: [STRANGER: An Automata-based
More information