V Conference on Application Security and Modern Technologies
|
|
- Hilary Morton
- 5 years ago
- Views:
Transcription
1 V Conference on Application Security and Modern Technologies In collaborazione con Venezia, Università Ca Foscari 6 Ottobre
2 Matteo Meucci OWASP Nuovi standard per la sicurezza applicativa 2
3 <AGENDA> 1. How OWASP can help Companies on software security 1.1 Devs, Architects 1.2 Auditors, Testers 1.2 CISO, Management 2. Focus on SAMM and GDPR </AGENDA> 3
4 Who Am I? Informatics Engineer (since 2001) Research: OWASP contributor (since 2002) OWASP-Italy Chair (since 2005) OWASP Testing Guide Lead (since 2006) Work: 16+ years on Information Security focusing on Software Security Minded Security The Software Security Company (since 2007) 4
5 1. How OWASP can help on software security 5
6 The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit also registered in Europe as a worldwide charitable organization focused on improving the security of software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is welcomed to participate in OWASP and all of our materials are available under free and open software licenses. 6
7 OWASP HAS ~140 PROJECTS PROTECT - These are tools and documents that can be used to guard against security-related design and implementation flaws. DETECT - These are tools and documents that can be used to find security-related design and implementation flaws. LIFE CYCLE - These are tools and documents that can be used to add security-related activities into the Software Development Life Cycle (SDLC). 7
8 Equifax Incident September 2017 Impacting approximately 143 million consumers Reason: Using library with known vulnerabilities (Apache Struts 2 vulnerability CVE ) 8 Timo Pagel
9 Detection of Components with Known Vulnerabilities Through 2020, 99% of vulnerabilities exploited will continue to be ones known by security and IT professionals for at least one year. Gartner, 2016 Source: Gartner s Top 10 Security Predictions Timo Pagel
10 Do you see there? Can you see a Secure Software? 10
11 DEVELOPERS, ARCHITECTS I would like to build secure software 11
12 OWASP TOP (?) A1-Injection A2-Broken Authentication and Session Management A3-Cross-Site Scripting (XSS) A4-Broken Access Control A5-Security Misconfiguration A6-Sensitive Data Exposure A7-Insufficient Attack Protection A8-Cross-Site Request Forgery (CSRF) A9-Using Components with Known vulnerabilities A10-Underprotected APIs Top 2013 is available in italian language 12
13 TOP10 PROACTIVE CONTROLS 1. Verify for Security Early and Often 2. Parameterize Queries 3. Encode Data 4. Validate All Inputs 5. Implement Identity and Authentication Controls 6. Implement Appropriate Access Controls 7. Protect Data 8. Implement Logging and Intrusion Detection 9. Leverage Security Frameworks and Libraries 10. Error and Exception Handling Project leaders: 13
14 OWASP CHEAT SHEETS Authentication Cheat Sheet Clickjacking Defense Cheat Sheet Cross-Site Request Forgery Prevention Cheat Sheet DOM based XSS Prevention Cheat Sheet HTML5 Security Cheat Sheet Input Validation Cheat Sheet Query Parameterization Cheat Sheet Session Management Cheat Sheet SAML Security Cheat Sheet Transport Layer Protection Cheat Sheet Unvalidated Redirects and Forwards Cheat Sheet XSS (Cross Site Scripting) Prevention Cheat Sheet 14
15 AUDITORS, TESTERS I would like to find all the bugs in this software 15
16 CODE REVIEW GUIDE Most comprehensive open source secure code review guide on the web Years of development effort Version 2 Numerous contributors Project Leader and Editor eoin.keary@owasp.org 16
17 CODE REVIEW GUIDE public void finduser() { boolean showresult = false; String username = this.request.getparameter("username");... this.context.put("username", username); this.context.put("showresult", showresult); } 17
18 TESTING GUIDE Most comprehensive open source secure testing guide on the web Years of development effort Version 4.0 produced in 2014 Hundred of contributors Project Leader and Editor Matteo Meucci, Andrew Muller 18
19 TESTING GUIDE =finduser&module=pm&username=%22%3e%3cscr ipt%3ealert%28123%29%3c/script%3e%3c%22 19
20 CISO, Management I would like to implement a Roadmap for Software Security 20
21 Secure SDLC SDLC phases Secure Software processes Define Secure Software Requirements Design Secure Software Design Develop Secure Software Implementation Deploy Secure Software Testing & Acceptance Maintain Secure Software Deployment & Maintenance 21
22 SDLC Stakeholders Source: Official (ISC)2 Guide to CSSLP (2012) 22
23 Roles and responsabilities Define Design Develop Risk Assessment Secure Design Design Review Business Analyst AppSec Specialist Security Manager Security Manager Application Owner Secure Requirements Business Analyst Security Manager Secure Architecture Software Architect Security Manager Threat Modeling Secure Development Business Analyst Software Architect, AppSec Specialist Deploy Software Acceptance Security Manager App Owner Secure Installation Developer System Engineer SCR and WAPT Hardening AppSec Specialist Maintain Web Intrusion Monitoring AppSec Specialist Sec Manager Change Management App Owner Develper System Engineer Fixing Developer 23
24 OWASP for CISO Use the OWASP Software Contract Annex to regulate your outsourcer contracts Use the CISO Guide for Management s Awareness Use the OWASP TopTen Proactive Controls, the Building Guide and Cheat sheets to write more secure software Use the OWASP Secure Code Review to review the code Use the OWASP Testing Guide to review to test your application 24
25 OWASP FOR CISO (2) The fixing process is the most important step of the process of software security Retest your application after a bug fixing or a new release to be sure that the right implementations are in place Use the OWASP SAMM to assess your maturity and to build an Application Security Program to manage the SDLC The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development. 25
26 Software Contract Annex 26
27 Software Contract Annex: the model 1. Security Requirements Client Development 5. Acceptance Secure Software Development Contract 4. Assurance 2. Libraries and frameworks 3. Security Review Secure Software Development Contract 27
28 OWASP Application Security Verification Standard (ASVS) 28
29 ASVS 29
30 ASVS Authentication Verification Requirements 30
31 OWASP Software Assurance Maturity Model (SAMM) 31
32 SAMM goals SAMM allows a Company to: Measure and improve software security best practices Focus on security risk to make effective use of security resources Find vulnerabilities earlier in the development process Design a Roadmap to manage the software security in your projects 32
33 OWASP SAMM: objectives The SAMM s goals are: Define and measure security-related activities throughout an organization Evaluate an organization s existing software security practices Build a balanced software security assurance program in well-defined iterations Demonstrate concrete improvements to a security assurance program 33
34 OWASP SAMM: 4 Business functions Define Governance Software development management activities and organisation-wide business processes Design Develop Construction Goal definition and software creation processes Deploy Verification Checking, evaluation and testing of software development artifacts Maintain Deployment Software release management and normal operational management 34
35 OWASP SAMM: 12 Security Practices 35
36 Step 1: conduct the assessment 36
37 Step 2: evaluate the assessment 37
38 Step 3: create the scorecard 38
39 Step 4: create the roadmap For each Security Practice write down the Activities to implement Evaluate the benefits and the efforts for the organization necessary to improve each Security Practice. 39
40 Step 4: create the roadmap 40
41 CASE-STUDY: HOW COMPANIES ARE APPROACHING THE GOVERNANCE OF SOFTWARE SECURITY 41
42 What Italian Companies are doing today Area: Governance Activities Participants Strategy and Metrics Conduct periodic industry wide cost comparisons, collect metrics for historic security spend (% project), past spending. 10% Policy and Compliance Identify and monitor external compliance drivers, build and maintain compliance guidelines. 80% Education and Guidance Training courses for Developers, Analysts, Auditors and Workshop for Management. 55% Source: Minded Security Results of 14 assessments from 2012 to
43 What Italian Companies are doing today (2) Area: Construction Activities Participants Secure Architecture Build the document for the Governance of the development outsourcing process. 30% Security Requirements Develop: Building Secure applications guidelines. 60% Secure Design Apply the methodology of threat modeling to the projects evaluated with medium to high risk in the definition phase of the project and the specific 10% Source: Minded Security Results of 14 assessments from 2012 to
44 What Italian Companies are doing today (3) Area: Verification Activities Participants Design Review Identify software attack surface, Analyze design against known security requirements, Inspect for complete provision of security mechanisms. 20% Code Review Conduct Manual Secure Code Review for critical applications 30% Security Testing Conduct penetration testing on software releases with fixing support. 75% Source: Minded Security Results of 14 assessments from 2012 to
45 What Italian Companies are doing today (4) Area: Deployment Vulnerability Management Activities Create information security response team(s) for the application security, Establish consistent incident response process, Conduct root cause analysis for application security incidents. Develop Hardening procedures for all your technologies, Implement a fixing process Environment Hardening to be sure to patch all the issues identified during the security assessment. Request support for fixing all the vulnerabilities identified during the Secure Operational Enablement Code Review and Penetration Testing activities. Participants 20% 60% 40% Source: Minded Security Results of 14 assessments from 2012 to
46 And finally the GDPR... 46
47 GDPR The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, intend to strengthen and unify data protection for all individuals within the European Union (EU). It also addresses the export of personal data outside the EU. The GDPR aims primarily to give control back to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. 47
48 GDPR: impact on Application Security Article Art. 4: Expansion of definition of personal data Activities The GDPR s definition of the personal data that must be protected is more detailed and broad than previous regulations. It can be anything from a name, a photo, an address, bank details, posts on social networking websites, medical information or a computer IP address. The GDPR includes a requirement to implement data protection by design and by default. This requirement involves creating applications from scratch with security and data protection in mind. Art. 25: Security For applications, security by design incorporates activities like threat by Design modeling, secure design, training developers on secure coding best practices, and ensuring that developers are not only coding securely, but also identifying and remediating security-related defects in their code (fixing) 48
49 GDPR: impact on Application Security (2) Article Activities Article 28 states that, in choosing a data processor(outside vendor), the controller shall select a processor providing sufficient guarantees to implement appropriate technical and organisational measures and Art. 28: procedures in such a way that the processing will meet the requirements Third-party of this Regulation and ensure the protection of the rights of the data vendor security subject. For application security, this means you can t assume the security of third-party software. You need sufficient guarantees that these externally sourced applications comply with the EU GDPR. Art. 33: Notification of a Under the EU GDPR, breach notification will become mandatory in all personal data member states where a data breach is likely to result in a risk for the breach to the rights and freedoms of individuals. This must be done within 72 hours of first having become aware of the breach. Data processors will also supervisory be required to notify their customers without undue delay after first authority becoming aware of a data breach. 49
50 SDLC and GDPR Art. 4: Expansion of definition of personal data Define Design Develop Risk Assessment Secure Design Design Review Software Acceptance Web Intrusion Monitoring Secure Requirements Threat Modeling Secure Development Secure Installation Change Management Secure Architecture SCR and WAPT Deploy Maintain Hardening Fixing 50
51 SDLC and GDPR Art. 25: Security by Design Define Design Develop Risk Assessment Secure Design Design Review Software Acceptance Web Intrusion Monitoring Secure Requirements Threat Modeling Secure Development Secure Installation Change Management Secure Architecture SCR and WAPT Deploy Maintain Hardening Fixing 51
52 SDLC and GDPR Art. 28: Third-party vendor security Define Design Develop Risk Assessment Secure Design Design Review Software Acceptance Web Intrusion Monitoring Secure Requirements Threat Modeling Secure Development Secure Installation Change Management Secure Architecture SCR and WAPT Deploy Maintain Hardening Fixing 52
53 SDLC and GDPR Art. 33: Notification of a personal data breach to the supervisory authority Define Design Develop Risk Assessment Secure Design Design Review Software Acceptance Web Intrusion Monitoring Secure Requirements Threat Modeling Secure Development Secure Installation Change Management Secure Architecture SCR and WAPT Deploy Maintain Hardening Fixing 53
54 SDLC and GDPR: advantages GDPR and SDLC re-inforce each other (ab)use GDPR to start SDLC (business case) Improve SDLC by including GDPR activities SDLC deliverables with GDPR demonstrate compliance Thanks to: Embedding GDPR into the SDLC. Sebastien Deleersnyder, Siebe De Roovere 54
55 th OWASP Day: 20 October Cagliari 55
56 Thanks! /09/
In collaborazione con
In collaborazione con 1. Software Security Introduction 2. SDLC frameworks: how OWASP can help on software security 3. OWASP Software Security 5 Dimension Framework 4. Apply the models to a real
More informationOWASP Review. Amherst Security Group June 14, 2017 Robert Hurlbut.
OWASP Review Amherst Security Group June 14, 2017 Robert Hurlbut RobertHurlbut.com @RobertHurlbut Robert Hurlbut Software Security Consultant, Architect, and Trainer Owner / President of Robert Hurlbut
More informationEmbedding GDPR into the SDLC. Sebastien Deleersnyder Siebe De Roovere
Embedding GDPR into the SDLC Sebastien Deleersnyder Siebe De Roovere Who is Who? Sebastien Deleersnyder 5 years developer experience 15+ years information security experience Application security consultant
More informationEmbedding GDPR into the SDLC
Embedding GDPR into the SDLC Sebastien Deleersnyder Siebe De Roovere Toreon 2 Who is Who? Sebastien Deleersnyder Siebe De Roovere 5 years developer experience 15+ years information security experience
More informationOWASP Top 10 The Ten Most Critical Web Application Security Risks
OWASP Top 10 The Ten Most Critical Web Application Security Risks The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain
More informationDevelopment*Process*for*Secure* So2ware
Development*Process*for*Secure* So2ware Development Processes (Lecture outline) Emphasis on building secure software as opposed to building security software Major methodologies Microsoft's Security Development
More informationPresentation Overview
Presentation Overview Basic Application Security (AppSec) Fundamentals Risks Associated With Vulnerable Applications Understanding the Software Attack Surface Mean Time to Fix (MTTF) Explained Application
More informationAguascalientes Local Chapter. Kickoff
Aguascalientes Local Chapter Kickoff juan.gama@owasp.org About Us Chapter Leader Juan Gama Application Security Engineer @ Aspect Security 9+ years in Appsec, Testing, Development Maintainer of OWASP Benchmark
More informationSDLC Maturity Models
www.pwc.com SDLC Maturity Models SecAppDev 2017 Bart De Win Bart De Win? 20 years of Information Security Experience Ph.D. in Computer Science - Application Security Author of >60 scientific publications
More informationSECURITY TESTING. Towards a safer web world
SECURITY TESTING Towards a safer web world AGENDA 1. 3 W S OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS ate: 2013-14 Few Security Breaches September
More informationSecurity Communications and Awareness
Security Communications and Awareness elearning OVERVIEW Recent high-profile incidents underscore the need for security awareness training. In a world where your employees are frequently exposed to sophisticated
More informationNOTHING IS WHAT IT SIEMs: COVER PAGE. Simpler Way to Effective Threat Management TEMPLATE. Dan Pitman Principal Security Architect
NOTHING IS WHAT IT SIEMs: COVER PAGE Simpler Way to Effective Threat Management TEMPLATE Dan Pitman Principal Security Architect Cybersecurity is harder than it should be 2 SIEM can be harder than it should
More informationSecurity Communications and Awareness
Security Communications and Awareness elearning OVERVIEW Recent high-profile incidents underscore the need for security awareness training. In a world where your employees are frequently exposed to sophisticated
More informationManaging Privacy Risk & Compliance in Financial Services. Brett Hamilton Advisory Solutions Consultant ServiceNow
Managing Privacy Risk & Compliance in Financial Services Brett Hamilton Advisory Solutions Consultant ServiceNow 1 Speaker Introduction INSERT PHOTO Name: Brett Hamilton Title: Advisory Solutions Consultant
More informationPractical Guide to Securing the SDLC
Practical Guide to Securing the SDLC Branko Ninkovic Dragonfly Technologies Founder Agenda Understanding the Threats Software versus Security Goals Secure Coding and Testing A Proactive Approach to Secure
More informationOWASP Top David Caissy OWASP Los Angeles Chapter July 2017
OWASP Top 10-2017 David Caissy OWASP Los Angeles Chapter July 2017 About Me David Caissy Web App Penetration Tester Former Java Application Architect IT Security Trainer: Developers Penetration Testers
More informationContinuously Discover and Eliminate Security Risk in Production Apps
White Paper Security Continuously Discover and Eliminate Security Risk in Production Apps Table of Contents page Continuously Discover and Eliminate Security Risk in Production Apps... 1 Continuous Application
More informationAchieving Java Application Security With Parasoft Jtest
Achieving Java Application Security With Parasoft Jtest Cloud computing continues to gain traction as enterprises increasingly embrace the shift to Internet-based environments. Unfortunately, this also
More informationKenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you
More information01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED
01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED Contents 1. Introduction 3 2. Security Testing Methodologies 3 2.1 Internet Footprint Assessment 4 2.2 Infrastructure Assessments
More informationSECURITY TRAINING SECURITY TRAINING
SECURITY TRAINING SECURITY TRAINING Addressing software security effectively means applying a framework of focused activities throughout the software lifecycle in addition to implementing sundry security
More informationGuidelines. on the security measures for operational and security risks of payment services under Directive (EU) 2015/2366 (PSD2) EBA/GL/2017/17
GUIDELINES ON SECURITY MEASURES FOR OPERATIONAL AND SECURITY RISKS UNDER EBA/GL/2017/17 12/01/2018 Guidelines on the security measures for operational and security risks of payment services under Directive
More informationGoogle Cloud & the General Data Protection Regulation (GDPR)
Google Cloud & the General Data Protection Regulation (GDPR) INTRODUCTION General Data Protection Regulation (GDPR) On 25 May 2018, the most significant piece of European data protection legislation to
More informationManaged Application Security trends and best practices in application security
Managed Application Security trends and best practices in application security Adrian Locusteanu, B2B Delivery Director, Telekom Romania adrian.locusteanu@telekom.ro About Me Adrian Locusteanu is the B2B
More informationApplication Security Approach
Technical Approach Page 1 CONTENTS Section Page No. 1. Introduction 3 2. What is Application Security 7 3. Typical Approaches 9 4. Methodology 11 Page 2 1. INTRODUCTION Page 3 It is a Unsafe Cyber world..
More informationA New Cyber Defense Management Regulation. Ophir Zilbiger, CRISC, CISSP SECOZ CEO
A New Cyber Defense Management Regulation Ophir Zilbiger, CRISC, CISSP SECOZ CEO Personal Background IT and Internet professional (since 1992) PwC (1999-2003) Global SME for Network Director Information
More informationGDPR Update and ENISA guidelines
GDPR Update and ENISA guidelines 2016 [Type text] There are two topics that should be uppermost in every CISO's mind, how to address the growing demand for Unified Communications (UC) and how to ensure
More informationContinuous protection to reduce risk and maintain production availability
Industry Services Continuous protection to reduce risk and maintain production availability Managed Security Service Answers for industry. Managing your industrial cyber security risk requires world-leading
More informationReinvent Your 2013 Security Management Strategy
Reinvent Your 2013 Security Management Strategy Laurent Boutet 18 septembre 2013 Phone:+33 6 25 34 12 01 Email:laurent.boutet@skyboxsecurity.com www.skyboxsecurity.com What are Your Key Objectives for
More informationApplication Security for the Masses. OWASP Greek Chapter Meeting 16/3/2011. The OWASP Foundation
Application Security for the Masses Konstantinos Papapanagiotou Greek Chapter Leader Syntax IT Inc Greek Chapter Meeting 16/3/2011 Konstantinos@owasp.org Copyright The Foundation Permission is granted
More informationOPEN WEB APPLICATION SECURITY PROJECT OWASP TOP 10 VULNERABILITIES
OPEN WEB APPLICATION SECURITY PROJECT OWASP TOP 10 VULNERABILITIES What is the OWASP Top 10? A list of the top ten web application vulnerabilities Determined by OWASP and the security community at large
More informationCSWAE Certified Secure Web Application Engineer
CSWAE Certified Secure Web Application Engineer Overview Organizations and governments fall victim to internet based attacks every day. In many cases, web attacks could be thwarted but hackers, organized
More informationApplication. Security. on line training. Academy. by Appsec Labs
Application Security on line training Academy by Appsec Labs APPSEC LABS ACADEMY APPLICATION SECURITY & SECURE CODING ON LINE TRAINING PROGRAM AppSec Labs is an expert application security company serving
More informationCyber Risk Program Maturity Assessment UNDERSTAND AND MANAGE YOUR ORGANIZATION S CYBER RISK.
Cyber Risk Program Maturity Assessment UNDERSTAND AND MANAGE YOUR ORGANIZATION S CYBER RISK. In today s escalating cyber risk environment, you need to make sure you re focused on the right priorities by
More informationWeb Application Vulnerabilities: OWASP Top 10 Revisited
Pattern Recognition and Applications Lab Web Application Vulnerabilities: OWASP Top 10 Revisited Igino Corona igino.corona AT diee.unica.it Computer Security April 5th, 2018 Department of Electrical and
More informationG DATA Whitepaper. The new EU General Data Protection Regulation - What businesses need to know
G DATA Whitepaper The new EU General Data Protection Regulation - What businesses need to know G DATA Software AG September 2017 Introduction Guaranteeing the privacy of personal data requires more than
More informationGDPR: Get Prepared! A Checklist for Implementing a Security and Event Management Tool. Contact. Ashley House, Ashley Road London N17 9LZ
GDPR: Get Prepared! A Checklist for Implementing a Security and Event Management Tool Contact Ashley House, Ashley Road London N17 9LZ 0333 234 4288 info@networkiq.co.uk The General Data Privacy Regulation
More informationSolutions Business Manager Web Application Security Assessment
White Paper Solutions Business Manager Solutions Business Manager 11.3.1 Web Application Security Assessment Table of Contents Micro Focus Takes Security Seriously... 1 Solutions Business Manager Security
More informationOWASP CISO Survey Report 2015 Tactical Insights for Managers
OWASP CISO Survey Report 2015 Tactical Insights for Managers Disclaimer The views and opinions expressed in this presentation are those of the author and not of any organisation. Everything I say is my
More informationIncentives for IoT Security. White Paper. May Author: Dr. Cédric LEVY-BENCHETON, CEO
White Paper Incentives for IoT Security May 2018 Author: Dr. Cédric LEVY-BENCHETON, CEO Table of Content Defining the IoT 5 Insecurity by design... 5 But why are IoT systems so vulnerable?... 5 Integrating
More informationCloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops.
George Gerchow, Sumo Logic Chief Information Security Officer Cloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops. Agenda Sumo Security
More informationCLOUD COMPUTING SECURITY THE SOFT SPOT Security by Application Development Quality Assurance
IBM Innovate 2010 CLOUD COMPUTING SECURITY THE SOFT SPOT Security by Application Development Quality Assurance Anthony Lim MBA CISSP CSSLP FCITIL Director, Asia Pacific, Software Security Solutions IBM,
More informationCertified Secure Web Application Engineer
Certified Secure Web Application Engineer ACCREDITATIONS EXAM INFORMATION The Certified Secure Web Application Engineer exam is taken online through Mile2 s Assessment and Certification System ( MACS ),
More informationSecuring Digital Applications
Securing Digital Applications Chris Lewis: Certification Director Agenda The problem and solution The Kitemark and how it works ISO/IEC 27001 (Information Security Management Standard) OWASP ASVS v2 CVSS
More informationApplication Security. Doug Ashbaugh CISSP, CISA, CSSLP. Solving the Software Quality Puzzle
Application Security Doug Ashbaugh CISSP, CISA, CSSLP Page 1 It security Page 2 Page 3 Percent of Breaches Page 4 Hacking 5% 15% 39% Page 5 Common Attack Pathways Page 6 V u ln e ra b ilitie s / We a k
More informationSaving Time and Costs with Virtual Patching and Legacy Application Modernizing
Case Study Virtual Patching/Legacy Applications May 2017 Saving Time and Costs with Virtual Patching and Legacy Application Modernizing Instant security and operations improvement without code changes
More informationOWASP - SAMM. OWASP 12 March The OWASP Foundation Matt Bartoldus Gotham Digital Science
OWASP - SAMM Matt Bartoldus Gotham Digital Science OWASP 12 March 2009 Copyright The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP
More informationThe Top 6 WAF Essentials to Achieve Application Security Efficacy
The Top 6 WAF Essentials to Achieve Application Security Efficacy Introduction One of the biggest challenges IT and security leaders face today is reducing business risk while ensuring ease of use and
More informationMobile Malfeasance. Exploring Dangerous Mobile Code. Jason Haddix, Director of Penetration Testing
Mobile Malfeasance Exploring Dangerous Mobile Code Jason Haddix, Director of Penetration Testing Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to
More informationBuilding a Resilient Security Posture for Effective Breach Prevention
SESSION ID: GPS-F03B Building a Resilient Security Posture for Effective Breach Prevention Avinash Prasad Head Managed Security Services, Tata Communications Agenda for discussion 1. Security Posture 2.
More informationAtlassian. Atlassian Software Development and Collaboration Tools. Bugcrowd Bounty Program Results. Report created on October 04, 2017.
Atlassian Software Development and Collaboration Tools Atlassian Bugcrowd Bounty Program Results Report created on October 04, 2017 Prepared by Ryan Black, Director of Technical Operations Table of Contents
More informationDefense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
More informationOWASP TOP Release. Andy Willingham June 12, 2018 OWASP Cincinnati
OWASP TOP 10 2017 Release Andy Willingham June 12, 2018 OWASP Cincinnati Agenda A quick history lesson The Top 10(s) Web Mobile Privacy Protective Controls Why have a Top 10? Software runs the world (infrastructure,
More information90% of data breaches are caused by software vulnerabilities.
90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with
More informationWP1. DIGIT B1 - EP Pilot Project 645. Deliverable 4: Analysis of Software Development Methodologies Used in the FOSS Communities
WP1 DIGIT B1 - EP Pilot Project 645 Deliverable 4: Analysis of Software Development Methodologies Used in the Specific contract n 226 under Framework Contract n DI/07172 ABCIII February 2016 Author: Disclaimer
More informationARE YOU READY FOR GDPR?
SQL Security Whitepaper ARE YOU READY FOR GDPR? BY BOB FULLAM AND STEPHEN STOUT Demonstrate Compliance with IDERA SQL Security Suite OVERVIEW The European Union s General Data Protection Regulation (GDPR)
More informationApplication Security at Scale
Jake Marcinko Standards Manager, PCI Security Standards Council Jeff Williams CTO, Contrast Security Application Security at Scale AppSec at Scale Delivering Timely Security Solutions / Services to Meet
More informationNEW DATA REGULATIONS: IS YOUR BUSINESS COMPLIANT?
NEW DATA REGULATIONS: IS YOUR BUSINESS COMPLIANT? What the new data regulations mean for your business, and how Brennan IT and Microsoft 365 can help. THE REGULATIONS: WHAT YOU NEED TO KNOW Australia:
More informationHow icims Supports. Your Readiness for the European Union General Data Protection Regulation
How icims Supports Your Readiness for the European Union General Data Protection Regulation The GDPR is the EU s next generation of data protection law. Aiming to strengthen the security and protection
More informationSecurity and Compliance at Mavenlink
Security and Compliance at Mavenlink Table of Contents Introduction....3 Application Security....4....4....5 Infrastructure Security....8....8....8....9 Data Security.... 10....10....10 Infrastructure
More informationSecuring Your Web Application against security vulnerabilities. Alvin Wong, Brand Manager IBM Rational Software
Securing Your Web Application against security vulnerabilities Alvin Wong, Brand Manager IBM Rational Software Agenda Security Landscape Vulnerability Analysis Automated Vulnerability Analysis IBM Rational
More informationPlan a Pragmatic Approach to the new EU Data Privacy Regulation
AmChamDenmark event: EU Compliant & Cyber Resistant Plan a Pragmatic Approach to the new EU Data Privacy Regulation Janus Friis Bindslev, Partner Cyber Risk Services, Deloitte 4 February 2016 Agenda General
More informationSoftware Security Initiatives for Information Security Officers Marco Morana OWASP Cincinnati Chapter OWASP ISSA Cincinnati Chapter Meeting
Software Security Initiatives for Information Security Officers Marco Morana OWASP Cincinnati Chapter OWASP ISSA Cincinnati Chapter Meeting July 14 th 2010 Copyright 2010 - The OWASP Foundation Permission
More informationInternet of Things. Internet of Everything. Presented By: Louis McNeil Tom Costin
Internet of Things Internet of Everything Presented By: Louis McNeil Tom Costin Agenda Session Topics What is the IoT (Internet of Things) Key characteristics & components of the IoT Top 10 IoT Risks OWASP
More informationWelcome to the OWASP TOP 10
Welcome to the OWASP TOP 10 Secure Development for Java Developers Dominik Schadow 03/20/2012 BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART WIEN 1 AGENDA
More informationTRACKVIA SECURITY OVERVIEW
TRACKVIA SECURITY OVERVIEW TrackVia s customers rely on our service for many mission-critical applications, as well as for applications that have various compliance and regulatory obligations. At all times
More informationSECURITY & PRIVACY DOCUMENTATION
Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive
More informationIBM Rational Software
IBM Rational Software Development Conference 2008 Our Vision for Application Security David Ng Rational Software Security, Asean IBM Software Group 2008 IBM Corporation Agenda Application Security Defined
More informationRisk: Security s New Compliance. Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23
Risk: Security s New Compliance Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23 Agenda Market Dynamics Organizational Challenges Risk: Security s New Compliance
More informationBrochure. Security. Fortify on Demand Dynamic Application Security Testing
Brochure Security Fortify on Demand Dynamic Application Security Testing Brochure Fortify on Demand Application Security as a Service Dynamic Application Security Testing Fortify on Demand delivers application
More informationOWASP InfoSec Romania 2013
OWASP InfoSec Romania 2013 Secure Development Lifecycle, The good, the bad and the ugly! October 25 th 2013 Martin Knobloch OWASP Netherlands Chapter Leader Applications are about information! 3 pillars
More informationCyber Security Program
Cyber Security Program Cyber Security Program Goals and Objectives Goals Provide comprehensive Security Education and Awareness to the University community Build trust with the University community by
More informationEuropean Union Agency for Network and Information Security
Critical Information Infrastructure Protection in the EU Evangelos Ouzounis Head of Secure Infrastructure and Services Regional Cybersecurity Forum Sofia, Bulgaria 29 th November 2016 European Union Agency
More informationFintech District. The First Testing Cyber Security Platform. In collaboration with CISCO. Cloud or On Premise Platform
Fintech District The First Testing Cyber Security Platform In collaboration with CISCO Cloud or On Premise Platform WHAT IS SWASCAN? SWASCAN SERVICES Cloud On premise Web Application Vulnerability Scan
More informationPEACHTECH PEACH API SECURITY AUTOMATING API SECURITY TESTING. Peach.tech
PEACH API SECURITY AUTOMATING API SECURITY TESTING Peach.tech Table of Contents Introduction... 3 Industry Trends... 3 API growth... 3 Agile and Continuous Development Frameworks... 4 Gaps in Tooling...
More informationEnhancing the Cybersecurity of Federal Information and Assets through CSIP
TECH BRIEF How BeyondTrust Helps Government Agencies Address Privileged Access Management to Improve Security Contents Introduction... 2 Achieving CSIP Objectives... 2 Steps to improve protection... 3
More informationThe NIS Directive and Cybersecurity in
The NIS Directive and Cybersecurity in ehealth Dr. Athanasios Drougkas Officer in NIS Belgian Hospitals Meeting on Security Brussels 13 th October European Union Agency For Network And Information Security
More informationSecurity Best Practices. For DNN Websites
Security Best Practices For DNN Websites Mitchel Sellers Who am I? Microsoft MVP, ASPInsider, DNN MVP Microsoft Certified Professional CEO IowaComputerGurus, Inc. Contact Information msellers@iowacomputergurus.com
More information113 BSIMM Activities at a Glance
113 BSIMM Activities at a Glance (Red indicates most observed BSIMM activity in that practice) Level 1 Activities Governance Strategy & Metrics (SM) Publish process (roles, responsibilities, plan), evolve
More informationIntroduction F rom a management perspective, application security is a difficult topic. Multiple parties within an organization are involved, as well
Simplifying Application Security and Compliance with the OWASP Top 10 AN EXECUTIVE PERSPECTIVE Introduction F rom a management perspective, application security is a difficult topic. Multiple parties within
More informationTRAINING CURRICULUM 2017 Q2
TRAINING CURRICULUM 2017 Q2 Index 3 Why Security Compass? 4 Discover Role Based Training 6 SSP Suites 7 CSSLP Training 8 Course Catalogue 14 What Can We Do For You? Why Security Compass? Role-Based Training
More informationUnder the hood testing - Code Reviews - - Harshvardhan Parmar
Under the hood testing - Code Reviews - - Harshvardhan Parmar In the news September 2011 A leading bank s Database hacked (SQLi) June 2011 Sony hack exposes consumer passwords (SQLi) April 2011 Sony sites
More informationSIEMLESS THREAT MANAGEMENT
SOLUTION BRIEF: SIEMLESS THREAT MANAGEMENT SECURITY AND COMPLIANCE COVERAGE FOR APPLICATIONS IN ANY ENVIRONMENT Evolving threats, expanding compliance risks, and resource constraints require a new approach.
More informationGuide to Cyber Security Compliance with GDPR
Guide to Cyber Security Compliance with GDPR Security V1.3 General Data Protection Regulation GDPR Overview What is GDPR? An EU regulation coming into force in May 2018 Which means it applies to all EU
More informationSecure Development Guide
Secure Development Guide Oracle Health Sciences InForm 6.1.1 Part number: E72493-01 Copyright 2016, Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided
More informationSecure Agile How to make secure applications using Agile Methods Thomas Stiehm, CTO
Secure Agile How to make secure applications using Agile Methods Thomas Stiehm, CTO tom.stiehm@coveros.com 1 About Coveros Coveros helps organizations accelerate the delivery of business value through
More informationWeb Application Security. Philippe Bogaerts
Web Application Security Philippe Bogaerts OWASP TOP 10 3 Aim of the OWASP Top 10 educate developers, designers, architects and organizations about the consequences of the most common web application security
More informationCyberSecurity. Penetration Testing. Penetration Testing. Contact one of our specialists for more information CYBERSECURITY SERVICE DATASHEET
DATASHEET Gavin, Technical Director Ensures Penetration Testing Quality CyberSecurity Penetration Testing CHESS CYBERSECURITY CREST-ACCREDITED PEN TESTS PROVIDE A COMPREHENSIVE REVIEW OF YOUR ORGANISATION
More informationThreat Landscape 2017
Pattern Recognition and Applications Lab WEB Security Giorgio Giacinto giacinto@diee.unica.it Computer Security 2018 Department of Electrical and Electronic Engineering University of Cagliari, Italy Threat
More informationNew York Cybersecurity. New York Cybersecurity. Requirements for Financial Services Companies (23NYCRR 500) Solution Brief
Publication Date: March 10, 2017 Requirements for Financial Services Companies (23NYCRR 500) Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker s advanced
More informationCybersecurity Considerations for GDPR
Cybersecurity Considerations for GDPR What is the GDPR? The General Data Protection Regulation (GDPR) is a brand new legislation containing updated requirements for how personal data of European Union
More informationSimplifying Application Security and Compliance with the OWASP Top 10
Simplifying Application Security and Compliance with the OWASP Top 10 An Executive Perspective 187 Ballardvale Street, Wilmington, MA 01887 978.694.1008 ExECuTivE PErSPECTivE 2 introduction From a management
More informationEUROPEAN ICT PROFESSIONAL ROLE PROFILES VERSION 2 CWA 16458:2018 LOGFILE
EUROPEAN ICT PROFESSIONAL ROLE PROFILES VERSION 2 CWA 16458:2018 LOGFILE Overview all ICT Profile changes in title, summary, mission and from version 1 to version 2 Versions Version 1 Version 2 Role Profile
More informationEngineering Your Software For Attack
Engineering Your Software For Attack Robert A. Martin Senior Principal Engineer Cyber Security Center Center for National Security The MITRE Corporation 2013 The MITRE Corporation. All rights reserved.
More informationApplication Security Kung-Fu Competitive Advantage from Threat Modeling
Application Security Kung-Fu Competitive Advantage from Threat Modeling Akshay Aggarwal Practice Manager (North America & LATAM) Akshaya AT Microsoft Dot com ACE Team Microsoft Information Security Agenda
More informationGOING WHERE NO WAFS HAVE GONE BEFORE
GOING WHERE NO WAFS HAVE GONE BEFORE Andy Prow Aura Information Security Sam Pickles Senior Systems Engineer, F5 Networks NZ Agenda: WTF is a WAF? View from the Trenches Example Attacks and Mitigation
More informationOWASP ASVS for NFTaaS in Financial Services OLEKSANDR KAZYMYROV, TECHNICAL TEST ANALYST
OWASP ASVS for NFTaaS in Financial Services OLEKSANDR KAZYMYROV, TECHNICAL TEST ANALYST Agenda Chapter I - Brief Introduction Chapter II - Why OWASP ASVS? Chapter III - OWAS ASVS in Practice Chapter IV
More informationDefend Your Web Applications Against the OWASP Top 10 Security Risks. Speaker Name, Job Title
Defend Your Web Applications Against the OWASP Top 10 Security Risks Speaker Name, Job Title Application Security Is Business Continuity Maintain and grow revenue Identify industry threats Protect assets
More informationVULNERABILITIES IN 2017 CODE ANALYSIS WEB APPLICATION AUTOMATED
AUTOMATED CODE ANALYSIS WEB APPLICATION VULNERABILITIES IN 2017 CONTENTS Introduction...3 Testing methods and classification...3 1. Executive summary...4 2. How PT AI works...4 2.1. Verifying vulnerabilities...5
More informationJim Reavis CEO and Founder Cloud Security Alliance December 2017
CLOUD THREAT HUNTING Jim Reavis CEO and Founder Cloud Security Alliance December 2017 A B O U T T H E BUILDING SECURITY BEST PRACTICES FOR NEXT GENERATION IT C L O U D S E C U R I T Y A L L I A N C E GLOBAL,
More information