how to secure web applications with owasp - isaca sep 2009 - for distribution

How to secure web applications with OWASP
Santosh Satam
Head-Technical Services MIEL

No noble thing can be done without risks.
Michel De Montaigne

© 2009 MIEL eSecurity Pvt Ltd
Confidential
2

Due care has been taken to make this Presentation as accurate as possible. Certain statements made in this presentation may not be based on
historical information or facts and may be “forward looking statements” and may be subject to risks and uncertainties that could cause actual results
to differ materially and adversely from those that may be projected by such forward looking statements.
MIEL makes no representation or warranties with respect to the contents hereof and shall not be responsible for any loss or damage caused to the
user by the direct or indirect use of this Presentation. MIEL may alter, modify or otherwise change in any manner the content hereof, without
obligation to notify any person of such revision or changes.
All company and product names are trademarks of the respective companies with which they are associated.

COPYRIGHT © 2009 MIEL e-Security Pvt. Ltd.
All rights reserved.

Softcopy Name : MIEL – OWASP Presentation – ISACA Sep 2009
Published Date : Sep 2009
Author : Santosh Satam

Confidential
3

Agenda
 Introduction to Application
Security
 OWASP Projects

 Way Forward

© 2009 MIEL e-Security Pvt. Ltd
Confidential
4

You have been appointed as Head of Application Security
Your first task is to define roadmap for application security ..

Confidential
5

You started digging into maze of applications ..

Confidential
6

COTS (Commercial Off the shelf) Applications
In-house Developed Applications
Legacy Systems
Interface to External Systems
Support Applications
Open Source Applications
Application Hosted in Cloud (SaaS)

Confidential
7

Even after two weeks you are still struggling …

Confidential
8

Stakeholders in Application Security
Top
Management
Auditors BU Heads

IT/Network Admin Quality Assurances

Project
Managers Architects Developers

Confidential
9

OWASP will help you !!

Confidential
10

What is OWASP ?

OWASP – Open Web Application Security Project

Open group focused on understanding and improving the
security of web applications and web services!

Confidential
11

Who is using OWASP ?

Confidential
12

SDLC is King

Requirements Design Development Testing Deployment

Confidential
13

OWASP – Guides throughout SDLC

Confidential
14

Requirements Phase
OWASP METHODS
 Identify Security Requirement AND TOOLS
 Identify Mis-use cases
Free Tools
 Identify Attack Surface
 Identify Deployment Scenarios * WebGoat Training Tool

Projects

* Web AppSec Guide

Confidential
15

Requirements Phase – Define Security Requirement

Business Requirements Security Requirement
The application stores credit card data Strong encryption should be
that must be protected. used to protect the sensitive
customer data.
The application transmits sensitive user Communication channels must be
information over the un-trusted network encrypted.
The application must be available 24x7 Mitigate denial of service attack
The application takes user input and uses SQL injection should be
SQL mitigated by Input Validations
Confidential
16

Requirements Phase – Car Security Mis-use Case

Drive Threatens
Steal
the Car the Car
Mitigates

Lock Threatens
the Car Short
the
Ignition
Lock the Mitigates
Transmission

Confidential
17

Requirements Phase – Identify Attack Surface

Confidential
18

Requirements Phase – Identify Deployment Scenarios

 Infrastructure Security
 Scalability
Secure Communication
 Compliance

Confidential
19

Design Phase
OWASP METHODS
 Security Principles AND TOOLS
 Threat Modeling
Free Tools

* WebGoat Training Tool

Projects

* Enterprise Security API
(ESAPI)
* AntiSamy (Java Project)
* AntiSamy (.Net Project)

Confidential
20

Design Phase – Security Principles

Confidential
21

Design Phase – Threat Modeling

 Identify Assets
 Decompose Application
 Identify Threats and Vulnerabilities
 Document Threats
 Rate Threats
Mitigate Threats

Confidential
22

Design Phase – OWASP ESAPI

Confidential
23

Development Phase
OWASP METHODS
 Input Validations AND TOOLS
Output Handling
Free Tools
Session Handling
 Error Handling * WebScarab Proxy
 Configuration Management * ASP.NET Analyzers

 Cryptography Projects
 Secure Code Review
* Web AppSec Guide
* Code Review Project
* AppSec Metrics

Confidential
24

Testing Phase
OWASP METHODS
 Manual Inspection AND TOOLS
 Threat Modeling
Free Tools
 Code Review
 Penetration Testing * LiveCD

Projects

* OWASP Top 10
* Testing Project

Confidential
25

OWASP Top 10

 A1 – Cross Site  A6 – Information Leakage
Scripting (XSS) and Improper Error Handling
 A2 – Injection Flaws  A7 – Broken Authentication
and Session Management
 A3 – Insecure Remote  A8 – Insecure Cryptographic
File Include Storage
 A4 – Insecure Direct  A9 – Insecure
Object Reference Communications
 A5 – Cross Site Request  A10 – Failure to Restrict URL
Forgery (CSRF) Access
Confidential
26

Code Review
• Code review helps to find vulnerabilities that may not be
discoverable in a black-box/zero-knowledge testing scenario.
• It covers following areas:

Syntactical

Business Infrastructure
logic

Confidential
27

OWASP – LiveCD Tools
1 OWASP WebScarab 14 OWASP WSFuzzer
2 OWASP WebGoat 15 Metasploit 3
3 OWASP CAL9000 16 w3af & GTK GUI for w3af
4 OWASP JBroFuzz 17 Netcats collection
5 Paros Proxy 18 OWASP Wapiti
6 nmap & Zenmap 19 Nikto
7 Wireshark 20 Fierce Domain Scaner
8 tcpdump 21 Maltego CE
9 Firefox 3 22 Httprint
10 Burp Suite 23 SQLBrute
11 Grenedel-Scan 24 Spike Proxy
12 OWASP DirBuster 25 Rat Proxy
13 OWASP SQLiX © 2009 MIEL eSecurity Pvt Ltd
Confidential
28

Deployment Phase
OWASP METHODS
 System Hardening AND TOOLS
Power on Sequence
Free Tools
 Secure Transmission
 Database Security * LiveCD

Projects

* Web AppSec Guide
* Testing Project

Confidential
29

Summary

 Implement Application Security
Practices in the Development
Process
 Conduct Awareness Program on
Application Security
 Conduct Code Reviews
 Test, Test and Test each and
“Prevention is
always better than every application before it is put
Cure” to Production
Confidential
30

Take a Systemic Approach

Confidential
31

Useful Links

Description URL
Open Web Application Security Project (OWASP) http://www.owasp.org
SANS http://www.sans.org
CERT http://www.cert.org
ISACA http://www.isaca.org
Security Focus http://www.securityfocus.com
Microsoft Security http://microsoft.com/security/
IBM http://www-
106.ibm.com/developerworks/linux/library/
The Web Application Security Consortium (WASC) http://www.webappsec.org/
The Web Hacking Incidents Database http://www.webappsec.org/projects/whid/

Confidential
32

Application Security - Certifications
• CSSLP - Certified Secure Software Lifecycle Professional
http://www.isc2.org/csslp/
• CSSLP CBK
• Secure Software Concepts
• Secure Software Requirements
• Secure Software Design
• Secure Software Implementation/Coding
• Secure Software Testing
• Software Acceptance
• Software Deployment, Operations, Maintenance and Disposal
Confidential
33

OWASP Application Security – Forthcoming Conference

Confidential

Discussion

Santosh Satam
Head – Technical Services
CISA | CISM | CISSP | CSSLP

MIEL e-Security Pvt. Ltd.
E-mail: ssatam@mielesecurity.com

Confidential
35

how to secure web applications with owasp - isaca sep 2009 - for distribution

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (20)

Similaire à how to secure web applications with owasp - isaca sep 2009 - for distribution

Similaire à how to secure web applications with owasp - isaca sep 2009 - for distribution (20)

Dernier

Dernier (20)

how to secure web applications with owasp - isaca sep 2009 - for distribution