2008: Web Application Security Tutorial

[object Object],[object Object],[object Object],[object Object],Copyright © 2008 The Regents of the University of California All Rights Reserved. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials.

Puzzle – What is this? ,[object Object]

Answer ,[object Object],[object Object]

Do you know? ,[object Object],[object Object],[object Object],[object Object]

High Schools hacked by High Schoolers http://www.privacyrights.org ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Essentials of a Comprehensive Web Security Program – 33 Principles National Institute of Standards and Technology (NIST) Special Publication 800-27 Rev A - Engineering Principles for Information Technology Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

33 Principles - Continued ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

33 Principles - Continued ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Security Frameworks – a few ,[object Object],[object Object],[object Object],[object Object],[object Object]

Security Frameworks – Continued ,[object Object],[object Object]

NIST Recommended Security Controls for Federal Information Systems http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf – 188 pages ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Security Frameworks – Continued ,[object Object],[object Object],[object Object],[object Object]

ISO 27001 Controls ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

ISO 27001 Control examples ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Security Frameworks – Continued ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

PCI DSS – Payment Card Industry Data Security Standard Requirements https:// www.pcisecuritystandards.org/index.shtml ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

PCI DSS – Self-Assessment Questionnaire D and Attestation of Compliance – 27 pages! https://www.pcisecuritystandards.org/docs/saq_d_v1-1.doc ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Adoption of a Standard ,[object Object],[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

OWASP’s Top 10 List ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Themes of this Talk ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

This Presentation's Re-ordered Top 10 List ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Cross-Site Scripting (XSS) Attacks ,[object Object],[object Object],[object Object]

Websites XSS’d ,[object Object],[object Object],[object Object],[object Object],[object Object]

Cross-Site Scripting (XSS) Attacks

The Impact of XSS ,[object Object],[object Object],[object Object],[object Object],[object Object]

Our first demo… ,[object Object]

Preventing XSS ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Preventing XSS - Continued ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Cross Site Request Forgery (CSRF) ,[object Object],[object Object]

Cross Site Request Forgery (CSRF) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

CSRF Example ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Cross Site Request Forgery Demo ,[object Object]

Solution ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Post vs Get ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Chinese Olympian Gymnast Age Confusion ,[object Object],[object Object],[object Object],[object Object]

Information Leakage and Improper Error Handling ,[object Object],[object Object],[object Object],[object Object],[object Object]

Application Error Messages ERROR [credit-card-db] (MySqlSystem.java:1331) - Invalid column name java.sql.SQLException: Invalid column name ‘social_security_numbre’: select username, password, ssn from users where id = ? sun.jdbc.rowset.CachedRowSet.getColIdxByName(CachedRowSet.java:1383)at com.mysql.Driver.MySQLDriver.a(MySQLDriver.java:2531) at sun.jdbc.rowset.CachedRowSet.getString(CachedRowSet.java:2167) at com.ppe.db.MySqlSystem.getReciPaying(MySqlSystem.java:1318) at control.action.FindUserAction.perform(FindKeyUserAction.java:81) at org.apache.struts.action.ActionServlet.processActionPerform(ActionServlet) at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1586) at org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:492) at javax.servlet.http.HttpServlet.service(HttpServlet.java:740) at javax.servlet.http.HttpServlet.service(HttpServlet.java:853) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl icationFilterChain.java:247)

Misconfigured, Default Settings, Unpatched Systems ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Forced Directory Browsing ,[object Object],[object Object]

Robots.txt ,[object Object],[object Object],[object Object]

Google Hacking ,[object Object],[object Object],[object Object]

"admin account info" filetype:log

Insecure Direct Object Reference ,[object Object],[object Object],[object Object],[object Object],[object Object]

Solution ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Use Proper Authorization ,[object Object],[object Object],[object Object],[object Object]

Failure to Restrict URL Access ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

UCLA Security Incident ,[object Object],[object Object],[object Object],[object Object]

Impact of SQL Injection - Dangerous ,[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injection Attacks “ SQL injection is a security vulnerability that occurs in the database layer of an application. Its source is the incorrect escaping of dynamically-generated string literals embedded in SQL statements. “ (Wikipedia)

SQL Injection Attacks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

More Dangerous SQL Injection Attacks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injection Demo… ,[object Object],[object Object]

Preventing SQL injection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Preventing SQL injection - Continued ,[object Object],[object Object],[object Object],[object Object]

Injection Impacts More Than SQL ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Another Injection Demo ,[object Object]

Malicious File Execution ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Impact ,[object Object],[object Object],[object Object],[object Object]

Solution ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Insecure Communication ,[object Object],[object Object],[object Object],[object Object]

Authentication Checks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Hardening Authentication ,[object Object],[object Object],[object Object]

Session Attacks ,[object Object],[object Object]

Demos ,[object Object],[object Object]

Solution ,[object Object],[object Object],[object Object],[object Object],[object Object]

Insecure Cryptographic Storage ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Additional Topics ,[object Object],[object Object],[object Object],[object Object]

Concurrency: Thread Safety ,[object Object],[object Object],[object Object],[object Object]

Impacts of Threading Problems ,[object Object],[object Object],[object Object]

Thread Safety Demo ,[object Object]

The Problem (Java Code) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Solutions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Web Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

REST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SOAP ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SOAP - Continued ,[object Object],[object Object]

SOAP Security Recommendations ,[object Object],[object Object],[object Object]

SOAP Security Recommendations - Continued ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SOAP Standards: WS-* (Web Services-*) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

AJAX Security ,[object Object],[object Object],[object Object],[object Object]

AJAX Request Lifecycle XmlHTTPRequest Response (text, JSON, XML, etc) There is nothing special about an XHR request other than its asynchronicity

Potential Issues With AJAX ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Tips ,[object Object],[object Object],[object Object],[object Object],[object Object]

AJAX Demos ,[object Object],[object Object],[object Object]

JavaScript Hijacking ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same-Origin Policy ,[object Object],[object Object]

How does it work? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Solution ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

“Reverse” JavaScript Hijacking and Mashups ,[object Object],[object Object],[object Object],[object Object],[object Object]

Browser Page Cache ,[object Object],[object Object],[object Object],[object Object],[object Object]

Browser History ,[object Object],[object Object],[object Object],[object Object],[object Object]

Browser Cookies ,[object Object],[object Object],[object Object],[object Object]

NIST Software Development Life Cycle (SDLC) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

NIST: Security Considerations in the Information System Development Life Cycle http://csrc.nist.gov/publications/nistpubs/800-64/NIST-SP800-64.pdf SDLC | Security Considerations -Appropriateness of disposal -Exchange and sale -Internal organization screening -Transfer and donation -Contract closeout _______________ -Information Preservation -Media Sanitization -Hardware and Software Disposal -Performance measurement -Contract modifications -Operations Maintenance ________________ -Configuration Management and Control – Continuous monitoring -Installation -Inspection -Acceptance testing -Initial user training -Documentation ____________________ -Inspection and Acceptance -System Integration -Security Certification -Security Accreditation -Functional Need Doc. -Market Research -Feasibility Study -Requirements Analysis -Alternatives Analysis -Cost-Benefit Analysis -Risk Management -Acquisition Planning __________________ - Risk Assessment -Security Functional Requirements Analysis -Security Assurance Requirements Analysis -Cost considerations -Security Planning -Security Control Development - Security Test and Evaluation - Linkage of Need to Mission and Performance Objectives -Assessment of Alternatives to Capital Assets -Preparing for investment and budgeting ________________ -Security Categorization -Preliminary Risk Assessment Disposition Operations/ Maintenance Implementation Acquisition/ Development Initiation

Remember - Essentials of a Comprehensive Web Security Program – Principles?* ,[object Object],[object Object],[object Object],[object Object]

8 Steps to Integrating Security into your SDLC ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Integrating Security into SDLC Step 1: Secure application deployment program ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Integrating Security into SDLC Step 2: Training ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Integrating Security into SDLC Step 3: Requirements ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Our Requirements Template ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Requirements Document Format ,[object Object],[object Object],[object Object],[object Object]

Integrating Security into SDLC Step 4: Architecture and Design ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Communication between distributed components ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Security Architecture – Multi-layer

Security Architecture Lifecycle – focus on Standardization

Application Logging Design ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Integrating Security into SDLC Step 5: Implementation / Acquisition ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Code Review – a Process ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Storing sensitive data ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Data Modelling for Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Integrating Security into SDLC Step 6: Deployment ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SDLC Approvals (Moving to JIRA Workflow)

Integrating Security into SDLC Step 7: Operations/Maintenance ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Integrating Security into SDLC Step 8: Decommissioning ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

UC Irvine’s Incident ,[object Object]

Procurement Practices ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Contract language should cover ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Educause Security Task Force: Contract Language Toolkit – Draft ,[object Object],[object Object],[object Object],[object Object]

ASP Vendor Security Checklist ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Good Tool Listings ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Development / Debug / QA Tools ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Open Source Reusable Security Components (a few) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Tamper Data – Firefox Plugin

Web Application Vulnerability Scanning Tools – Open Source / Free ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Web Application Vulnerability Scanning Tools – Commercial ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Watchfire Appscan ,[object Object],[object Object],[object Object]

System Administrator Tools ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Database Scanning and Hardening Tools ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Network Vulnerability Scanning Tools ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Web Application Firewalls ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Remember our Puzzle? ,[object Object]

Glossaries – which is best? ,[object Object],[object Object],[object Object],[object Object]

Resources ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What we learned today! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Printed Materials ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

2008: Web Application Security Tutorial

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (19)

En vedette

En vedette (11)

Similaire à 2008: Web Application Security Tutorial

Similaire à 2008: Web Application Security Tutorial (20)

Plus de Neil Matatall

Plus de Neil Matatall (8)

Dernier

Dernier (20)

2008: Web Application Security Tutorial