Risk Analysis and Measurement with CWRAF
|
|
|
- Caren Dennis
- 6 years ago
- Views:
Transcription
1 Risk Analysis and Measurement with CWRAF - Common Weakness Risk Analysis Framework - April 4, 2012
2 Making Security Measurable (MSM) Software Assurance Enterprise Security Management Threat Management Design Design Vulnerabilities Deploy Build Assess Test Exploits Attacks Test Deploy Malware CWE, CAPEC, CWSS, CWRAF CPE, CCE, OVAL, OCIL, XCCDF, AssetId, ARF CVE, CWE, CAPEC, MAEC, CybOX, IODEF, RID, RID-T, CYBEX
3 Like an Ecosystem Your System is When this Other System gets subverted through an un-patched vulnerability, a mis-configuration, or an application
4
5
6
7
8
9
10
11
12
13
14 CVE 1999 to
15 Vulnerability Type Trends: A Look at the CVE List ( )
16 Removing and Preventing the Vulnerabilities Improper Neutralization of Input During Web Page Generation ('Cross- (79) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (80) Improper Neutralization of Script in an Error Message Web Page (81) Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (82) Improper Neutralization of Script in Attributes in a Web Page (83) Improper Neutralization of Encoded URI Schemes in a Web Page (84) Doubled Character XSS Manipulations (85) Improper Neutralization of Invalid Characters in Identifiers in Web Pages (86) Improper Neutralization of Alternate XSS Syntax (87) Improper Restriction of Operations within the Bounds of a Memory Buffer (119) (120) Write-what-where Condition (123) Out-of-bounds Read (125) Improper Handling of Length Parameter Inconsistency (130) Improper Validation of Array Index (129) Return of Pointer Value Outside of Expected Range (466) Access of Memory Location Before Start of Buffer (786) Access of Memory Location After End of Buffer (788) Buffer Access with Incorrect Length Value 805 Untrusted Pointer Dereference (822) Use of Out-of-range Pointer Offset (823) Access of Uninitialized Pointer (824) Expired Pointer Dereference (825) Path Traversal (22) Relative Path Traversal (23) Path Traversal: '../filedir' (24) Path Traversal: '/../filedir' (25) < more here > Path Traversal: '...//' (34) Path Traversal: '.../...//' (35) Absolute Path Traversal (36) Path Traversal: '\absolute\pathname\ Path Traversal: 'C:dirname Path Traversal: '\\UNC\share\name\' (Windows UNC Share) (40)
17
18 What is wrong with this picture? if the weaknesses in software were as easy to spot and their impact as easy to understand as a screen door in
19
20
21 But you also needed to deal with the people that are out there trying to take advantage of vulnerabilities and weaknesses in your technologies, processes, or
22 offensive security capabilities The MITRE Corporation. All rights reserved.
23 Security Feature XSS (CWE-79) Exploit (CAPEC-86) SQL Injection (CWE-89) Exploit (CAPEC-66)
24 SQL Injection Attack Execution Flow User 2. One SQL error message MS SQL Database SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='$user_input' ORDER 4. SQL error BY message PRICE 5. Web Form with: ' exec master..xp_cmdshell 'dir' a listing of all directories
25 Simple test case for SQL Injection Test Case 1: Single quote SQL injection of registration page web form fields Test Case Goal: Ensure SQL syntax single quote character entered in registration page web form fields does not cause abnormal SQL behavior Context: This test case is part of a broader SQL injection syntax exploration suite of tests to probe various potential injection points for susceptibility to SQL injection. If this test case fails, it should be followed-up with test cases from the SQL injection experimentation test suite. Preconditions: Access to system registration page exists Registration page web form field content are used by system in SQL queries of the system database upon page submission User has the ability to enter free-form text into registration page web form fields Test Data: ASCII single quote character Action Steps: Enter single quote character into each web form field on the registration page Submit the contents of the registration page Postconditions: Test case fails if SQL error is thrown Test case passes if page submission succeeds without any SQL errors
26
27
28
29
30 CWE web site visitors by City
31
32
33 16 July 2010
34
35 Industry Uptake CWE
36
37
38 ISO/IEC JTC 1/SC 27/WG 3, NWP
39 CWE Compatibility & Effectiveness Program ( launched Feb 2007) First 13 CWE Compatible Certificates Awarded 28 Feb 2012 cwe.mitre.org/compatible/ 33 60
40
41 Korean Japanese
42 CWE Coverage
43 * Program Office The Software Supply Chain Reuse Legacy Software Contractor?? Prime Contractor Outsource Supplier Other Programs US Global Contractor???? Acquire Develop In-house Foreign Supplier Software Off-shore Foreign Location COTS US Foreign Developers Supplier Acquire Reuse? Develop In-house Outsource??? *? Secure Software GAO-04-
44 Recreation Use Industrial Use Power Use Agricultural Use Home Use Recreation Use Agricultural Use
45
46 Prioritizing weaknesses to be mitigated OWASP Top 10 CWE/SANS Top 25 Lists are a good start but they are designed to be broadly applicable We would like a way to specify priorities based on business/mission risk
47 Common Weakness Risk Analysis Framework (CWRAF) are most important for my specific business domain, technologies and environment? Common Weakness Scoring System (CWSS) according to my specific business domain, technologies and environment? How do I identify and score weaknesses important to my organization?
48 CWRAF-Level Technical Impacts 1. Modify data 2. Read data 3. DoS: unreliable execution 4. DoS: resource consumption 5. Execute unauthorized code or commands 6. Gain privileges / assume identity 7. Bypass protection mechanism 8. Hide activities
49 Common Weakness Risk Analysis Framework (CWRAF) Weightings Technical Impacts 1. Modify data 2. Read data 3. DoS: unreliable execution 4. DoS: resource consumption 5. Execute unauthorized code or commands 6. Gain privileges / assume identity 7. Bypass protection mechanism 8. Hide activities W1=0 W2=0 W3=1 0 W4=4 W5=1 0 W6=0 W7=0 W8=0 Technical Impact Scorecard Layers 1. System 2. Application 3. Network 4. Enterprise Multiple pieces
50 CWRAF: Technical Impact Scorecard and each technical impact MD RD UE RC EA GP BP HA Application System Network Enterprise 8 3 For each layer assign a weighting from 0 to 10
51 CWRAF: Technical Impact Scorecard MD RD UE RC EA GP BP HA Application System Network Enterprise These weightings can now be used Note: Values for illustrative purposes only
52 Note: Values for illustrative purposes only Notional Applicatio n MD RD UE RC EA GP BP HA System Network Enterprise CWE-78 Technical Impacts CWSS 95 Formula CWSS Score for CWE-78 for this vignette Common Weakness Scoring System (CWSS)
53 CWSS Score CWE 97 CWE CWE CWE CWE CWE CWE CWE CWE CWE CWE CWE CWE CWE CWE CWE-131 CWSS Scoring Engine Userdefined cutoff W W d Most Important Weaknesses CWRAF/CWSS in a Nutshell
54 Scoring Weaknesses Discovered in Code using CWSS
55 Organizations that have declared plans to support CWSS in their future offerings and are working with MITRE to help evolve CWSS to meet their customer's and the community's needs for a scoring system for software errors.
56 CWE Coverage Claims Representation Tool A claims to cover Tool B Most Important Weaknes ses Tool C
57 CWSS for a Technology Group 50% 10% 10% 10% 15% 15% Web Application Technology Group Top N List 1 Top N List 2 Top N List 3 Top N List 4 Top N List 5 Top N List 6 Top 10 List CWE Top 10 List for Web Applications can be used to: Identify skill and training needs for your web team Identify tool capability needs to support web assessment
58
59
60 Vignettes Technology Groups & Business/Mission Domains Common Weakness Risk Assessment Framework uses Vignettes with Archetypes to identify top CWEs in respective Domain/Technology Groups
61 Organizations that have declared plans to work on CWRAF Vignettes and Technical Scorecards with MITRE to help evolve CWRAF to meet their customer's and the community's needs for a scoring system for software errors.
62 Relationships between CWRAF, CWSS, and CWE
63 Contact Info
Engineering Your Software For Attack
Engineering Your Software For Attack Robert A. Martin Senior Principal Engineer Cyber Security Center Center for National Security The MITRE Corporation 2013 The MITRE Corporation. All rights reserved.
Software Assurance Ecosystem Knowledge Architecture. 1 Wednesday, December 31, 2008
Software Assurance Ecosystem Knowledge Architecture 1 1 Wednesday, December 31, 2008 What Do The Building Blocks for Measuring Assurance Look Like? Standard ways for enumerating things we care about Languages/Formats
Ranking Vulnerability for Web Application based on Severity Ratings Analysis
Ranking Vulnerability for Web Application based on Severity Ratings Analysis Nitish Kumar #1, Kumar Rajnish #2 Anil Kumar #3 1,2,3 Department of Computer Science & Engineering, Birla Institute of Technology,
SAP Security. BIZEC APP/11 Version 2.0 BIZEC TEC/11 Version 2.0
Welcome BIZEC Roundtable @ IT Defense, Berlin SAP Security BIZEC APP/11 Version 2.0 BIZEC TEC/11 Version 2.0 February 1, 2013 Andreas Wiegenstein CTO, Virtual Forge 2 SAP Security SAP security is a complex
IEEE Sec Dev Conference
IEEE Sec Dev Conference #23, Improving Attention to Security in Software Design with Analytics and Cognitive Techniques Jim Whitmore (former) IBM Distinguished Engineer Carlisle, PA jjwhitmore@ieee.org
Building Secure Systems
Building Secure Systems Antony Selim, CISSP, P.E. Cyber Security and Enterprise Security Architecture 13 November 2015 Copyright 2015 Raytheon Company. All rights reserved. Customer Success Is Our Mission
Attack Vectors in Computer Security
Attack Vectors in Computer Security Who Am I @WillGoard My first proper hacksoc talk I speak fluent greek Sell more pizzas have more fun Why attack vectors? Didn t know what to do for my dissertation Started
Software Assurance: Enabling Education and Training to better address needs of Security Automation and Software Supply Chain Risk Management
Software Assurance: Enabling Education and Training to better address needs of Security Automation and Software Supply Chain Risk Joe Jarzombek, PMP, CSSLP Director for Software Assurance Cyber Security
Webapps Vulnerability Report
Webapps Vulnerability Report Tuesday, January 12, 2010 Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE IMPACT during this
Cybersecurity Technical Risk Indicators:
Cybersecurity Technical Risk Indicators: A Measure of Technical Debt Joe Jarzombek, CSSLP, PMP Global Manager, Software Supply Chain Solutions Synopsys Software Integrity Group Previously Director, Software
MAKING SECURITY MEASURABLE AND MANAGEABLE
MAKING SECURITY MEASURABLE AND MANAGEABLE Robert A. Martin The MITRE Corporation Bedford, MA ABSTRACT The security and integrity of information systems is a critical issue within most types of organizations.
C1: Define Security Requirements
OWASP Top 10 Proactive Controls IEEE Top 10 Software Security Design Flaws OWASP Top 10 Vulnerabilities Mitigated OWASP Mobile Top 10 Vulnerabilities Mitigated C1: Define Security Requirements A security
BEST PRACTICES FOR SELECTING A WEB APPLICATION SCANNING (WAS) SOLUTION
GUIDE BEST PRACTICES FOR SELECTING A WEB APPLICATION SCANNING (WAS) SOLUTION CONTINUOUS SECURITY With attackers getting more sophisticated every day, manual methods of locating and testing web-based apps
Software Assurance: Measurable Security for FISMA, IAVA, and PPP Reporting Requirements and Criteria. Focusing on Program Protection Plans
Software Assurance: Measurable Security for FISMA, IAVA, and PPP Reporting Requirements and Criteria Focusing on Program Protection Plans August 1, 2012 Joe Jarzombek, PMP, CSSLP Director for Software
Enabling Distributed Event Management: Interoperability for Automated Response and Prevention. Sean Barnum George Saylor Aug 2011
Enabling Distributed Event Management: Interoperability for Automated Response and Prevention Sean Barnum George Saylor Aug 2011 The HS SEDI FFRDC is managed and operated by The MITRE Corporation for DHS.
Case Study: The Evolution of EMC s Product Security Office. Dan Reddy, CISSP, CSSLP EMC Product Security Office
Case Study: The Evolution of EMC s Product Security Office Dan Reddy, CISSP, CSSLP EMC Product Security Office 1 The Evolution of EMC Product Security 2000-2004 2005-2009 2010-Beyond External Drivers Hackers
RiskSense Attack Surface Validation for Web Applications
RiskSense Attack Surface Validation for Web Applications 2018 RiskSense, Inc. Keeping Pace with Digital Business No Excuses for Not Finding Risk Exposure We needed a faster way of getting a risk assessment
Software Security and CISQ. Dr. Bill Curtis Executive Director
Software Security and CISQ Dr. Bill Curtis Executive Director Why Measure IT Applications? Six Digit Defects now affect Board of Directors CEO, COO, CFO Business VPs Corporate Auditors CIO accountable
Saving Time and Costs with Virtual Patching and Legacy Application Modernizing
Case Study Virtual Patching/Legacy Applications May 2017 Saving Time and Costs with Virtual Patching and Legacy Application Modernizing Instant security and operations improvement without code changes
Supply Chain Information Exchange: Non-conforming & Authentic Components
Supply Chain Information Exchange: Non-conforming & Authentic Components Joe Jarzombek Director for Software and Supply Chain Assurance Stakeholder Engagement & Cyber Infrastructure Resilience Agenda Purpose
RiskSense Attack Surface Validation for IoT Systems
RiskSense Attack Surface Validation for IoT Systems 2018 RiskSense, Inc. Surfacing Double Exposure Risks Changing Times and Assessment Focus Our view of security assessments has changed. There is diminishing
Provide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any
OWASP Top 10 Provide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any tester can (and should) do security testing
Software & Supply Chain Assurance: Enabling Enterprise Resilience through Security Automation, Software Assurance and Supply Chain Risk Management
Software & Supply Chain Assurance: Enabling Enterprise Resilience through Security Automation, Software Assurance and Supply Chain Risk Management Joe Jarzombek, PMP, CSSLP Director for Software & Supply
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
Measuring and Evaluating Cyber Risk in ICS Components, Products and Systems
Measuring and Evaluating Cyber Risk in ICS Components, Products and Systems Copyright 2018 UL LLC. All rights reserved. No portion of this material may be reprinted in any form without the express written
State of Software Security Report Volume 2. Jeff Ennis, CEH Solutions Architect Veracode
State of Software Security Report Volume 2 Jeff Ennis, CEH Solutions Architect Veracode 1 Agenda Background Metrics, Distribution of Applications Security of Applications Third Party Risk Summary 2 Background
Programming Language Vulnerabilities within the ISO/IEC Standardization Community
Programming Language Vulnerabilities within the ISO/IEC Standardization Community Stephen Michell International Convenor JTC 1/SC 22 WG 23 Programming Language Vulnerabilities stephen.michell@maurya.on.ca
The Weakest Link: Mitigating Web Application Vulnerabilities. webscurity White Paper. webscurity Inc. Minneapolis, Minnesota USA
The Weakest Link: Mitigating Web Application Vulnerabilities webscurity White Paper webscurity Inc. Minneapolis, Minnesota USA March 19, 2008 Contents Executive Summary...3 Introduction...4 Target Audience...4
Copyright
1 Security Test EXTRA Workshop : ANSWER THESE QUESTIONS 1. What do you consider to be the biggest security issues with mobile phones? 2. How seriously are consumers and companies taking these threats?
Application security : going quicker
Application security : going quicker The web application firewall example Agenda Agenda o Intro o Application security o The dev team approach o The infra team approach o Impact of the agility o The WAF
Managed Application Security trends and best practices in application security
Managed Application Security trends and best practices in application security Adrian Locusteanu, B2B Delivery Director, Telekom Romania adrian.locusteanu@telekom.ro About Me Adrian Locusteanu is the B2B
Security Solutions. Overview. Business Needs
Security Solutions Overview Information security is not a one time event. The dynamic nature of computer networks mandates that examining and ensuring information security be a constant and vigilant effort.
What can an Acquirer do to prevent developers from make dangerous software errors? OWASP AppSec DC 2012 April 5, 2012
What can an Acquirer do to prevent developers from make dangerous software errors? OWASP AppSec DC 2012 April 5, 2012 Key questions Do acquirers know why they need include requirements for secure code?
Inverting Risk Management for Ethical Hacking. SecureWorld Expo 09
Inverting Risk Management for Ethical Hacking SecureWorld Expo 09 Agenda Speaker Introductions Learning Objectives Framework of Risk Management & Analysis (FoRMA) Duality of Risk Demonstration of Information
HP 2012 Cyber Security Risk Report Overview
HP 2012 Cyber Security Risk Report Overview September 2013 Paras Shah Software Security Assurance - Canada Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject
Tenable SCAP Standards Declarations. June 4, 2015 (Revision 11)
Tenable SCAP Standards Declarations June 4, 2015 (Revision 11) Table of Contents Center for Internet Security (CIS)... 3 Common Criteria (NIAP)... 3 Common Vulnerability Enumeration (CVE)... 3 Common Configuration
Cybersecurity Technical Risk Indicators:
Cybersecurity Technical Risk Indicators: A Measure of Technical Debt in Software Supply Chain Risk Management Joe Jarzombek, USAF Lt Col (Retired), CSSLP, PMP Global Manager, Software Supply Chain Solutions
Pillars of Cyber Risk as Competitive Advantage: Enabling Enterprise Resilience & Cyber Security Assurance through Software Supply Chain Management
Pillars of Cyber Risk as Competitive Advantage: Enabling Enterprise Resilience & Cyber Security Assurance through Software Supply Chain Management OMG Cyber Risk Summit Pillars of Cyber Risk as Competitive
OPEN WEB APPLICATION SECURITY PROJECT OWASP TOP 10 VULNERABILITIES
OPEN WEB APPLICATION SECURITY PROJECT OWASP TOP 10 VULNERABILITIES What is the OWASP Top 10? A list of the top ten web application vulnerabilities Determined by OWASP and the security community at large
Software Security Weaknesses Avoiding and Testing
Software Security Weaknesses ---------------- Avoiding and Testing 18 December 2007 Robert A. Martin Goal of the Common Weakness Enumeration Initiative To improve the quality of software with respect to
Security in a Mainframe Emulator. Chaining Security Vulnerabilities Until Disaster Strikes (twice) Author Tim Thurlings & Meiyer Goren
Security in a Mainframe Emulator Chaining Security Vulnerabilities Until Disaster Strikes (twice) Author Tim Thurlings & Meiyer Goren October 25, 2017 Table of Contents Introduction... 2 About this paper...
Scan Report Executive Summary. Part 2. Component Compliance Summary IP Address :
Scan Report Executive Summary Part 1. Scan Information Scan Customer Company: Date scan was completed: Vin65 ASV Company: Comodo CA Limited 03/18/2015 Scan expiration date: 06/16/2015 Part 2. Component
INF3700 Informasjonsteknologi og samfunn. Application Security. Audun Jøsang University of Oslo Spring 2015
INF3700 Informasjonsteknologi og samfunn Application Security Audun Jøsang University of Oslo Spring 2015 Outline Application Security Malicious Software Attacks on applications 2 Malicious Software 3
Students should have an understanding and a working knowledge in the following topics, or attend these courses as a pre-requisite:
Secure Java Web Application Development Lifecycle - SDL (TT8325-J) Day(s): 5 Course Code: GK1107 Overview Secure Java Web Application Development Lifecycle (SDL) is a lab-intensive, hands-on Java / JEE
Practical OpenSCAP Security Standard Compliance and Reporting. Robin Price II Senior Solutions Architect Martin Preisler Senior Software Engineer
Practical OpenSCAP Security Standard Compliance and Reporting Robin Price II Senior Solutions Architect Martin Preisler Senior Software Engineer INTRODUCTION AGENDA Review some slides Follow along demostration
Symlink attacks. Do not assume that symlinks are trustworthy: Example 1
Symlink attacks Do not assume that symlinks are trustworthy: Example 1 Application A creates a file for writing in /tmp. It assumes that since the file name is unusual, or because it encodes A's name or
Web Application & Web Server Vulnerabilities Assessment Pankaj Sharma
Web Application & Web Server Vulnerabilities Assessment Pankaj Sharma Indian Computer Emergency Response Team ( CERT - IN ) Department Of Information Technology 1 Agenda Introduction What are Web Applications?
Automotive Software Security Testing
Detecting and Addressing Cybersecurity Issues V1.1 2018-03-05 Code ahead! 2 Automated vulnerability detection and triage + = 3 How did we get here? Vector was engaged with a large, US Tier 1 and we were
Vulnerability Management From B Movie to Blockbuster Rahim Jina
Vulnerability Management From B Movie to Blockbuster Rahim Jina 5 December 2018 Rahim Jina COO & Co-Founder Edgescan & BCC Risk Advisory @rahimjina rahim@edgescan.com HACKED Its (not) the $$$$ Information
Web Application Vulnerabilities: OWASP Top 10 Revisited
Pattern Recognition and Applications Lab Web Application Vulnerabilities: OWASP Top 10 Revisited Igino Corona igino.corona AT diee.unica.it Computer Security April 5th, 2018 Department of Electrical and
Robert Hayes Senior Director Microsoft Global Cyber Security & Data Protection Group
Robert Hayes Senior Director Microsoft Global Cyber Security & Data Protection Group Presentation Objectives Introductions Cyber security context Cyber security in the maritime sector Developing cybersecurity
Is Browsing Safe? Web Browser Security. Subverting the Browser. Browser Security Model. XSS / Script Injection. 1. XSS / Script Injection
Is Browsing Safe? Web Browser Security Charlie Reis Guest Lecture - CSE 490K - 5/24/2007 Send Spam Search Results Change Address? Install Malware Web Mail Movie Rentals 2 Browser Security Model Pages are
Cyber Observables and Integration with EMAP EMAP 2011 Developer Days
Cyber Observables and Integration with EMAP EMAP 2011 Developer Days Sean Barnum Aug 2011 Knowledge Repositories Asset Definition Configuration Guidance Vulnerability Alert Threat Alert Incident Report
Qualys Cloud Platform
Qualys Cloud Platform Quick Tour The Qualys Cloud Platform is a platform of integrated solutions that provides businesses with asset discovery, network security, web application security, threat protection
Exposing The Misuse of The Foundation of Online Security
Exposing The Misuse of The Foundation of Online Security HLA ID: 90FZSBZFZSB 56BVCXVBVCK 23YSLUSYSLI 01GATCAGATC Cyber space is very similar to organic realm Keys & certificates are like HLA tags But,
A Supply Chain Attack Framework to Support Department of Defense Supply Chain Security Risk Management
A Supply Chain Attack Framework to Support Department of Defense Supply Chain Security Risk Management D r. J o h n F. M i l l e r T h e M I T R E C o r p o r a t i o n P e t e r D. K e r t z n e r T h
K12 Cybersecurity Roadmap
K12 Cybersecurity Roadmap Introduction Jason Brown, CISSP Chief Information Security Officer Merit Network, Inc jbrown@merit.edu @jasonbrown17 https://linkedin.com/in/jasonbrown17 2 Agenda 3 Why Use the
Protecting Against Modern Attacks. Protection Against Modern Attack Vectors
Protecting Against Modern Attacks Protection Against Modern Attack Vectors CYBER SECURITY IS A CEO ISSUE. - M C K I N S E Y $4.0M 81% >300K 87% is the average cost of a data breach per incident. of breaches
10 FOCUS AREAS FOR BREACH PREVENTION
10 FOCUS AREAS FOR BREACH PREVENTION Keith Turpin Chief Information Security Officer Universal Weather and Aviation Why It Matters Loss of Personally Identifiable Information (PII) Loss of Intellectual
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Unauthorized Access
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
A (sample) computerized system for publishing the daily currency exchange rates
A (sample) computerized system for publishing the daily currency exchange rates The Treasury Department has constructed a computerized system that publishes the daily exchange rates of the local currency
VULNERABILITIES IN 2017 CODE ANALYSIS WEB APPLICATION AUTOMATED
AUTOMATED CODE ANALYSIS WEB APPLICATION VULNERABILITIES IN 2017 CONTENTS Introduction...3 Testing methods and classification...3 1. Executive summary...4 2. How PT AI works...4 2.1. Verifying vulnerabilities...5
Going Without CPU Patches on Oracle E-Business Suite 11i?
Going Without CPU Patches on E-Business Suite 11i? September 17, 2013 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation About
AUTOMATED PROCESSES IN COMPUTER SECURITY
AUTOMATED PROCESSES IN COMPUTER SECURITY Maroš Barabas Doctoral Degree Programme (3), FIT BUT E-mail: ibarabas@fit.vutbr.cz Supervised by: Petr Hanáček E-mail: hanacek@fit.vutbr.cz ABSTRACT This article
A Study on Secure SDLC Specialized in Common Criteria
, pp.19-23 http://dx.doi.org/10.14257/astl.2015.93.05 A Study on Secure SDLC Specialized in Common Criteria Min-Gyu Lee 1, Hyo-jung Sohn 2, Baek-MinSeong 3 and Jong-Bae Kim 4* 1,2,3,4* Graduate School
Finding Vulnerabilities in Web Applications
Finding Vulnerabilities in Web Applications Christopher Kruegel, Technical University Vienna Evolving Networks, Evolving Threats The past few years have witnessed a significant increase in the number of
Certified Vulnerability Assessor
Certified Vulnerability Assessor COURSE BENEFITS Course Title:Certified Vulnerability Assessor Duration: 3Day Language: English Class Format Options: Instructor-led classroom Live Online Training Prerequisites:
Protocols for exchange of cyber security information
Protocols for exchange of cyber security information Ing. Július Baráth, PhD. julius.barath@aos.sk Department of informatics Armed Forces Academy Liptovský Mikuláš, Slovakia doc. Ing. Marcel Harakaľ, PhD.
Application vulnerabilities and defences
Application vulnerabilities and defences In this lecture We examine the following : SQL injection XSS CSRF SQL injection SQL injection is a basic attack used to either gain unauthorized access to a database
Detection of Logic Flaws in Web Applications
Detection of Logic Flaws in Web Applications Davide Balzarotti Giancarlo Pellegrino Distributed, Service-oriented, Web-based applications Seller Inc. Bank Inc. U S P Order item I Transfer value(i) to S
Under the hood testing - Code Reviews - - Harshvardhan Parmar
Under the hood testing - Code Reviews - - Harshvardhan Parmar In the news September 2011 A leading bank s Database hacked (SQLi) June 2011 Sony hack exposes consumer passwords (SQLi) April 2011 Sony sites
Kishin Fatnani. Founder & Director K-Secure. Workshop : Application Security: Latest Trends by Cert-In, 30 th Jan, 2009
Securing Web Applications: Defense Mechanisms Kishin Fatnani Founder & Director K-Secure Workshop : Application Security: Latest Trends by Cert-In, 30 th Jan, 2009 1 Agenda Current scenario in Web Application
Tricolour Alphanumerical Spaghetti
AppSec Research 2012 Athens, Greece The OWASP Foundation https://www.owasp.org Tricolour Alphanumerical Spaghetti Application Vulnerability Severity Ranking Do you know your A, B, Cs from your 1, 2, 3s?
Hacking by Numbers OWASP. The OWASP Foundation
Hacking by Numbers OWASP Tom Brennan WhiteHat Security Inc. tom.brennan@whitehatsec.com 973-506-9303 skype: jinxpuppy Copyright The OWASP Foundation Permission is granted to copy, distribute and/or modify
CAMSCANNER TURN YOUR PHONE AND TABLET INTO SCANNER FOR
PDF NESSUS VULNERABILITY SCANNER - BASICS - SECURITYLEARN CAMSCANNER TURN YOUR PHONE AND TABLET INTO SCANNER FOR 1 / 6 2 / 6 3 / 6 website vulnerability scanner pdf Basics vulnerability scanning with NESSUS...
Vulnerabilities. To know your Enemy, you must become your Enemy. Information security: Vulnerabilities & attacks threats. difficult.
Vulnerabilities To know your Enemy, you must become your Enemy. "The Art of War", Sun Tzu André Zúquete Security 1 Information security: Vulnerabilities & attacks threats Discouragement measures difficult
Operationalizing the Three Principles of Advanced Threat Detection
SESSION ID: SDS2-R08 Operationalizing the Three Principles of Advanced Threat Detection ZULFIKAR RAMZAN, PH.D Chief Technology Officer RSA @zulfikar_ramzan Dealing with Traffic Congestion Singapore: Major
This slide shows the OWASP Top 10 Web Application Security Risks of 2017, which is a list of the currently most dangerous web vulnerabilities in
1 This slide shows the OWASP Top 10 Web Application Security Risks of 2017, which is a list of the currently most dangerous web vulnerabilities in terms of prevalence (how much the vulnerability is widespread),
Web 2.0 and AJAX Security. OWASP Montgomery. August 21 st, 2007
Web 2.0 and AJAX Security OWASP Montgomery August 21 st, 2007 Overview Introduction Definition of Web 2.0 Basics of AJAX Attack Vectors for AJAX Applications AJAX and Application Security Conclusions 1
Automating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
About the company. What we do? Cybersecurity solutions adapted to protect enterprise business applications (SAP & Oracle).
About the company 2 What we do? Cybersecurity solutions adapted to protect enterprise business applications (SAP & Oracle). Agenda 3 Building a business case for SAP Vulnerability Management How to start
Comprehensive Database Security
Comprehensive Database Security Safeguard against internal and external threats In today s enterprises, databases house some of the most highly sensitive, tightly regulated data the very data that is sought
Unit Level Secure by Design Approach
Unit Level Secure by Design Approach Abstract Authors: Vasantharaju MS & Joshua Cajetan Rebelo Vasantharaju_MS@McAfee.com Joshua.Rebelo@Siemens.com With cyber-attacks on the rise and high-profile breaches
Meeting PCI DSS 3.2 Compliance with RiskSense Solutions
Meeting PCI DSS 3.2 Compliance with Solutions Platform the industry s most comprehensive, intelligent platform for managing cyber risk. 2018, Inc. What s Changing with PCI DSS? Summary of PCI Business
Web Applications Penetration Testing
Web Applications Penetration Testing Team Members: Rahul Motwani (2016ME10675) Akshat Khare (2016CS10315) ftarth Chopra (2016TT10829) Supervisor: Prof. Ranjan Bose Before proceeding further, we would like
Procurement Language for Supply Chain Cyber Assurance
Procurement Language for Supply Chain Cyber Assurance Procurement Language for Supply Chain Cyber Assurance Introduction For optimal viewing of this PDF, please view in Adobe Acrobat. This document serves
ME?
ME? VULNEX: Blog: Twitter: www.vulnex.com www.simonroses.com @simonroses TALK OBJECTIVES Apps are the new Web Peek into current state of Apps security on Markets Bugs will be revealed but not the victims
Executive Summary. Flex Bounty Program Overview. Bugcrowd Inc Page 2 of 7
CANVAS by Instructure Bugcrowd Flex Program Results December 01 Executive Summary Bugcrowd Inc was engaged by Instructure to perform a Flex Bounty program, commonly known as a crowdsourced penetration
OWASP TOP Release. Andy Willingham June 12, 2018 OWASP Cincinnati
OWASP TOP 10 2017 Release Andy Willingham June 12, 2018 OWASP Cincinnati Agenda A quick history lesson The Top 10(s) Web Mobile Privacy Protective Controls Why have a Top 10? Software runs the world (infrastructure,
CIS 700/002 : Special Topics : OWASP ZED (ZAP)
CIS 700/002 : Special Topics : OWASP ZED (ZAP) Hitali Sheth CIS 700/002: Security of EMBS/CPS/IoT Department of Computer and Information Science School of Engineering and Applied Science University of
Configuring User Defined Patterns
The allows you to create customized data patterns which can be detected and handled according to the configured security settings. The uses regular expressions (regex) to define data type patterns. Custom
Application Layer Security
Application Layer Security General overview Ma. Angel Marquez Andrade Benefits of web Applications: No need to distribute separate client software Changes to the interface take effect immediately Client-side
Microsoft Office Protected-View Out-Of- Bound Array Access
Microsoft Office Protected-View Out-Of- Bound Array Access 2017-11-23 Software Microsoft Office Affected Versions Microsoft Excel 2010, 2013, 2016 (x86 and x64) CVE Reference Author Severity Vendor CVE-2017-8502
SOLUTION BRIEF. RiskSense Platform. RiskSense Platform the industry s most comprehensive, intelligent platform for managing cyber risk.
RiskSense Platform RiskSense Platform the industry s most comprehensive, intelligent platform for managing cyber risk. 27 RiskSense, Inc. Executive Summary The RiskSense Platform is a Software-as-a-Service
Mitigating Security Breaches in Retail Applications WHITE PAPER
Mitigating Security Breaches in Retail Applications WHITE PAPER Executive Summary Retail security breaches have always been a concern in the past, present and will continue to be in the future. They have
Application Security Approach
Technical Approach Page 1 CONTENTS Section Page No. 1. Introduction 3 2. What is Application Security 7 3. Typical Approaches 9 4. Methodology 11 Page 2 1. INTRODUCTION Page 3 It is a Unsafe Cyber world..
OPSEC and defense agains social engineering for devels, execs, and sart-ups
OPSEC and defense agains social engineering for devels, execs, and sart-ups @KirilsSolovjovs on twitter http://kirils.org for more Mg.sc.comp. Kirils Solovjovs Possible Security Problem: Social Engineering
Drone /12/2018. Threat Model. Description. Threats. Threat Source Risk Status Date Created
Drone - 2 04/12/2018 Threat Model Description Threats Threat Source Risk Status Date Created Mobile Phone: Sensitive Data Leakage Smart Devices Mobile Phone: Session Hijacking Smart Devices Mobile Phone:
Trustwave Managed Security Testing
Trustwave Managed Security Testing SOLUTION OVERVIEW Trustwave Managed Security Testing (MST) gives you visibility and insight into vulnerabilities and security weaknesses that need to be addressed to