SlideShare a Scribd company logo

2015 09-18-jug summer camp

•
Sebastien Gioria, profile picture
Sebastien Gioria

The document discusses securing code through proper authorization and access control. It recommends avoiding hard-coded authorization rules and instead using a centralized access control system. The document outlines some common anti-patterns like untrusted data driving access decisions and discusses how improper access controls can enable data tampering or disclosure of confidential information.

Internet
Related topics:
Application Security
1 of 79
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
42  minutes  to  secure  your  code…. Sébastien Gioria sebastien.gioria@owasp.org OWASP  France  Leader  &   Evangelist JUG  Summer  Camp 18  Septembre 2015 LaRochelle -­‐ France
Agenda • OWASP  ?   • Secure  Coding  ?   • 10  simply  principles  to  secure  code • Controlling  code  security   • Q&A  Beer  J 2
2 http://www.google.fr/#q=sebastien   gioria ‣OWASP  France  Leader  &  Founder  &   Evangelist,   ‣OWASP  ISO  Project  &  OWASP  SonarQube Project   Leader ‣Innovation  and  Technology  @Advens  &&     Application  Security  Expert Twitter  :@SPoint/@OWASP_France/@AppSecAcademy2 ‣Application  Security  group  leader  for  the   CLUSIF ‣Proud  father  of  youngs  kids  trying  to  hack  my   digital  life.   ‣Legal expert    for  Cour  of  Appeal of  Poitiers
4 Learn Contract Testing Design MaturityCode
OWASP  publications  !   • Publications  :   – Top10  Application  Security   Risk  ;  bestseller – Testing  Guide  ;  second   bestseller – OWASP  Cheat  Sheets  !!!   – Application  Security   Verification  Standard  ;  not  the   best  well  known  document – OpenSAMM :  improve  your   application  security – OWASP  Secure  Contract   Annex   – OWASP  Top10  for  ...  (mobile,   cloud,  privacy,  ...) • Tools  /  API – OWASP  Zed  Attack  Proxy  ;   replace  WebScarab with  a  lot   of  new  functionalities – OWASP  ESAPI  :  API  for   securing  your  Software – OWASP  AppSensor ;  a  IDS/IPS   in  the  heart  of  your  software – OWASP  Cornucoppia ;   application  security  play  with   cards – OWASP  Snake  and  ladder  :   play  Top10 and  many  more....
Secure  Coding  ?  
Yes,  this  is  you  !  
Some  Stats.... (c)  IBM  March  2014
Hackers  are  clever
Money, Money, Money
Be accurate
2015 09-18-jug summer camp
2015 09-18-jug summer camp
2015 09-18-jug summer camp
2015 09-18-jug summer camp
2015 09-18-jug summer camp
@Inject EntityManager em; @Transactional public  User  updateEmail(String   username,String email)  { TypedQuery<User>   q  =  em.createQuery( String.format(”update    Users  set  email  ‘%s’  where  username   =   '%s’",  email,  username), User.class); return  q.getSingleResult(); }
Parametrize !  don't Jeopardize !!! String  eMail=  request.getParameter("email")   ; String  userName=   request.getParameter("username"); //SQL PreparedStatement pstmt =  con.prepareStatement("update    Users  set  email  =  ?  where   username   =    ?);   pstmt.setString(1,   eMail);   pstmt.setString(2,   userName); //JPA Query  safeQuery =  entityManager.createQuery( "update  Users  u  SET  u.email =  ?1  WHERE  u.username =  ?2"); safeQuery.setParameter(1,   eMail)   ; safeQuery.setParameter(2,   userName); safeQuery.executeUpdate();
Moral  !   NEVER  re-­implements   security mechanisms  that  are   approuved in  a  core  library  !! This  is  the  same  thing  for  crypto  and  other  mechanisms  that  are  not  security....
public final class InsertEmployeeActionextends Action{ public ActionForward execute(ActionMappingmapping,ActionForm form, HttpServletRequest request,HttpServletResponseresponse)throws Exception{ Obj1 service= new Obj1(); ObjForm objForm = (ObjForm) form; InfoADT adt = new InfoADT(); BeanUtils.copyProperties(adt,objForm); String searchQuery= objForm.getqueryString(); String payload = objForm.getPayLoad(); try { service.doWork(adt); / /do somethingwith thedata ActionMessages messages = new ActionMessages(); ActionMessagemessage= new ActionMessage("success",adt.getName()); messages.add(ActionMessages.GLOBAL_MESSAGE,message); saveMessages(request, messages ); request.setAttribute("Record",adt); return (mapping.findForward("success")); } catch( DatabaseExceptionde) { ActionErrors errors = new ActionErrors(); ActionError error = new ActionError("error.employee.databaseException" + “Payload:“+payload); errors.add(ActionErrors.GLOBAL_ERROR,error ); saveErrors(request,errors ); return (mapping.findForward("error: "+ searchQuery)); } } } Spot  the  vuln(s)  !
XSS  risks • Session  Hijacking • Site  Defacement • Network  Scanning • Undermining  CSRF  Defenses • Site  Redirection/Phishing • Load  of  Remotely  Hosted  Scripts • Data  Theft • Keystroke  Logging • Attackers  using  XSS  more  frequently
<
&lt;
Encoding  Output Characters Decimal Hexadecimal HTML  Character   Set Unicode "  (double   quotation   marks) &#34; &#x22; &quot; u0022 '  (single   quotation  mark) &#39; &#x27; &apos; u0027 &  (ampersand) &#38; &#x26; &amp; u0026 <  (less  than) &#60; &#x3C; &lt; u003c >  (greater  than) &#62; &#x3E; &gt; u003e Safe  ways  to  represent  dangerous  characters  in  a  web  page
OWASP  Java  Encoder  Project https://www.owasp.org/index.php/OWASP_Java_Encoder_Project • No  third  party  libraries  or  configuration  necessary • This  code  was  designed  for  high-­availability/high-­ performance  encoding  functionality • Simple  drop-­in  encoding  functionality • Redesigned  for  performance • More  complete  API  (uri and  uri component  encoding,   etc)  in  some  regards. • Java  1.5+
(3)  Validate  All  Inputs
2015 09-18-jug summer camp
OWASP  HTML  Sanitizer  Project https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project • HTML  Sanitizer  written  in  Java  which  lets  you  include  HTML   authored  by  third-­parties  in  your  web  application  while  protecting   against  XSS.   • This  code  was  written  with  security  best  practices  in  mind,  has  an   extensive  test  suite,  and  has  undergone  adversarial  security  review   https://code.google.com/p/owasp-­java-­html-­ sanitizer/wiki/AttackReviewGroundRules.   • It  allows  for  simple  programmatic  POSITIVE  policy  configuration.   No  XML  config.   • Actively  maintained  by  Mike  Samuel  from  Google's  AppSec team!   • This  is  code  from  the  Caja project  that  was  donated  by  Google.  It   is  rather  high  performance  and  low  memory  utilization.  
• Upload  Verification – Filename   and  Size  validation   +  antivirus • Upload  Storage – Use  only  trusted  filenames  +  separate  domain • Beware  of  "special"  files – "crossdomain.xml"    or    "clientaccesspolicy.xml".   • Image  Upload  Verification – Enforce  proper  image  size  limits – Use  image  rewriting  libraries – Set  the  extension  of  the  stored  image  to  be  a  valid  image  extension – Ensure  the  detected  content  type  of  the  image  is  safe • Generic  Upload  Verification – Ensure  decompressed   size  of  file  <  maximum  size   – Ensure  that  an  uploaded   archive  matches  the  type  expected  (zip,  rar) – Ensure  structured  uploads   such  as  an  add-­on  follow  proper  standard
2015 09-18-jug summer camp
What  is  Access  Control? • Authorization  is  the  process  where  a  system  determines if  a  specific  user  has  access  to  a  resource • Permission:  Represents  app  behavior  only • Entitlement:  What  a  user  is  actually  allowed  to  do • Principle/User:  Who/what  you  are  entitling • Implicit  Role:    Named  permission,  user  associated – if  (user.isRole(“Manager”));; • Explicit  Role:  Named  permission,  resource  associated – if  (user.isAuthorized(“report:view:3324”);;
Access  Control  Anti-­Patterns • Hard-­coded  role  checks  in  application  code • Lack  of  centralized  access  control  logic • Untrusted  data  driving  access  control  decisions • Access  control  that  is  “open  by  default” • Lack  of  addressing  horizontal  access  control  in  a   standardized  way  (if  at  all) • Access  control  logic  that  needs  to  be  manually   added  to  every  endpoint  in  code • Access  Control  that  is  “sticky”  per  session • Access  Control  that  requires  per-­user  policy
Access  Controls  Impact • Loss  of  accountability – Attackers  maliciously  execute  actions  as  other  users – Attackers  maliciously  execute  higher  level  actions • Disclosure  of  confidential  data – Compromising  admin-­‐level  accounts  often  results  in   access  to  user’s  confidential  data • Data  tampering – Privilege  levels  do  not  distinguish  users  who  can  only   view  data  and  users  permitted  to  modify  data
void editProfile(User u, EditUser eu) { if (u.isManager()) { editUser(eu) } } HardCode Auth Rule
void editProfile(User u, EditUser eu) { if ((user.isManager() || user.isAdministrator() || user.isEditor()) && user.id() != 1132)) { // do stuff } } Policy  evolution....
36
Hard-­‐Coded  Roles • Makes  “proving”  the  policy  of  an  application   difficult  for  audit  or  Q/A  purposes • Any  time  access  control  policy  needs  to   change,  new  code  need  to  be  pushed • RBAC(http://en.wikipedia.org/wiki/Role-­‐ based_access_control)  is  often  not  granular   enough   • Fragile,  easy  to  make  mistakes
Never  Depend  on  Untrusted  Data • Never  trust  request  data  for  access  control  decisions • Never  make  access  control  decisions  in  JavaScript • Never  make  authorization  decisions  based  solely  on:   hidden  fields cookie  values form  parameters URL  parameters anything  else  from  the  request • Never  depend  on  the  order  of  values  sent  from  the  client
Best  Practice:  Centralized  AuthZ • Define  a  centralized  access  controller – ACLService.isAuthorized(PERMISSION_CONSTANT) – ACLService.assertAuthorized(PERMISSION_CONSTANT) • Access  control  decisions  go  through  these  simple   API’s • Centralized  logic  to  drive  policy  behavior  and   persistence • May  contain  data-­‐driven  access  control  policy   information
int userId= request.getInt(”userID"); //Best to get it from sessionID.... if (validateUser(userId) ) { if ( currentUser.isPermitted( ”module:function:" + userId) ) { log.info(userId + “are permitted to access ."); doStuff(userId); } else { log.info(userId + “ is notallowed to access!"); throw new AuthorizationException (userId); } } Should  be  like  this...
Establish  Authentication  and   Identity  Controls
1) Do  not  limit  the  type  of  characters  or  length   of  user  password  within  reason • Be  wary  of  systems  that  allow  unlimited  password   sizes  (Django DOS  Sept  2013) • 2)  Use  a  cryptographically  strong  credential-­‐specific   salt • 3)  Impose  difficult  verification   • on  the  attacker  and  defender  :  use  PBKDF2  or   script • on  only the  attacker  :  use  HMAC-­‐SHA-­‐256  
2)  Use  a  cryptographically  strong  credential-­‐ specific  salt • protect(  [salt]  +  [password]  ); • Use  a  32char  or  64char  salt  (actual  size  dependent   on  protection  function); • Do  not  depend  on  hiding,  splitting,  or  otherwise   obscuring  the  salt
3a)  Impose  difficult  verification  on  the  attacker   and  defender •PBKDF2([salt]  +  [password],  c=140,000);   •Use  PBKDF2 when  FIPS  certification  or  enterprise   support  on  many  platforms  is  required •Use  Scrypt where  resisting  any/all  hardware   accelerated  attacks  is  necessary  but  enterprise  support   and  scale  is  not.  (bcrypt is  also  a  reasonable  choice)
3b)  Impose  difficult  verification  on  only the   attacker   •HMAC-­‐SHA-­‐256(  [private  key],  [salt]  +  [password]  ) •Protect  this  key  as  any  private  key  using  best  practices •Store  the  key  outside  the  credential  store •Build  the  password-­‐to-­‐hash  conversion  as  a  separate   webservice (cryptograpic isolation).
Password1!
Require  2  identity  questions   <Last  name,  account  number,  email,  DOB <Enforce  lockout  policy Ask  one  or  more  good  security  questions <https://www.owasp.org/index.php/Choosing_and_Using_Security_ Questions_Cheat_Sheet Send  the  user  a  randomly  generated  token  via  out-­‐of-­‐band <app,  SMS  or  token   Verify  code  in  same  web  session <Enforce  lockout  policy Change  password <Enforce password policy Changing  Password
//import  java.security and  java.crypto and  java.util needed //  Based on  recommendation from NIST  SP800-­‐132.pdf public  class  PasswordEncryptionService { public  boolean authenticate(String  attemptedPassword,  byte[]  encryptedPassword,  byte[]  salt) throws NoSuchAlgorithmException,  InvalidKeySpecException { byte[]  encryptedAttemptedPassword =  getEncryptedPassword(attemptedPassword,  salt); return  Arrays.equals(encryptedPassword,  encryptedAttemptedPassword); } public  byte[]  getEncryptedPassword(String  password,  byte[]  salt) throws NoSuchAlgorithmException,  InvalidKeySpecException { String  algorithm =  "PBKDF2WithHmacSHA1’’;    //  SHA1  recommende by  nist int derivedKeyLength =  160; int iterations =  20000;  //  minimum  1000  its from NIST KeySpec spec =  new  PBEKeySpec(password.toCharArray(),  salt,  iterations,  derivedKeyLength); SecretKeyFactory f  =  SecretKeyFactory.getInstance(algorithm); return  f.generateSecret(spec).getEncoded(); } public  byte[]  generateSalt()  throws NoSuchAlgorithmException { SecureRandom random =  SecureRandom.getInstance("SHA1PRNG"); byte[]  salt =  new  byte[8]; random.nextBytes(salt); return  salt; SecurePasswordStorage
• Authentication  Cheat  Sheet – https://www.owasp.org/index.php/Authentication_Cheat_Sheet • Password  Storage  Cheat  Sheet – https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet • Forgot  Password  Cheat  Sheet – https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet • Session  Management  Cheat  Sheet – https://www.owasp.org/index.php/Session_Management_Cheat_Sheet • ASVS  AuthN and  Session  Requirements – https://www.owasp.org/index.php/OWASP_Application_Security_Verific ation_Standard_Project • Choose  Security  Questions – https://www.owasp.org/index.php/Choosing_and_Using_Security_Quest ions_Cheat_Sheet
2015 09-18-jug summer camp
• What  benefits  do  HTTPS  provide? – Confidentiality,  Integrity  and  Authenticity – Confidentiality:  Spy  cannot  view  your  data – Integrity:  Spy  cannot  change  your  data – Authenticity:  Server  you  are  visiting  is  the   right  one
Encryption  in  Transit  (HTTPS/TLS) • HTTPS  configuration  best  practices – https://www.owasp.org/index.php/Transport_L ayer_Protection_Cheat_Sheet – https://www.ssllabs.com/projects/best-­ practices/
• Certificate  Pinning – https://www.owasp.org/index.php/Pinning_Cheat_Sheet • HSTS  (Strict  Transport  Security) – http://www.youtube.com/watch?v=zEV3HOuM_Vw – Strict-­‐Transport-­‐Security:   max-­‐age=31536000 • Forward  Secrecy – https://whispersystems.org/blog/asynchronous-­‐security/ • Certificate  Creation  Transparency – http://certificate-­‐transparency.org • Browser  Certificate  Pruning – Etsy/Zane  Lackey
HSTS  – Strict  Transport  Security • HSTS  (Strict  Transport  Security) – http://www.youtube.com/watch?v=zEV3HOuM_Vw – Strict-­‐Transport-­‐Security:  max-­‐age=31536000;   includeSubdomains • Forces  browser  to  only  make  HTTPS  connection  to  server • Must  be  initially  delivered  over  a  HTTPS  connection
Intrusion  Detection  
Logs  and  errors
Risks  ?   • Error messages  can disclose information   valuable to  an  attacker • Failure can lead  to  an  unhandled state,  which can lead  to  denial of  service  – Unhandled failures can lead  to  malicious behavior being unnoticed
Fail  Securely  !   • Not  Just  catching  exception • Not  Just  logging  exception/errors Handle  all  failures  securely  and  return  the   system  to  a  proper  state  
Design  Patterns • Don't assume  that an  error condition  won't occur • It's what the  attackers want you to  assume   • Errors are  like accidents,  you don't expect them,  but  they happen • Any code  that can throw an  exception  should be in  a  Try Block   • Handle all  possible  exceptions   • Use  Finally Blocks:  leaving files  open  or  exceptions  defined after use  creates resource leaks and  possible  system  failure • Short  specific Try Blocks  give you more  control  over  the   error state  
App  Layer  Intrusion  Detection • Great  detection  points  to  start  with – Input  validation  failure  server  side  when  client  side   validation  exists – Input  validation  failure  server  side  on  non-­user   editable  parameters  such  as  hidden  fields,   checkboxes,  radio  buttons  or  select  lists – Forced  browsing  to  common  attack  entry  points   – Honeypot  URL  (e.g.  a  fake  path  listed  in  robots.txt like  e.g.  /admin/secretlogin.jsp)  
App  Layer  Intrusion  Detection • Others – Blatant  SQLi or  XSS  injection  attacks – Workflow  sequence  abuse  (e.g.  multi-­part  form  in   wrong  order) – Custom  business  logic  (e.g.  basket  vs catalogue   price  mismatch) – Further  Study: • “libinjection:  from  SQLi to  XSS” – Nick  Galbreath • “Attack  Driven  Defense”  – Zane  Lackey
OWASP  AppSensor (Java) • Project  and  mailing  list   https://www.owasp.org/index.php/OWASP_A ppSensor_Project • Four-­page  briefing,  Crosstalk,  Journal  of   Defense  Software  Engineering • http://www.crosstalkonline.org/storage/issue-­ archives/2011/201109/201109-­Watson.pdf
Security  Requirements
OWASP  ASVS https://www.owasp.org/index.php/C ategory:OWASP_Application_Security _Verification_Standard_Project
Bad  Design
Security  Architecture  and  Design Strategic  effort • Business,  technical  and  security  stakeholders   • Functional  and  non-­‐functional  security  properties • Different  flavors/efforts  based  on  SDL/culture Example:  state • Should  you  use  the  request?   • Should  you  use  a  web  session?   • Should  you  use  the  database?   These  decisions  have  dramatic  security  implications
Trusting  Input • Treating  all  client  side  data  as  untrusted  is   important,  and  can  be  tied  back  to  trust   zones/boundaries  in  design/architecture.   • Ideally  we  want  to  consider  all  tiers  to  be   untrusted  and  build  controls  at  all  layers,   but  this  is  not  practical  or  even  possible  for   some  very  large  systems.
Security  Architecture  and  Design Additional  Considerations • Overall  Architecture/Design • Trust  Zones/Boundaries/Tiers 1. User  Interface,    API  (Webservices),   2. Business  Layer  (Custom  Logic),   3. Data  Layer  (Keys  to  the  Kingdom) 4. What  sources  can/cannot  be  trusted? • What  is  inside/outside  of  a  trust  zone/boundary • Specific  controls  need  to  exist  at  certain  layers • Attack  Surface
Controlling  code  in  one  picture
Pentest or  code  review  for   CISO   Top10 Web Pentest Code  Review A1-­‐Injection ++ +++ A2-­‐Broken  Authentication  and  Session   Management ++ + A3-­‐Cross-­‐Site  Scripting  (XSS) +++ +++ A4-­‐Insecure  Direct  Object  References + +++ A5-­‐Security  Misconfiguration + ++ A6-­‐Sensitive  Data  Exposure ++ + A7-­‐Missing  Function  Level  Access   Control + + A8-­‐Cross-­‐Site  Request  Forgery  (CSRF) ++ + A9-­‐Using  Components  with  Known   Vulnerabilities +++ A10-­‐Unvalidated  Redirects  and   Forwards + +
Pentesting and  code  review  for  a   developer
10  reasons to  use  .... • Written in  Java  J • Integrated with CI  Tools   (Jenkins/Hudson/Bamboo) • Modular (plugins  by  languages) • Developer tools • Dashboard • OWASP  project J • Open-­‐Source  (and  commercial  too)
• https://www.owasp.org/index.php/OWASP_S onarQube_Project Of  Course  !  
License 7 4 • @SPoint • sebastien.gioria@owasp.org
LAST  BUT  NOT  LEAST....
Lack  of  knowledge... String  myString =  "insecure"; myString.replace("i","1") //  do  Stuff
Good  Try...but...catch  J public  class  BadCatch { public  void mymethodErr1()  { try { //do  Stuff }  catch  (SecurityException se){ System.err.println (se); } } }
Nice  comments //  Pattern  to  match  the  string Pattern  myPattern =  "bword1W+(?:w+/W+){1,6}?word2b"; String  updated =  MYCONSTANT1.replaceAll(mypattern,  "$2"); //  i  iterate from 0  to  10 for  (int i=0;  i  <10  ;  i++)  { //  do  stuff myMethod(updated); }
Unit  testing • In  computer  programming,  unit  testing is a  software  testing method by  which individual units of  source  code,  sets  of  one  or  more  computer  program   modules  together with associated control  data,  usage  procedures,  and   operating  procedures,  are  tested to  determine whether they are  fit  for  use..   (c)  Wikipedia

More Related Content

PDF
Secure Coding For Java - Une introduction
Sebastien Gioria
 
PDF
42 minutes to secure your code....
Sebastien Gioria
 
PPTX
CLUSIR INFONORD OWASP iot 2014
Sebastien Gioria
 
PDF
OWASP, PHP, life and universe
Sebastien Gioria
 
PDF
Secure Coding for Java - An Introduction
Sebastien Gioria
 
PDF
Application Security on a Dime: A Practical Guide to Using Functional Open So...
POSSCON
 
PPT
Top Ten Proactive Web Security Controls v5
Jim Manico
 
PDF
Problems with parameters b sides-msp
Mike Saunders
 
Secure Coding For Java - Une introduction
Sebastien Gioria
 
42 minutes to secure your code....
Sebastien Gioria
 
CLUSIR INFONORD OWASP iot 2014
Sebastien Gioria
 
OWASP, PHP, life and universe
Sebastien Gioria
 
Secure Coding for Java - An Introduction
Sebastien Gioria
 
Application Security on a Dime: A Practical Guide to Using Functional Open So...
POSSCON
 
Top Ten Proactive Web Security Controls v5
Jim Manico
 
Problems with parameters b sides-msp
Mike Saunders
 

What's hot (19)

PDF
HackFest 2015 - Rasp vs waf
IMMUNIO
 
PDF
Running an app sec program with OWASP projects_ Defcon AppSec Village
Vandana Verma
 
PDF
David Thiel - Secure Development On iOS
Source Conference
 
PPTX
OWASP
Pen Testeronyguy
 
PDF
Smart Sheriff, Dumb Idea, the wild west of government assisted parenting
Abraham Aranguren
 
PDF
Secure development in .NET with EPiServer Solita
Joona Immonen
 
PPTX
Database Firewall from Scratch
Denis Kolegov
 
PPTX
20160211 OWASP Charlotte RASP
chadtindel
 
PPTX
[Wroclaw #2] Web Application Security Headers
OWASP
 
PDF
[OWASP Poland Day] OWASP for testing mobile applications
OWASP
 
PDF
Nessus and Reporting Karma
n|u - The Open Security Community
 
PDF
OSCP Preparation Guide @ Infosectrain
InfosecTrain
 
PDF
(Un)safe Python
Ivan Tsyganov
 
PDF
[OPD 2019] Top 10 Security Facts of 2020
OWASP
 
PDF
[OWASP Poland Day] Security knowledge framework
OWASP
 
PDF
[OWASP Poland Day] Security in developer's life
OWASP
 
PDF
The Hacker's Guide To Session Hijacking
Patrycja Wegrzynowicz
 
PDF
OISC 2019 - The OWASP Top 10 & AppSec Primer
ThreatReel Podcast
 
PDF
Technical Architecture of RASP Technology
Priyanka Aash
 
HackFest 2015 - Rasp vs waf
IMMUNIO
 
Running an app sec program with OWASP projects_ Defcon AppSec Village
Vandana Verma
 
David Thiel - Secure Development On iOS
Source Conference
 
OWASP
Pen Testeronyguy
 
Smart Sheriff, Dumb Idea, the wild west of government assisted parenting
Abraham Aranguren
 
Secure development in .NET with EPiServer Solita
Joona Immonen
 
Database Firewall from Scratch
Denis Kolegov
 
20160211 OWASP Charlotte RASP
chadtindel
 
[Wroclaw #2] Web Application Security Headers
OWASP
 
[OWASP Poland Day] OWASP for testing mobile applications
OWASP
 
Nessus and Reporting Karma
n|u - The Open Security Community
 
OSCP Preparation Guide @ Infosectrain
InfosecTrain
 
(Un)safe Python
Ivan Tsyganov
 
[OPD 2019] Top 10 Security Facts of 2020
OWASP
 
[OWASP Poland Day] Security knowledge framework
OWASP
 
[OWASP Poland Day] Security in developer's life
OWASP
 
The Hacker's Guide To Session Hijacking
Patrycja Wegrzynowicz
 
OISC 2019 - The OWASP Top 10 & AppSec Primer
ThreatReel Podcast
 
Technical Architecture of RASP Technology
Priyanka Aash
 
Ad

Similar to 2015 09-18-jug summer camp (20)

PPTX
ISO 27k talk for django meet up
Viren Rajput
 
PDF
Weaponizing Your DevOps Pipeline
Puma Security, LLC
 
PDF
James Jara Portfolio 2014 - InfoSec White Paper- Part 5
James Jara
 
PPTX
Platform Security IRL: Busting Buzzwords & Building Better
Equal Experts
 
PPTX
How to Use OWASP Security Logging
Milton Smith
 
PDF
Cache Security- The Basics
InterSystems Corporation
 
PDF
Java EE 6 Security in practice with GlassFish
Markus Eisele
 
PPTX
AllDayDevOps 2019 AppSensor
jtmelton
 
PPTX
Slides for the #JavaOne Session ID: CON11881
Masoud Kalali
 
PDF
KoprowskiT_SQLSatHolland_SQLServerSecurityInTheCloud
Tobias Koprowski
 
PPTX
Penetration testing dont just leave it to chance
Dr. Anish Cheriyan (PhD)
 
PPTX
Making Security Agile - Oleg Gryb
SeniorStoryteller
 
PPTX
Self-Protecting JavaScript: A Lightweight Approach to Enforcing Security Poli...
Phú Phùng
 
PDF
Bringing Security Testing to Development: How to Enable Developers to Act as ...
Achim D. Brucker
 
PDF
Securing the Internet of Things - Hank Chavers
WithTheBest
 
PDF
1.3. (In)security Software
defconmoscow
 
PPT
iOS Application Penetration Testing for Beginners
RyanISI
 
PPTX
Martin Toshev - Java Security Architecture - Codemotion Rome 2019
Codemotion
 
PDF
Threat_Modelling.pdf
MarlboroAbyad
 
PDF
CMS Hacking Tricks - DerbyCon 4 - 2014
Greg Foss
 
ISO 27k talk for django meet up
Viren Rajput
 
Weaponizing Your DevOps Pipeline
Puma Security, LLC
 
James Jara Portfolio 2014 - InfoSec White Paper- Part 5
James Jara
 
Platform Security IRL: Busting Buzzwords & Building Better
Equal Experts
 
How to Use OWASP Security Logging
Milton Smith
 
Cache Security- The Basics
InterSystems Corporation
 
Java EE 6 Security in practice with GlassFish
Markus Eisele
 
AllDayDevOps 2019 AppSensor
jtmelton
 
Slides for the #JavaOne Session ID: CON11881
Masoud Kalali
 
KoprowskiT_SQLSatHolland_SQLServerSecurityInTheCloud
Tobias Koprowski
 
Penetration testing dont just leave it to chance
Dr. Anish Cheriyan (PhD)
 
Making Security Agile - Oleg Gryb
SeniorStoryteller
 
Self-Protecting JavaScript: A Lightweight Approach to Enforcing Security Poli...
Phú Phùng
 
Bringing Security Testing to Development: How to Enable Developers to Act as ...
Achim D. Brucker
 
Securing the Internet of Things - Hank Chavers
WithTheBest
 
1.3. (In)security Software
defconmoscow
 
iOS Application Penetration Testing for Beginners
RyanISI
 
Martin Toshev - Java Security Architecture - Codemotion Rome 2019
Codemotion
 
Threat_Modelling.pdf
MarlboroAbyad
 
CMS Hacking Tricks - DerbyCon 4 - 2014
Greg Foss
 
Ad

More from Sebastien Gioria (7)

PDF
La Sécurité des CMS ?
Sebastien Gioria
 
PDF
Securing your API and mobile application - API Connection FR
Sebastien Gioria
 
PDF
La Quete du code source fiable et sécurisé - GSDAYS 2015
Sebastien Gioria
 
PDF
2014 06-05-mozilla-afup
Sebastien Gioria
 
PDF
Sécurité des applications mobiles
Sebastien Gioria
 
PPTX
Securite des Applications dans le Cloud
Sebastien Gioria
 
PDF
Secure Coding for Java - An introduction
Sebastien Gioria
 
La Sécurité des CMS ?
Sebastien Gioria
 
Securing your API and mobile application - API Connection FR
Sebastien Gioria
 
La Quete du code source fiable et sécurisé - GSDAYS 2015
Sebastien Gioria
 
2014 06-05-mozilla-afup
Sebastien Gioria
 
Sécurité des applications mobiles
Sebastien Gioria
 
Securite des Applications dans le Cloud
Sebastien Gioria
 
Secure Coding for Java - An introduction
Sebastien Gioria
 

Recently uploaded (20)

PPTX
EthicalHack{aksdladlsfsamnookfmnakoasjd}.pptx
dagarabull
 
PPTX
谢尔丹学院毕业证购买|Sheridan文凭不见了怎么办谢尔丹学院成绩单
mookxk3
 
PDF
Generative AI Foundations: AI Skills for the Future of Work
hemal sharma
 
PDF
KIPER4D situs Exclusive Game dari server Star Gaming Asia
hokimamad0
 
PDF
KIPER4D situs Exclusive Game dari server Star Gaming Asia
hokimamad0
 
PDF
PDF document: World Game (s) Great Redesign.pdf
Steven McGee
 
PPTX
原版北不列颠哥伦比亚大学毕业证文凭UNBC成绩单2025年新版在线制作学位证书
e7nw4o4
 
PPTX
Pengenalan perangkat Jaringan komputer pada teknik jaringan komputer dan tele...
Prayudha3
 
PDF
BGP Security Best Practices that Matter, presented at PHNOG 2025
APNIC
 
PDF
LOGENVIDAD DANNYFGRETRRTTRRRTRRRRRRRRR.pdf
juan456ytpro
 
PPTX
SEO Trends in 2025 | B3AITS - Bow & 3 Arrows IT Solutions
B3AITS - Bow & 3 Arrows IT Solutions
 
PDF
Data Protection & Resilience in Focus.pdf
AmyPoblete3
 
PPTX
Artificial-Intelligence-in-Daily-Life (2).pptx
nidhigoswami335
 
PPTX
Perkembangan Perangkat jaringan komputer dan telekomunikasi 3.pptx
Prayudha3
 
PPTX
B2B_Ecommerce_Internship_Simranpreet.pptx
LipakshiJindal
 
PPTX
The Internet of Things (IoT) refers to a vast network of interconnected devic...
chethana8182
 
PDF
KIPER4D situs Exclusive Game dari server Star Gaming Asia
hokimamad0
 
PPTX
LESSON-2-Roles-of-ICT-in-Teaching-for-learning_123922 (1).pptx
renavieramopiquero
 
PDF
Project English Paja Jara Alejandro.jpdf
AlejandroAlonsoPajaJ
 
PPTX
Generics jehfkhkshfhskjghkshhhhlshluhueheuhuhhlhkhk.pptx
yashpavasiya892
 
EthicalHack{aksdladlsfsamnookfmnakoasjd}.pptx
dagarabull
 
谢尔丹学院毕业证购买|Sheridan文凭不见了怎么办谢尔丹学院成绩单
mookxk3
 
Generative AI Foundations: AI Skills for the Future of Work
hemal sharma
 
KIPER4D situs Exclusive Game dari server Star Gaming Asia
hokimamad0
 
KIPER4D situs Exclusive Game dari server Star Gaming Asia
hokimamad0
 
PDF document: World Game (s) Great Redesign.pdf
Steven McGee
 
原版北不列颠哥伦比亚大学毕业证文凭UNBC成绩单2025年新版在线制作学位证书
e7nw4o4
 
Pengenalan perangkat Jaringan komputer pada teknik jaringan komputer dan tele...
Prayudha3
 
BGP Security Best Practices that Matter, presented at PHNOG 2025
APNIC
 
LOGENVIDAD DANNYFGRETRRTTRRRTRRRRRRRRR.pdf
juan456ytpro
 
SEO Trends in 2025 | B3AITS - Bow & 3 Arrows IT Solutions
B3AITS - Bow & 3 Arrows IT Solutions
 
Data Protection & Resilience in Focus.pdf
AmyPoblete3
 
Artificial-Intelligence-in-Daily-Life (2).pptx
nidhigoswami335
 
Perkembangan Perangkat jaringan komputer dan telekomunikasi 3.pptx
Prayudha3
 
B2B_Ecommerce_Internship_Simranpreet.pptx
LipakshiJindal
 
The Internet of Things (IoT) refers to a vast network of interconnected devic...
chethana8182
 
KIPER4D situs Exclusive Game dari server Star Gaming Asia
hokimamad0
 
LESSON-2-Roles-of-ICT-in-Teaching-for-learning_123922 (1).pptx
renavieramopiquero
 
Project English Paja Jara Alejandro.jpdf
AlejandroAlonsoPajaJ
 
Generics jehfkhkshfhskjghkshhhhlshluhueheuhuhhlhkhk.pptx
yashpavasiya892
 

2015 09-18-jug summer camp

  • 1. 42  minutes  to  secure  your  code…. Sébastien Gioria [email protected] OWASP  France  Leader  &   Evangelist JUG  Summer  Camp 18  Septembre 2015 LaRochelle -­‐ France
  • 2. Agenda • OWASP  ?   • Secure  Coding  ?   • 10  simply  principles  to  secure  code • Controlling  code  security   • Q&A  Beer  J 2
  • 3. 2 http://www.google.fr/#q=sebastien   gioria ‣OWASP  France  Leader  &  Founder  &   Evangelist,   ‣OWASP  ISO  Project  &  OWASP  SonarQube Project   Leader ‣Innovation  and  Technology  @Advens  &&     Application  Security  Expert Twitter  :@SPoint/@OWASP_France/@AppSecAcademy2 ‣Application  Security  group  leader  for  the   CLUSIF ‣Proud  father  of  youngs  kids  trying  to  hack  my   digital  life.   ‣Legal expert    for  Cour  of  Appeal of  Poitiers
  • 5. OWASP  publications  !   • Publications  :   – Top10  Application  Security   Risk  ;  bestseller – Testing  Guide  ;  second   bestseller – OWASP  Cheat  Sheets  !!!   – Application  Security   Verification  Standard  ;  not  the   best  well  known  document – OpenSAMM :  improve  your   application  security – OWASP  Secure  Contract   Annex   – OWASP  Top10  for  ...  (mobile,   cloud,  privacy,  ...) • Tools  /  API – OWASP  Zed  Attack  Proxy  ;   replace  WebScarab with  a  lot   of  new  functionalities – OWASP  ESAPI  :  API  for   securing  your  Software – OWASP  AppSensor ;  a  IDS/IPS   in  the  heart  of  your  software – OWASP  Cornucoppia ;   application  security  play  with   cards – OWASP  Snake  and  ladder  :   play  Top10 and  many  more....
  • 7. Yes,  this  is  you  !  
  • 8. Some  Stats.... (c)  IBM  March  2014
  • 17. @Inject EntityManager em; @Transactional public  User  updateEmail(String   username,String email)  { TypedQuery<User>   q  =  em.createQuery( String.format(”update    Users  set  email  ‘%s’  where  username   =   '%s’",  email,  username), User.class); return  q.getSingleResult(); }
  • 18. Parametrize !  don't Jeopardize !!! String  eMail=  request.getParameter("email")   ; String  userName=   request.getParameter("username"); //SQL PreparedStatement pstmt =  con.prepareStatement("update    Users  set  email  =  ?  where   username   =    ?);   pstmt.setString(1,   eMail);   pstmt.setString(2,   userName); //JPA Query  safeQuery =  entityManager.createQuery( "update  Users  u  SET  u.email =  ?1  WHERE  u.username =  ?2"); safeQuery.setParameter(1,   eMail)   ; safeQuery.setParameter(2,   userName); safeQuery.executeUpdate();
  • 19. Moral  !   NEVER  re-­implements   security mechanisms  that  are   approuved in  a  core  library  !! This  is  the  same  thing  for  crypto  and  other  mechanisms  that  are  not  security....
  • 20. public final class InsertEmployeeActionextends Action{ public ActionForward execute(ActionMappingmapping,ActionForm form, HttpServletRequest request,HttpServletResponseresponse)throws Exception{ Obj1 service= new Obj1(); ObjForm objForm = (ObjForm) form; InfoADT adt = new InfoADT(); BeanUtils.copyProperties(adt,objForm); String searchQuery= objForm.getqueryString(); String payload = objForm.getPayLoad(); try { service.doWork(adt); / /do somethingwith thedata ActionMessages messages = new ActionMessages(); ActionMessagemessage= new ActionMessage("success",adt.getName()); messages.add(ActionMessages.GLOBAL_MESSAGE,message); saveMessages(request, messages ); request.setAttribute("Record",adt); return (mapping.findForward("success")); } catch( DatabaseExceptionde) { ActionErrors errors = new ActionErrors(); ActionError error = new ActionError("error.employee.databaseException" + “Payload:“+payload); errors.add(ActionErrors.GLOBAL_ERROR,error ); saveErrors(request,errors ); return (mapping.findForward("error: "+ searchQuery)); } } } Spot  the  vuln(s)  !
  • 21. XSS  risks • Session  Hijacking • Site  Defacement • Network  Scanning • Undermining  CSRF  Defenses • Site  Redirection/Phishing • Load  of  Remotely  Hosted  Scripts • Data  Theft • Keystroke  Logging • Attackers  using  XSS  more  frequently
  • 22. <
  • 23. &lt;
  • 24. Encoding  Output Characters Decimal Hexadecimal HTML  Character   Set Unicode "  (double   quotation   marks) &#34; &#x22; &quot; u0022 '  (single   quotation  mark) &#39; &#x27; &apos; u0027 &  (ampersand) &#38; &#x26; &amp; u0026 <  (less  than) &#60; &#x3C; &lt; u003c >  (greater  than) &#62; &#x3E; &gt; u003e Safe  ways  to  represent  dangerous  characters  in  a  web  page
  • 25. OWASP  Java  Encoder  Project https://www.owasp.org/index.php/OWASP_Java_Encoder_Project • No  third  party  libraries  or  configuration  necessary • This  code  was  designed  for  high-­availability/high-­ performance  encoding  functionality • Simple  drop-­in  encoding  functionality • Redesigned  for  performance • More  complete  API  (uri and  uri component  encoding,   etc)  in  some  regards. • Java  1.5+
  • 28. OWASP  HTML  Sanitizer  Project https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project • HTML  Sanitizer  written  in  Java  which  lets  you  include  HTML   authored  by  third-­parties  in  your  web  application  while  protecting   against  XSS.   • This  code  was  written  with  security  best  practices  in  mind,  has  an   extensive  test  suite,  and  has  undergone  adversarial  security  review   https://code.google.com/p/owasp-­java-­html-­ sanitizer/wiki/AttackReviewGroundRules.   • It  allows  for  simple  programmatic  POSITIVE  policy  configuration.   No  XML  config.   • Actively  maintained  by  Mike  Samuel  from  Google's  AppSec team!   • This  is  code  from  the  Caja project  that  was  donated  by  Google.  It   is  rather  high  performance  and  low  memory  utilization.  
  • 29. • Upload  Verification – Filename   and  Size  validation   +  antivirus • Upload  Storage – Use  only  trusted  filenames  +  separate  domain • Beware  of  "special"  files – "crossdomain.xml"    or    "clientaccesspolicy.xml".   • Image  Upload  Verification – Enforce  proper  image  size  limits – Use  image  rewriting  libraries – Set  the  extension  of  the  stored  image  to  be  a  valid  image  extension – Ensure  the  detected  content  type  of  the  image  is  safe • Generic  Upload  Verification – Ensure  decompressed   size  of  file  <  maximum  size   – Ensure  that  an  uploaded   archive  matches  the  type  expected  (zip,  rar) – Ensure  structured  uploads   such  as  an  add-­on  follow  proper  standard
  • 31. What  is  Access  Control? • Authorization  is  the  process  where  a  system  determines if  a  specific  user  has  access  to  a  resource • Permission:  Represents  app  behavior  only • Entitlement:  What  a  user  is  actually  allowed  to  do • Principle/User:  Who/what  you  are  entitling • Implicit  Role:    Named  permission,  user  associated – if  (user.isRole(“Manager”));; • Explicit  Role:  Named  permission,  resource  associated – if  (user.isAuthorized(“report:view:3324”);;
  • 32. Access  Control  Anti-­Patterns • Hard-­coded  role  checks  in  application  code • Lack  of  centralized  access  control  logic • Untrusted  data  driving  access  control  decisions • Access  control  that  is  “open  by  default” • Lack  of  addressing  horizontal  access  control  in  a   standardized  way  (if  at  all) • Access  control  logic  that  needs  to  be  manually   added  to  every  endpoint  in  code • Access  Control  that  is  “sticky”  per  session • Access  Control  that  requires  per-­user  policy
  • 33. Access  Controls  Impact • Loss  of  accountability – Attackers  maliciously  execute  actions  as  other  users – Attackers  maliciously  execute  higher  level  actions • Disclosure  of  confidential  data – Compromising  admin-­‐level  accounts  often  results  in   access  to  user’s  confidential  data • Data  tampering – Privilege  levels  do  not  distinguish  users  who  can  only   view  data  and  users  permitted  to  modify  data
  • 34. void editProfile(User u, EditUser eu) { if (u.isManager()) { editUser(eu) } } HardCode Auth Rule
  • 35. void editProfile(User u, EditUser eu) { if ((user.isManager() || user.isAdministrator() || user.isEditor()) && user.id() != 1132)) { // do stuff } } Policy  evolution....
  • 36. 36
  • 37. Hard-­‐Coded  Roles • Makes  “proving”  the  policy  of  an  application   difficult  for  audit  or  Q/A  purposes • Any  time  access  control  policy  needs  to   change,  new  code  need  to  be  pushed • RBAC(http://en.wikipedia.org/wiki/Role-­‐ based_access_control)  is  often  not  granular   enough   • Fragile,  easy  to  make  mistakes
  • 38. Never  Depend  on  Untrusted  Data • Never  trust  request  data  for  access  control  decisions • Never  make  access  control  decisions  in  JavaScript • Never  make  authorization  decisions  based  solely  on:   hidden  fields cookie  values form  parameters URL  parameters anything  else  from  the  request • Never  depend  on  the  order  of  values  sent  from  the  client
  • 39. Best  Practice:  Centralized  AuthZ • Define  a  centralized  access  controller – ACLService.isAuthorized(PERMISSION_CONSTANT) – ACLService.assertAuthorized(PERMISSION_CONSTANT) • Access  control  decisions  go  through  these  simple   API’s • Centralized  logic  to  drive  policy  behavior  and   persistence • May  contain  data-­‐driven  access  control  policy   information
  • 40. int userId= request.getInt(”userID"); //Best to get it from sessionID.... if (validateUser(userId) ) { if ( currentUser.isPermitted( ”module:function:" + userId) ) { log.info(userId + “are permitted to access ."); doStuff(userId); } else { log.info(userId + “ is notallowed to access!"); throw new AuthorizationException (userId); } } Should  be  like  this...
  • 41. Establish  Authentication  and   Identity  Controls
  • 42. 1) Do  not  limit  the  type  of  characters  or  length   of  user  password  within  reason • Be  wary  of  systems  that  allow  unlimited  password   sizes  (Django DOS  Sept  2013) • 2)  Use  a  cryptographically  strong  credential-­‐specific   salt • 3)  Impose  difficult  verification   • on  the  attacker  and  defender  :  use  PBKDF2  or   script • on  only the  attacker  :  use  HMAC-­‐SHA-­‐256  
  • 43. 2)  Use  a  cryptographically  strong  credential-­‐ specific  salt • protect(  [salt]  +  [password]  ); • Use  a  32char  or  64char  salt  (actual  size  dependent   on  protection  function); • Do  not  depend  on  hiding,  splitting,  or  otherwise   obscuring  the  salt
  • 44. 3a)  Impose  difficult  verification  on  the  attacker   and  defender •PBKDF2([salt]  +  [password],  c=140,000);   •Use  PBKDF2 when  FIPS  certification  or  enterprise   support  on  many  platforms  is  required •Use  Scrypt where  resisting  any/all  hardware   accelerated  attacks  is  necessary  but  enterprise  support   and  scale  is  not.  (bcrypt is  also  a  reasonable  choice)
  • 45. 3b)  Impose  difficult  verification  on  only the   attacker   •HMAC-­‐SHA-­‐256(  [private  key],  [salt]  +  [password]  ) •Protect  this  key  as  any  private  key  using  best  practices •Store  the  key  outside  the  credential  store •Build  the  password-­‐to-­‐hash  conversion  as  a  separate   webservice (cryptograpic isolation).
  • 47. Require  2  identity  questions   <Last  name,  account  number,  email,  DOB <Enforce  lockout  policy Ask  one  or  more  good  security  questions <https://www.owasp.org/index.php/Choosing_and_Using_Security_ Questions_Cheat_Sheet Send  the  user  a  randomly  generated  token  via  out-­‐of-­‐band <app,  SMS  or  token   Verify  code  in  same  web  session <Enforce  lockout  policy Change  password <Enforce password policy Changing  Password
  • 48. //import  java.security and  java.crypto and  java.util needed //  Based on  recommendation from NIST  SP800-­‐132.pdf public  class  PasswordEncryptionService { public  boolean authenticate(String  attemptedPassword,  byte[]  encryptedPassword,  byte[]  salt) throws NoSuchAlgorithmException,  InvalidKeySpecException { byte[]  encryptedAttemptedPassword =  getEncryptedPassword(attemptedPassword,  salt); return  Arrays.equals(encryptedPassword,  encryptedAttemptedPassword); } public  byte[]  getEncryptedPassword(String  password,  byte[]  salt) throws NoSuchAlgorithmException,  InvalidKeySpecException { String  algorithm =  "PBKDF2WithHmacSHA1’’;    //  SHA1  recommende by  nist int derivedKeyLength =  160; int iterations =  20000;  //  minimum  1000  its from NIST KeySpec spec =  new  PBEKeySpec(password.toCharArray(),  salt,  iterations,  derivedKeyLength); SecretKeyFactory f  =  SecretKeyFactory.getInstance(algorithm); return  f.generateSecret(spec).getEncoded(); } public  byte[]  generateSalt()  throws NoSuchAlgorithmException { SecureRandom random =  SecureRandom.getInstance("SHA1PRNG"); byte[]  salt =  new  byte[8]; random.nextBytes(salt); return  salt; SecurePasswordStorage
  • 49. • Authentication  Cheat  Sheet – https://www.owasp.org/index.php/Authentication_Cheat_Sheet • Password  Storage  Cheat  Sheet – https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet • Forgot  Password  Cheat  Sheet – https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet • Session  Management  Cheat  Sheet – https://www.owasp.org/index.php/Session_Management_Cheat_Sheet • ASVS  AuthN and  Session  Requirements – https://www.owasp.org/index.php/OWASP_Application_Security_Verific ation_Standard_Project • Choose  Security  Questions – https://www.owasp.org/index.php/Choosing_and_Using_Security_Quest ions_Cheat_Sheet
  • 51. • What  benefits  do  HTTPS  provide? – Confidentiality,  Integrity  and  Authenticity – Confidentiality:  Spy  cannot  view  your  data – Integrity:  Spy  cannot  change  your  data – Authenticity:  Server  you  are  visiting  is  the   right  one
  • 52. Encryption  in  Transit  (HTTPS/TLS) • HTTPS  configuration  best  practices – https://www.owasp.org/index.php/Transport_L ayer_Protection_Cheat_Sheet – https://www.ssllabs.com/projects/best-­ practices/
  • 53. • Certificate  Pinning – https://www.owasp.org/index.php/Pinning_Cheat_Sheet • HSTS  (Strict  Transport  Security) – http://www.youtube.com/watch?v=zEV3HOuM_Vw – Strict-­‐Transport-­‐Security:   max-­‐age=31536000 • Forward  Secrecy – https://whispersystems.org/blog/asynchronous-­‐security/ • Certificate  Creation  Transparency – http://certificate-­‐transparency.org • Browser  Certificate  Pruning – Etsy/Zane  Lackey
  • 54. HSTS  – Strict  Transport  Security • HSTS  (Strict  Transport  Security) – http://www.youtube.com/watch?v=zEV3HOuM_Vw – Strict-­‐Transport-­‐Security:  max-­‐age=31536000;   includeSubdomains • Forces  browser  to  only  make  HTTPS  connection  to  server • Must  be  initially  delivered  over  a  HTTPS  connection
  • 57. Risks  ?   • Error messages  can disclose information   valuable to  an  attacker • Failure can lead  to  an  unhandled state,  which can lead  to  denial of  service  – Unhandled failures can lead  to  malicious behavior being unnoticed
  • 58. Fail  Securely  !   • Not  Just  catching  exception • Not  Just  logging  exception/errors Handle  all  failures  securely  and  return  the   system  to  a  proper  state  
  • 59. Design  Patterns • Don't assume  that an  error condition  won't occur • It's what the  attackers want you to  assume   • Errors are  like accidents,  you don't expect them,  but  they happen • Any code  that can throw an  exception  should be in  a  Try Block   • Handle all  possible  exceptions   • Use  Finally Blocks:  leaving files  open  or  exceptions  defined after use  creates resource leaks and  possible  system  failure • Short  specific Try Blocks  give you more  control  over  the   error state  
  • 60. App  Layer  Intrusion  Detection • Great  detection  points  to  start  with – Input  validation  failure  server  side  when  client  side   validation  exists – Input  validation  failure  server  side  on  non-­user   editable  parameters  such  as  hidden  fields,   checkboxes,  radio  buttons  or  select  lists – Forced  browsing  to  common  attack  entry  points   – Honeypot  URL  (e.g.  a  fake  path  listed  in  robots.txt like  e.g.  /admin/secretlogin.jsp)  
  • 61. App  Layer  Intrusion  Detection • Others – Blatant  SQLi or  XSS  injection  attacks – Workflow  sequence  abuse  (e.g.  multi-­part  form  in   wrong  order) – Custom  business  logic  (e.g.  basket  vs catalogue   price  mismatch) – Further  Study: • “libinjection:  from  SQLi to  XSS” – Nick  Galbreath • “Attack  Driven  Defense”  – Zane  Lackey
  • 62. OWASP  AppSensor (Java) • Project  and  mailing  list   https://www.owasp.org/index.php/OWASP_A ppSensor_Project • Four-­page  briefing,  Crosstalk,  Journal  of   Defense  Software  Engineering • http://www.crosstalkonline.org/storage/issue-­ archives/2011/201109/201109-­Watson.pdf
  • 66. Security  Architecture  and  Design Strategic  effort • Business,  technical  and  security  stakeholders   • Functional  and  non-­‐functional  security  properties • Different  flavors/efforts  based  on  SDL/culture Example:  state • Should  you  use  the  request?   • Should  you  use  a  web  session?   • Should  you  use  the  database?   These  decisions  have  dramatic  security  implications
  • 67. Trusting  Input • Treating  all  client  side  data  as  untrusted  is   important,  and  can  be  tied  back  to  trust   zones/boundaries  in  design/architecture.   • Ideally  we  want  to  consider  all  tiers  to  be   untrusted  and  build  controls  at  all  layers,   but  this  is  not  practical  or  even  possible  for   some  very  large  systems.
  • 68. Security  Architecture  and  Design Additional  Considerations • Overall  Architecture/Design • Trust  Zones/Boundaries/Tiers 1. User  Interface,    API  (Webservices),   2. Business  Layer  (Custom  Logic),   3. Data  Layer  (Keys  to  the  Kingdom) 4. What  sources  can/cannot  be  trusted? • What  is  inside/outside  of  a  trust  zone/boundary • Specific  controls  need  to  exist  at  certain  layers • Attack  Surface
  • 69. Controlling  code  in  one  picture
  • 70. Pentest or  code  review  for   CISO   Top10 Web Pentest Code  Review A1-­‐Injection ++ +++ A2-­‐Broken  Authentication  and  Session   Management ++ + A3-­‐Cross-­‐Site  Scripting  (XSS) +++ +++ A4-­‐Insecure  Direct  Object  References + +++ A5-­‐Security  Misconfiguration + ++ A6-­‐Sensitive  Data  Exposure ++ + A7-­‐Missing  Function  Level  Access   Control + + A8-­‐Cross-­‐Site  Request  Forgery  (CSRF) ++ + A9-­‐Using  Components  with  Known   Vulnerabilities +++ A10-­‐Unvalidated  Redirects  and   Forwards + +
  • 71. Pentesting and  code  review  for  a   developer
  • 72. 10  reasons to  use  .... • Written in  Java  J • Integrated with CI  Tools   (Jenkins/Hudson/Bamboo) • Modular (plugins  by  languages) • Developer tools • Dashboard • OWASP  project J • Open-­‐Source  (and  commercial  too)
  • 75. LAST  BUT  NOT  LEAST....
  • 76. Lack  of  knowledge... String  myString =  "insecure"; myString.replace("i","1") //  do  Stuff
  • 77. Good  Try...but...catch  J public  class  BadCatch { public  void mymethodErr1()  { try { //do  Stuff }  catch  (SecurityException se){ System.err.println (se); } } }
  • 78. Nice  comments //  Pattern  to  match  the  string Pattern  myPattern =  "bword1W+(?:w+/W+){1,6}?word2b"; String  updated =  MYCONSTANT1.replaceAll(mypattern,  "$2"); //  i  iterate from 0  to  10 for  (int i=0;  i  <10  ;  i++)  { //  do  stuff myMethod(updated); }
  • 79. Unit  testing • In  computer  programming,  unit  testing is a  software  testing method by  which individual units of  source  code,  sets  of  one  or  more  computer  program   modules  together with associated control  data,  usage  procedures,  and   operating  procedures,  are  tested to  determine whether they are  fit  for  use..   (c)  Wikipedia