1 / 50

OWASP Education Project -Developing Secure Applications

OWASP Education Project -Developing Secure Applications. Martin Knobloch OWASP on the Move Project OWASP Speaker Project OWASP Education Project Sogeti Nederland B.V. martin.knobloch@sogeti.nl +31-6 52 32 76 79. February 2008. Developing Secure Applications. What Is Application Security?

geona
Download Presentation

OWASP Education Project -Developing Secure Applications

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. OWASP Education Project -Developing Secure Applications Martin Knobloch OWASP on the Move Project OWASP Speaker Project OWASP Education Project Sogeti Nederland B.V. martin.knobloch@sogeti.nl +31-6 52 32 76 79 February 2008

  2. Developing Secure Applications • What Is Application Security? • Security Awareness! • Security Requirements? • Secure Development Process! • Stay Secure! • Summary, Questions And Discussion

  3. Quick side step- What is OWASP? Open Web Application Security Project: • The Open Web Application Security Project (OWASP) is dedicated to finding and fighting the causes of insecure software. • Tools • WebGoat Project • WebScarab Project • ... • Documentation • AppSec FAQ Project • Guide Project • Legal Project • Testing Guide Project • Top Ten Project • ...

  4. Developing Secure Applications • What Is Application Security? • Security Awareness! • Security Requirements? • Secure Development Process! • Stay Secure! • Summary, Questions And Discussion

  5. What Is Application Security?What is application security? Applications are about information! 3 pillars of Information Security: • Confidentiality • Integrity • Availability

  6. What Is Application Security?What is a secure application?

  7. What Is Application Security?What is a secure application? Example: Hidden Fields

  8. What Is Application Security?What is a secure application? An application is secure if it acts and reacts, as it expected, at any time! Technical Implementation Functional Specification Secure Insecure Insecure

  9. Developing Secure Applications • What Is Application Security? • Security Awareness! • Security Requirements? • Secure Development Process! • Stay Secure! • Summary, Questions And Discussion

  10. Security Awareness!To be aware of what? The environments in where the software applications run where closed. • By this, the applications could be developed ‘open’.

  11. Security Awareness!To be aware of what? The environments in where the software applications run where closed. The environments became more open over time. • By this, the applications could be developed ‘open’.

  12. Security Awareness!To be aware of what? The environments in where the software applications run where closed. The environments became more open over time. • Which means, the applications have to become more closed. • By this, the applications could be developed ‘open’.

  13. OWASP TOP TEN A1 Cross-Site Scripting (XSS) Example:

  14. Security Awareness!To be aware of what? The Problems: • Cookies, HTTP authentication, SSL.. • Low learning curve • Easy to attack (web) applications

  15. Security Awareness!To be aware of what? OWASP TOP TEN: 1. Cross Site Scripting 2. Injection Flaws 3. Malicious File Execution 4. Insecure Direct Object References 5. Cross Site Request Forgery 6. Information Leakage and Improper Error Handling 7. Broken Authentication and Session Management 8. Insecure Cryptographic Storage 9. Insecure Communication 10. Failure to Restrict URL Access

  16. Security Awareness!To be aware of what? Source: www.mitre.org

  17. Risk =()*Value Threats * Vulnerabilities Countermeasures Security Awareness!To be aware of what? Consciously! Unconsciously! • CRACKER • HACKER • SCRIPTKIDDIE • User • System • Environment

  18. OWASP TOP TEN A2 Injection Flaws Example: USERNAME: PERSOONA PASSWORD: GEHEIM12 USERNAME: PERSOONA PASSWORD: GEHEIM12 of 1=1 de username is 'PERSOONA'en het wachtwoord is 'GEHEIM12‘ de username is 'PERSOONA'en het wachtwoord is 'GEHEIM12‘ of 1=1;

  19. Security Awareness!Who to make aware? Functional Designers & Architects: • It is not only about what functionality the application has to supply, it also what it may not! Engineers: • Quality is not just ‘does it work’ . Testers: • Security weaknesses are not different from other, functional, bugs. They can be traced down the same way. Managers: • Reserve project time for security • Understand security as manditory value of an application Security Analyst: Involve a security Analyst at the beginning of the design phase.

  20. Developing Secure Applications • What Is Application Security? • Security Awareness! • Security Requirements? • Secure Development Process! • Stay Secure! • Summary, Questions And Discussion

  21. Security RequirementsFunction or Non-Fuctional?

  22. User requirements Businessrequirements Non f u n c t i o n a l F u n c t i o n a l  ‘What’  ‘How’ System requirements Security RequirementsSecurity requirements HOWTO! ‘Why’ Business rules Constraints External interfaces

  23. OWASP TOP TEN A3 Malicious File Execution Example:

  24. Developing Secure Applications • What Is Application Security? • Security Awareness! • Security Requirements? • Secure Development Process! • Stay Secure! • Summary, Questions And Discussion

  25. E D U C A T I O N Secure Development Process- How to develop secure applications! PROTOCOLS RULES BEST PRACTICES STANDARDS TOOLING E X P E R I E N C E FEEDBACK EVALUATION

  26. Developing Secure Applications • What Is Application Security? • Security Awareness! • Security Requirements? • Secure Development Process! • Stay Secure! • Summary, Questions And Discussion

  27. System User? System User? User Rights? User Rights? User Rights? Internet Error handling? Error handling? Error handling? Firewall Firewall Firewall Private Network Private Network Stay Secure!Secure application configuration! DMZ System Environment Database User?

  28. OWASP TOP TEN A4 Insecure Direct Object Reference Example:

  29. Stay Secure!Secure application configuration! Development Computer Windows XP AMD Linux Suse 7.x IBM Unix Tomcat 5.5 WebSphere 5 WebSphere 6 JBoss 4.x WebSphere 5 WebSphere 6 MySql 5.x Oracle 8 Oracle 10

  30. Developing Secure Applications • What Is Application Security? • Security Awareness! • Security Requirements? • Secure Development Process! • Stay Secure! • Summary, Questions And Discussion

  31. Summary, questions and discussionQuestions?

  32. OWASP TOP TEN A1 Cross-Site Scripting (XSS) XSS flaws occur whenever an application takes user supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser which can hijack user sessions, deface web sites, possibly introduce worms, etc. • Making abuse of the trust a client has into a website!

  33. OWASP TOP TEN A1 Cross-Site Scripting (XSS) Example: http://localhost/WebGoat/attack?Screen=15&menu=410 LAB: Cross Site Scripting (XSS)

  34. OWASP TOP TEN A2 Injection Flaws Injection flaws, particularly SQL injection, are common in web applications. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or changing data.

  35. OWASP TOP TEN A2 Injection Flaws – SQL injection Screen: USERNAME:[PERSONA] PASSWORD:[SECRET12] On the server: username is 'PERSONA' and the password is SECRET12'; Screen : USERNAME:[PERSONA] PASSWORD:[SECRET12 or 1=1] On the server : username is ' PERSONA' and the password is SECRET12' or 1=1;

  36. OWASP TOP TEN A2 Injection Flaws Example: http://localhost/WebGoat/attack?Screen=28&menu=610 LAB: SQL Injection

  37. OWASP TOP TEN A3 Malicious File Execution Code vulnerable to remote file inclusion (RFI) allows attackers to include hostile code and data, resulting in devastating attacks, such as total server compromise. Malicious file execution attacks affect PHP, XML and any framework which accepts filenames or files from users.

  38. OWASP TOP TEN A3 Malicious File Execution Example: http://localhost/WebGoat/attack?Screen=2&menu=610

  39. OWASP TOP TEN A4 Insecure Direct Object Reference A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter. Attackers can manipulate those references to access other objects without authorization.

  40. OWASP TOP TEN A4 Insecure Direct Object Reference Example:

  41. OWASP TOP TEN A5 Cross-site Request Forgery (CSRF) A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request to a vulnerable web application, which then forces the victim's browser to perform a hostile action to the benefit of the attacker. CSRF can be as powerful as the web application that it attacks. • Making abuse of the trust a client got from a website! CSRF vs. XSS • CSRF can be done by XSS • XSS can be automated by CSRF

  42. OWASP TOP TEN A5 Cross-site Request Forgery (CSRF) Example: http://localhost/WebGoat/attack?Screen=30&menu=210 How to Perform Cross Site Request Forgery (CSRF)

  43. OWASP TOP TEN A6 Information Leakage / Improper Error Handling Applications can unintentionally leak information about their configuration, internal workings, or violate privacy through a variety of application problems. Attackers use this weakness to steal sensitive data, or conduct more serious attacks. • Gaining inside information • Invalid Password / Invalid Username • 404 Page not found / 403 Forbidden • Stack trace on the webpage • Information from log files

  44. OWASP TOP TEN A6 Information Leakage / Improper Error Handling Example: http://localhost/WebGoat/attack?Screen=49&menu=710 How to Bypass a Fail Open Authentication Scheme

  45. OWASP TOP TEN A7 Broken authentication and session management Account credentials and session tokens are often not properly protected. Attackers compromise passwords, keys, or authentication tokens to assume other users' identities. • Session tokens kan be put in place by a hacker via an XSS of CSRF attack. • Session tokens kan easily be stolen because they are valid to long or insufficient protected. • Session is still valid after login

  46. OWASP TOP TEN A8 Insecure Cryptographic Storage Web applications rarely use cryptographic functions properly to protect data and credentials. Attackers use weakly protected data to conduct identity theft and other crimes, such as credit card fraud.

  47. OWASP TOP TEN A8 Insecure Cryptographic Storage Example: http://localhost/WebGoat/attack?Screen=14&menu=810 Encoding Basics Webscarab Cookie collector 50x ofzo..

  48. OWASP TOP TENA9 Insecure Communication Applications frequently fail to encrypt network traffic when it is necessary to protect sensitive communications.

  49. OWASP TOP TEN A10 Failure to Restrict URL Access Frequently, an application only protects sensitive functionality by preventing the display of links or URLs to unauthorized users. Attackers can use this weakness to access and perform unauthorized operations by accessing those URLs directly.

  50. OWASP TOP TEN A10 Failure to Restrict URL Access Example:

More Related