SlideShare a Scribd company logo

42 minutes to secure your code....

Sebastien Gioria
Sebastien Gioria

The document presents a comprehensive overview of secure coding practices and principles, emphasizing the importance of protecting code and applications from various vulnerabilities such as SQL injection, cross-site scripting (XSS), and improper access control. It highlights numerous tools, techniques, and frameworks within the OWASP community aimed at enhancing application security, alongside best practices for authentication, session management, and input validation. The agenda also includes extensive discussions on architectural considerations and strategies to create secure code that adheres to industry standards.

Technology
1 of 79
Downloaded 40 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
42  minutes  to  secure  your  code…. Sébastien Gioria sebastien.gioria@owasp.org OWASP  France  Leader  &   Evangelist JUG  Summer  Camp 18  Septembre 2015 LaRochelle -­‐ France
Agenda • OWASP  ?   • Secure  Coding  ?   • 10  simply  principles  to  secure  code • Controlling  code  security   • Q&A  Beer  J 2
2 http://www.google.fr/#q=sebastien   gioria ‣OWASP  France  Leader  &  Founder  &   Evangelist,   ‣OWASP  ISO  Project  &  OWASP  SonarQube Project   Leader ‣Innovation  and  Technology  @Advens  &&     Application  Security  Expert Twitter  :@SPoint/@OWASP_France/@AppSecAcademy2 ‣Application  Security  group  leader  for  the   CLUSIF ‣Proud  father  of  youngs  kids  trying  to  hack  my   digital  life.   ‣Legal expert    for  Cour  of  Appeal of  Poitiers
4 Learn Contract Testing Design MaturityCode
OWASP  publications  !   • Publications  :   – Top10  Application  Security   Risk  ;  bestseller – Testing  Guide  ;  second   bestseller – OWASP  Cheat  Sheets  !!!   – Application  Security   Verification  Standard  ;  not  the   best  well  known  document – OpenSAMM :  improve  your   application  security – OWASP  Secure  Contract   Annex   – OWASP  Top10  for  ...  (mobile,   cloud,  privacy,  ...) • Tools  /  API – OWASP  Zed  Attack  Proxy  ;   replace  WebScarab with  a  lot   of  new  functionalities – OWASP  ESAPI  :  API  for   securing  your  Software – OWASP  AppSensor ;  a  IDS/IPS   in  the  heart  of  your  software – OWASP  Cornucoppia ;   application  security  play  with   cards – OWASP  Snake  and  ladder  :   play  Top10 and  many  more....
Secure  Coding  ?  
Yes,  this  is  you  !  
Some  Stats.... (c)  IBM  March  2014
Hackers  are  clever
Money, Money, Money
Be accurate
42 minutes to secure your code....
42 minutes to secure your code....
42 minutes to secure your code....
42 minutes to secure your code....
42 minutes to secure your code....
@Inject EntityManager em; @Transactional public  User  updateEmail(String   username,String email)  { TypedQuery<User>   q  =  em.createQuery( String.format(”update    Users  set  email  ‘%s’  where  username   =   '%s’",  email,  username), User.class); return  q.getSingleResult(); }
Parametrize !  don't Jeopardize !!! String  eMail=  request.getParameter("email")   ; String  userName=   request.getParameter("username"); //SQL PreparedStatement pstmt =  con.prepareStatement("update    Users  set  email  =  ?  where   username   =    ?);   pstmt.setString(1,   eMail);   pstmt.setString(2,   userName); //JPA Query  safeQuery =  entityManager.createQuery( "update  Users  u  SET  u.email =  ?1  WHERE  u.username =  ?2"); safeQuery.setParameter(1,   eMail)   ; safeQuery.setParameter(2,   userName); safeQuery.executeUpdate();
Moral  !   NEVER  re-­implements   security mechanisms  that  are   approuved in  a  core  library  !! This  is  the  same  thing  for  crypto  and  other  mechanisms  that  are  not  security....
public final class InsertEmployeeActionextends Action{ public ActionForward execute(ActionMappingmapping,ActionForm form, HttpServletRequest request,HttpServletResponseresponse)throws Exception{ Obj1 service= new Obj1(); ObjForm objForm = (ObjForm) form; InfoADT adt = new InfoADT(); BeanUtils.copyProperties(adt,objForm); String searchQuery= objForm.getqueryString(); String payload = objForm.getPayLoad(); try { service.doWork(adt); / /do somethingwith thedata ActionMessages messages = new ActionMessages(); ActionMessagemessage= new ActionMessage("success",adt.getName()); messages.add(ActionMessages.GLOBAL_MESSAGE,message); saveMessages(request, messages ); request.setAttribute("Record",adt); return (mapping.findForward("success")); } catch( DatabaseExceptionde) { ActionErrors errors = new ActionErrors(); ActionError error = new ActionError("error.employee.databaseException" + “Payload:“+payload); errors.add(ActionErrors.GLOBAL_ERROR,error ); saveErrors(request,errors ); return (mapping.findForward("error: "+ searchQuery)); } } } Spot  the  vuln(s)  !
XSS  risks • Session  Hijacking • Site  Defacement • Network  Scanning • Undermining  CSRF  Defenses • Site  Redirection/Phishing • Load  of  Remotely  Hosted  Scripts • Data  Theft • Keystroke  Logging • Attackers  using  XSS  more  frequently
<
&lt;
Encoding  Output Characters Decimal Hexadecimal HTML  Character   Set Unicode "  (double   quotation   marks) &#34; &#x22; &quot; u0022 '  (single   quotation  mark) &#39; &#x27; &apos; u0027 &  (ampersand) &#38; &#x26; &amp; u0026 <  (less  than) &#60; &#x3C; &lt; u003c >  (greater  than) &#62; &#x3E; &gt; u003e Safe  ways  to  represent  dangerous  characters  in  a  web  page
OWASP  Java  Encoder  Project https://www.owasp.org/index.php/OWASP_Java_Encoder_Project • No  third  party  libraries  or  configuration  necessary • This  code  was  designed  for  high-­availability/high-­ performance  encoding  functionality • Simple  drop-­in  encoding  functionality • Redesigned  for  performance • More  complete  API  (uri and  uri component  encoding,   etc)  in  some  regards. • Java  1.5+
(3)  Validate  All  Inputs
42 minutes to secure your code....
OWASP  HTML  Sanitizer  Project https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project • HTML  Sanitizer  written  in  Java  which  lets  you  include  HTML   authored  by  third-­parties  in  your  web  application  while  protecting   against  XSS.   • This  code  was  written  with  security  best  practices  in  mind,  has  an   extensive  test  suite,  and  has  undergone  adversarial  security  review   https://code.google.com/p/owasp-­java-­html-­ sanitizer/wiki/AttackReviewGroundRules.   • It  allows  for  simple  programmatic  POSITIVE  policy  configuration.   No  XML  config.   • Actively  maintained  by  Mike  Samuel  from  Google's  AppSec team!   • This  is  code  from  the  Caja project  that  was  donated  by  Google.  It   is  rather  high  performance  and  low  memory  utilization.  
• Upload  Verification – Filename   and  Size  validation   +  antivirus • Upload  Storage – Use  only  trusted  filenames  +  separate  domain • Beware  of  "special"  files – "crossdomain.xml"    or    "clientaccesspolicy.xml".   • Image  Upload  Verification – Enforce  proper  image  size  limits – Use  image  rewriting  libraries – Set  the  extension  of  the  stored  image  to  be  a  valid  image  extension – Ensure  the  detected  content  type  of  the  image  is  safe • Generic  Upload  Verification – Ensure  decompressed   size  of  file  <  maximum  size   – Ensure  that  an  uploaded   archive  matches  the  type  expected  (zip,  rar) – Ensure  structured  uploads   such  as  an  add-­on  follow  proper  standard
42 minutes to secure your code....
What  is  Access  Control? • Authorization  is  the  process  where  a  system  determines if  a  specific  user  has  access  to  a  resource • Permission:  Represents  app  behavior  only • Entitlement:  What  a  user  is  actually  allowed  to  do • Principle/User:  Who/what  you  are  entitling • Implicit  Role:    Named  permission,  user  associated – if  (user.isRole(“Manager”));; • Explicit  Role:  Named  permission,  resource  associated – if  (user.isAuthorized(“report:view:3324”);;
Access  Control  Anti-­Patterns • Hard-­coded  role  checks  in  application  code • Lack  of  centralized  access  control  logic • Untrusted  data  driving  access  control  decisions • Access  control  that  is  “open  by  default” • Lack  of  addressing  horizontal  access  control  in  a   standardized  way  (if  at  all) • Access  control  logic  that  needs  to  be  manually   added  to  every  endpoint  in  code • Access  Control  that  is  “sticky”  per  session • Access  Control  that  requires  per-­user  policy
Access  Controls  Impact • Loss  of  accountability – Attackers  maliciously  execute  actions  as  other  users – Attackers  maliciously  execute  higher  level  actions • Disclosure  of  confidential  data – Compromising  admin-­‐level  accounts  often  results  in   access  to  user’s  confidential  data • Data  tampering – Privilege  levels  do  not  distinguish  users  who  can  only   view  data  and  users  permitted  to  modify  data
void editProfile(User u, EditUser eu) { if (u.isManager()) { editUser(eu) } } HardCode Auth Rule
void editProfile(User u, EditUser eu) { if ((user.isManager() || user.isAdministrator() || user.isEditor()) && user.id() != 1132)) { // do stuff } } Policy  evolution....
36
Hard-­‐Coded  Roles • Makes  “proving”  the  policy  of  an  application   difficult  for  audit  or  Q/A  purposes • Any  time  access  control  policy  needs  to   change,  new  code  need  to  be  pushed • RBAC(http://en.wikipedia.org/wiki/Role-­‐ based_access_control)  is  often  not  granular   enough   • Fragile,  easy  to  make  mistakes
Never  Depend  on  Untrusted  Data • Never  trust  request  data  for  access  control  decisions • Never  make  access  control  decisions  in  JavaScript • Never  make  authorization  decisions  based  solely  on:   hidden  fields cookie  values form  parameters URL  parameters anything  else  from  the  request • Never  depend  on  the  order  of  values  sent  from  the  client
Best  Practice:  Centralized  AuthZ • Define  a  centralized  access  controller – ACLService.isAuthorized(PERMISSION_CONSTANT) – ACLService.assertAuthorized(PERMISSION_CONSTANT) • Access  control  decisions  go  through  these  simple   API’s • Centralized  logic  to  drive  policy  behavior  and   persistence • May  contain  data-­‐driven  access  control  policy   information
int userId= request.getInt(”userID"); //Best to get it from sessionID.... if (validateUser(userId) ) { if ( currentUser.isPermitted( ”module:function:" + userId) ) { log.info(userId + “are permitted to access ."); doStuff(userId); } else { log.info(userId + “ is notallowed to access!"); throw new AuthorizationException (userId); } } Should  be  like  this...
Establish  Authentication  and   Identity  Controls
1) Do  not  limit  the  type  of  characters  or  length   of  user  password  within  reason • Be  wary  of  systems  that  allow  unlimited  password   sizes  (Django DOS  Sept  2013) • 2)  Use  a  cryptographically  strong  credential-­‐specific   salt • 3)  Impose  difficult  verification   • on  the  attacker  and  defender  :  use  PBKDF2  or   script • on  only the  attacker  :  use  HMAC-­‐SHA-­‐256  
2)  Use  a  cryptographically  strong  credential-­‐ specific  salt • protect(  [salt]  +  [password]  ); • Use  a  32char  or  64char  salt  (actual  size  dependent   on  protection  function); • Do  not  depend  on  hiding,  splitting,  or  otherwise   obscuring  the  salt
3a)  Impose  difficult  verification  on  the  attacker   and  defender •PBKDF2([salt]  +  [password],  c=140,000);   •Use  PBKDF2 when  FIPS  certification  or  enterprise   support  on  many  platforms  is  required •Use  Scrypt where  resisting  any/all  hardware   accelerated  attacks  is  necessary  but  enterprise  support   and  scale  is  not.  (bcrypt is  also  a  reasonable  choice)
3b)  Impose  difficult  verification  on  only the   attacker   •HMAC-­‐SHA-­‐256(  [private  key],  [salt]  +  [password]  ) •Protect  this  key  as  any  private  key  using  best  practices •Store  the  key  outside  the  credential  store •Build  the  password-­‐to-­‐hash  conversion  as  a  separate   webservice (cryptograpic isolation).
Password1!
Require  2  identity  questions   <Last  name,  account  number,  email,  DOB <Enforce  lockout  policy Ask  one  or  more  good  security  questions <https://www.owasp.org/index.php/Choosing_and_Using_Security_ Questions_Cheat_Sheet Send  the  user  a  randomly  generated  token  via  out-­‐of-­‐band <app,  SMS  or  token   Verify  code  in  same  web  session <Enforce  lockout  policy Change  password <Enforce password policy Changing  Password
//import  java.security and  java.crypto and  java.util needed //  Based on  recommendation from NIST  SP800-­‐132.pdf public  class  PasswordEncryptionService { public  boolean authenticate(String  attemptedPassword,  byte[]  encryptedPassword,  byte[]  salt) throws NoSuchAlgorithmException,  InvalidKeySpecException { byte[]  encryptedAttemptedPassword =  getEncryptedPassword(attemptedPassword,  salt); return  Arrays.equals(encryptedPassword,  encryptedAttemptedPassword); } public  byte[]  getEncryptedPassword(String  password,  byte[]  salt) throws NoSuchAlgorithmException,  InvalidKeySpecException { String  algorithm =  "PBKDF2WithHmacSHA1’’;    //  SHA1  recommende by  nist int derivedKeyLength =  160; int iterations =  20000;  //  minimum  1000  its from NIST KeySpec spec =  new  PBEKeySpec(password.toCharArray(),  salt,  iterations,  derivedKeyLength); SecretKeyFactory f  =  SecretKeyFactory.getInstance(algorithm); return  f.generateSecret(spec).getEncoded(); } public  byte[]  generateSalt()  throws NoSuchAlgorithmException { SecureRandom random =  SecureRandom.getInstance("SHA1PRNG"); byte[]  salt =  new  byte[8]; random.nextBytes(salt); return  salt; SecurePasswordStorage
• Authentication  Cheat  Sheet – https://www.owasp.org/index.php/Authentication_Cheat_Sheet • Password  Storage  Cheat  Sheet – https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet • Forgot  Password  Cheat  Sheet – https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet • Session  Management  Cheat  Sheet – https://www.owasp.org/index.php/Session_Management_Cheat_Sheet • ASVS  AuthN and  Session  Requirements – https://www.owasp.org/index.php/OWASP_Application_Security_Verific ation_Standard_Project • Choose  Security  Questions – https://www.owasp.org/index.php/Choosing_and_Using_Security_Quest ions_Cheat_Sheet
42 minutes to secure your code....
• What  benefits  do  HTTPS  provide? – Confidentiality,  Integrity  and  Authenticity – Confidentiality:  Spy  cannot  view  your  data – Integrity:  Spy  cannot  change  your  data – Authenticity:  Server  you  are  visiting  is  the   right  one
Encryption  in  Transit  (HTTPS/TLS) • HTTPS  configuration  best  practices – https://www.owasp.org/index.php/Transport_L ayer_Protection_Cheat_Sheet – https://www.ssllabs.com/projects/best-­ practices/
• Certificate  Pinning – https://www.owasp.org/index.php/Pinning_Cheat_Sheet • HSTS  (Strict  Transport  Security) – http://www.youtube.com/watch?v=zEV3HOuM_Vw – Strict-­‐Transport-­‐Security:   max-­‐age=31536000 • Forward  Secrecy – https://whispersystems.org/blog/asynchronous-­‐security/ • Certificate  Creation  Transparency – http://certificate-­‐transparency.org • Browser  Certificate  Pruning – Etsy/Zane  Lackey
HSTS  – Strict  Transport  Security • HSTS  (Strict  Transport  Security) – http://www.youtube.com/watch?v=zEV3HOuM_Vw – Strict-­‐Transport-­‐Security:  max-­‐age=31536000;   includeSubdomains • Forces  browser  to  only  make  HTTPS  connection  to  server • Must  be  initially  delivered  over  a  HTTPS  connection
Intrusion  Detection  
Logs  and  errors
Risks  ?   • Error messages  can disclose information   valuable to  an  attacker • Failure can lead  to  an  unhandled state,  which can lead  to  denial of  service  – Unhandled failures can lead  to  malicious behavior being unnoticed
Fail  Securely  !   • Not  Just  catching  exception • Not  Just  logging  exception/errors Handle  all  failures  securely  and  return  the   system  to  a  proper  state  
Design  Patterns • Don't assume  that an  error condition  won't occur • It's what the  attackers want you to  assume   • Errors are  like accidents,  you don't expect them,  but  they happen • Any code  that can throw an  exception  should be in  a  Try Block   • Handle all  possible  exceptions   • Use  Finally Blocks:  leaving files  open  or  exceptions  defined after use  creates resource leaks and  possible  system  failure • Short  specific Try Blocks  give you more  control  over  the   error state  
App  Layer  Intrusion  Detection • Great  detection  points  to  start  with – Input  validation  failure  server  side  when  client  side   validation  exists – Input  validation  failure  server  side  on  non-­user   editable  parameters  such  as  hidden  fields,   checkboxes,  radio  buttons  or  select  lists – Forced  browsing  to  common  attack  entry  points   – Honeypot  URL  (e.g.  a  fake  path  listed  in  robots.txt like  e.g.  /admin/secretlogin.jsp)  
App  Layer  Intrusion  Detection • Others – Blatant  SQLi or  XSS  injection  attacks – Workflow  sequence  abuse  (e.g.  multi-­part  form  in   wrong  order) – Custom  business  logic  (e.g.  basket  vs catalogue   price  mismatch) – Further  Study: • “libinjection:  from  SQLi to  XSS” – Nick  Galbreath • “Attack  Driven  Defense”  – Zane  Lackey
OWASP  AppSensor (Java) • Project  and  mailing  list   https://www.owasp.org/index.php/OWASP_A ppSensor_Project • Four-­page  briefing,  Crosstalk,  Journal  of   Defense  Software  Engineering • http://www.crosstalkonline.org/storage/issue-­ archives/2011/201109/201109-­Watson.pdf
Security  Requirements
OWASP  ASVS https://www.owasp.org/index.php/C ategory:OWASP_Application_Security _Verification_Standard_Project
Bad  Design
Security  Architecture  and  Design Strategic  effort • Business,  technical  and  security  stakeholders   • Functional  and  non-­‐functional  security  properties • Different  flavors/efforts  based  on  SDL/culture Example:  state • Should  you  use  the  request?   • Should  you  use  a  web  session?   • Should  you  use  the  database?   These  decisions  have  dramatic  security  implications
Trusting  Input • Treating  all  client  side  data  as  untrusted  is   important,  and  can  be  tied  back  to  trust   zones/boundaries  in  design/architecture.   • Ideally  we  want  to  consider  all  tiers  to  be   untrusted  and  build  controls  at  all  layers,   but  this  is  not  practical  or  even  possible  for   some  very  large  systems.
Security  Architecture  and  Design Additional  Considerations • Overall  Architecture/Design • Trust  Zones/Boundaries/Tiers 1. User  Interface,    API  (Webservices),   2. Business  Layer  (Custom  Logic),   3. Data  Layer  (Keys  to  the  Kingdom) 4. What  sources  can/cannot  be  trusted? • What  is  inside/outside  of  a  trust  zone/boundary • Specific  controls  need  to  exist  at  certain  layers • Attack  Surface
Controlling  code  in  one  picture
Pentest or  code  review  for   CISO   Top10 Web Pentest Code  Review A1-­‐Injection ++ +++ A2-­‐Broken  Authentication  and  Session   Management ++ + A3-­‐Cross-­‐Site  Scripting  (XSS) +++ +++ A4-­‐Insecure  Direct  Object  References + +++ A5-­‐Security  Misconfiguration + ++ A6-­‐Sensitive  Data  Exposure ++ + A7-­‐Missing  Function  Level  Access   Control + + A8-­‐Cross-­‐Site  Request  Forgery  (CSRF) ++ + A9-­‐Using  Components  with  Known   Vulnerabilities +++ A10-­‐Unvalidated  Redirects  and   Forwards + +
Pentesting and  code  review  for  a   developer
10  reasons to  use  .... • Written in  Java  J • Integrated with CI  Tools   (Jenkins/Hudson/Bamboo) • Modular (plugins  by  languages) • Developer tools • Dashboard • OWASP  project J • Open-­‐Source  (and  commercial  too)
• https://www.owasp.org/index.php/OWASP_S onarQube_Project Of  Course  !  
License 7 4 • @SPoint • sebastien.gioria@owasp.org
LAST  BUT  NOT  LEAST....
Lack  of  knowledge... String  myString =  "insecure"; myString.replace("i","1") //  do  Stuff
Good  Try...but...catch  J public  class  BadCatch { public  void mymethodErr1()  { try { //do  Stuff }  catch  (SecurityException se){ System.err.println (se); } } }
Nice  comments //  Pattern  to  match  the  string Pattern  myPattern =  "bword1W+(?:w+/W+){1,6}?word2b"; String  updated =  MYCONSTANT1.replaceAll(mypattern,  "$2"); //  i  iterate from 0  to  10 for  (int i=0;  i  <10  ;  i++)  { //  do  stuff myMethod(updated); }
Unit  testing • In  computer  programming,  unit  testing is a  software  testing method by  which individual units of  source  code,  sets  of  one  or  more  computer  program   modules  together with associated control  data,  usage  procedures,  and   operating  procedures,  are  tested to  determine whether they are  fit  for  use..   (c)  Wikipedia

More Related Content

What's hot (16)

PPTX
OWASP
Pen Testeronyguy
 
PDF
[OWASP Poland Day] Security in developer's life
OWASP
 
PDF
HackFest 2015 - Rasp vs waf
IMMUNIO
 
PDF
(Un)safe Python
Ivan Tsyganov
 
PDF
SARCON Talk - Vandana Verma Sehgal
Vandana Verma
 
PDF
OISC 2019 - The OWASP Top 10 & AppSec Primer
ThreatReel Podcast
 
PDF
[OPD 2019] Top 10 Security Facts of 2020
OWASP
 
PDF
[OPD 2019] Governance as a missing part of IT security architecture
OWASP
 
PPT
Top Ten Proactive Web Security Controls v5
Jim Manico
 
PPTX
OpenSouthCode '19 - Application Security Fundamentals [2019-May-25]
AngelGomezRomero
 
PDF
David Thiel - Secure Development On iOS
Source Conference
 
PDF
[OWASP Poland Day] Embedding security into SDLC + GDPR
OWASP
 
PDF
OWASP Top 10 - The Ten Most Critical Web Application Security Risks
All Things Open
 
PDF
Making DevSecOps a Reality in your Spring Applications
Hdiv Security
 
PPTX
Database Firewall from Scratch
Denis Kolegov
 
PPTX
Simplify Dev with Complicated Security Tools
Kevin Fealey
 
OWASP
Pen Testeronyguy
 
[OWASP Poland Day] Security in developer's life
OWASP
 
HackFest 2015 - Rasp vs waf
IMMUNIO
 
(Un)safe Python
Ivan Tsyganov
 
SARCON Talk - Vandana Verma Sehgal
Vandana Verma
 
OISC 2019 - The OWASP Top 10 & AppSec Primer
ThreatReel Podcast
 
[OPD 2019] Top 10 Security Facts of 2020
OWASP
 
[OPD 2019] Governance as a missing part of IT security architecture
OWASP
 
Top Ten Proactive Web Security Controls v5
Jim Manico
 
OpenSouthCode '19 - Application Security Fundamentals [2019-May-25]
AngelGomezRomero
 
David Thiel - Secure Development On iOS
Source Conference
 
[OWASP Poland Day] Embedding security into SDLC + GDPR
OWASP
 
OWASP Top 10 - The Ten Most Critical Web Application Security Risks
All Things Open
 
Making DevSecOps a Reality in your Spring Applications
Hdiv Security
 
Database Firewall from Scratch
Denis Kolegov
 
Simplify Dev with Complicated Security Tools
Kevin Fealey
 

Similar to 42 minutes to secure your code.... (20)

PPTX
Cm3 secure code_training_1day_access_control
dcervigni
 
PDF
OWASP Top 10 List Overview for Web Developers
Benjamin Floyd
 
PPTX
Access Control Pitfalls v2
Jim Manico
 
PDF
How to avoid top 10 security risks in Java EE applications and how to avoid them
Masoud Kalali
 
PPTX
Securing your web applications a pragmatic approach
Antonio Parata
 
PPTX
Ten Commandments of Secure Coding - OWASP Top Ten Proactive Controls
SecuRing
 
PPTX
Ten Commandments of Secure Coding
Mateusz Olejarka
 
PDF
Secure coding presentation Oct 3 2020
Moataz Kamel
 
PDF
OWASP Top 10
Arthur Shvetsov
 
PDF
Steps to mitigate Top 5 OWASP Vulnerabilities 2013
Jayasree Veliyath
 
PDF
OWASP Top 10 Proactive Control 2016 (C5-C10)
Narudom Roongsiriwong, CISSP
 
PPT
Web application development_dos_and_donts
huynhvanphuc
 
PDF
Application Security - Your Success Depends on it
WSO2
 
PPT
Secure code practices
Hina Rawal
 
PPTX
OWASP Top Ten 2017
Michael Furman
 
PDF
API Security Best Practices and Guidelines
WSO2
 
PPTX
The path of secure software by Katy Anton
DevSecCon
 
PPTX
Owasp 2017 oveview
Shreyas N
 
PDF
Authorisation: Concepts and Implementation
Omar Bashir
 
PPTX
OWASP_Top_Ten_Proactive_Controls_v2.pptx
FernandoVizer
 
Cm3 secure code_training_1day_access_control
dcervigni
 
OWASP Top 10 List Overview for Web Developers
Benjamin Floyd
 
Access Control Pitfalls v2
Jim Manico
 
How to avoid top 10 security risks in Java EE applications and how to avoid them
Masoud Kalali
 
Securing your web applications a pragmatic approach
Antonio Parata
 
Ten Commandments of Secure Coding - OWASP Top Ten Proactive Controls
SecuRing
 
Ten Commandments of Secure Coding
Mateusz Olejarka
 
Secure coding presentation Oct 3 2020
Moataz Kamel
 
OWASP Top 10
Arthur Shvetsov
 
Steps to mitigate Top 5 OWASP Vulnerabilities 2013
Jayasree Veliyath
 
OWASP Top 10 Proactive Control 2016 (C5-C10)
Narudom Roongsiriwong, CISSP
 
Web application development_dos_and_donts
huynhvanphuc
 
Application Security - Your Success Depends on it
WSO2
 
Secure code practices
Hina Rawal
 
OWASP Top Ten 2017
Michael Furman
 
API Security Best Practices and Guidelines
WSO2
 
The path of secure software by Katy Anton
DevSecCon
 
Owasp 2017 oveview
Shreyas N
 
Authorisation: Concepts and Implementation
Omar Bashir
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
FernandoVizer
 
Ad

More from Sebastien Gioria (8)

PDF
La Sécurité des CMS ?
Sebastien Gioria
 
PDF
2015 09-18-jug summer camp
Sebastien Gioria
 
PDF
Securing your API and mobile application - API Connection FR
Sebastien Gioria
 
PDF
La Quete du code source fiable et sécurisé - GSDAYS 2015
Sebastien Gioria
 
PDF
2014 06-05-mozilla-afup
Sebastien Gioria
 
PDF
Sécurité des applications mobiles
Sebastien Gioria
 
PPTX
Securite des Applications dans le Cloud
Sebastien Gioria
 
PDF
Secure Coding for Java - An introduction
Sebastien Gioria
 
La Sécurité des CMS ?
Sebastien Gioria
 
2015 09-18-jug summer camp
Sebastien Gioria
 
Securing your API and mobile application - API Connection FR
Sebastien Gioria
 
La Quete du code source fiable et sécurisé - GSDAYS 2015
Sebastien Gioria
 
2014 06-05-mozilla-afup
Sebastien Gioria
 
Sécurité des applications mobiles
Sebastien Gioria
 
Securite des Applications dans le Cloud
Sebastien Gioria
 
Secure Coding for Java - An introduction
Sebastien Gioria
 
Ad

Recently uploaded (20)

PDF
Impact of IEEE Computer Society in Advancing Emerging Technologies including ...
Hironori Washizaki
 
PDF
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
PDF
SFWelly Summer 25 Release Highlights July 2025
Anna Loughnan Colquhoun
 
PDF
Building Resilience with Digital Twins : Lessons from Korea
SANGHEE SHIN
 
PDF
Fl Studio 24.2.2 Build 4597 Crack for Windows Free Download 2025
faizk77g
 
PDF
NewMind AI Journal - Weekly Chronicles - July'25 Week II
NewMind AI
 
PPTX
OpenID AuthZEN - Analyst Briefing July 2025
David Brossard
 
PPTX
AUTOMATION AND ROBOTICS IN PHARMA INDUSTRY.pptx
sameeraaabegumm
 
PDF
Jak MŚP w Europie Środkowo-Wschodniej odnajdują się w świecie AI
dominikamizerska1
 
PDF
Predicting the unpredictable: re-engineering recommendation algorithms for fr...
Speck&Tech
 
PDF
Smart Trailers 2025 Update with History and Overview
Paul Menig
 
PDF
Wojciech Ciemski for Top Cyber News MAGAZINE. June 2025
Dr. Ludmila Morozova-Buss
 
PPTX
WooCommerce Workshop: Bring Your Laptop
Laura Hartwig
 
PDF
Achieving Consistent and Reliable AI Code Generation - Medusa AI
medusaaico
 
PDF
Log-Based Anomaly Detection: Enhancing System Reliability with Machine Learning
Mohammed BEKKOUCHE
 
PDF
Blockchain Transactions Explained For Everyone
CIFDAQ
 
PPTX
UiPath Academic Alliance Educator Panels: Session 2 - Business Analyst Content
DianaGray10
 
PDF
Smart Air Quality Monitoring with Serrax AQM190 LITE
SERRAX TECHNOLOGIES LLP
 
PDF
LLMs.txt: Easily Control How AI Crawls Your Site
Keploy
 
PDF
CIFDAQ Token Spotlight for 9th July 2025
CIFDAQ
 
Impact of IEEE Computer Society in Advancing Emerging Technologies including ...
Hironori Washizaki
 
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
SFWelly Summer 25 Release Highlights July 2025
Anna Loughnan Colquhoun
 
Building Resilience with Digital Twins : Lessons from Korea
SANGHEE SHIN
 
Fl Studio 24.2.2 Build 4597 Crack for Windows Free Download 2025
faizk77g
 
NewMind AI Journal - Weekly Chronicles - July'25 Week II
NewMind AI
 
OpenID AuthZEN - Analyst Briefing July 2025
David Brossard
 
AUTOMATION AND ROBOTICS IN PHARMA INDUSTRY.pptx
sameeraaabegumm
 
Jak MŚP w Europie Środkowo-Wschodniej odnajdują się w świecie AI
dominikamizerska1
 
Predicting the unpredictable: re-engineering recommendation algorithms for fr...
Speck&Tech
 
Smart Trailers 2025 Update with History and Overview
Paul Menig
 
Wojciech Ciemski for Top Cyber News MAGAZINE. June 2025
Dr. Ludmila Morozova-Buss
 
WooCommerce Workshop: Bring Your Laptop
Laura Hartwig
 
Achieving Consistent and Reliable AI Code Generation - Medusa AI
medusaaico
 
Log-Based Anomaly Detection: Enhancing System Reliability with Machine Learning
Mohammed BEKKOUCHE
 
Blockchain Transactions Explained For Everyone
CIFDAQ
 
UiPath Academic Alliance Educator Panels: Session 2 - Business Analyst Content
DianaGray10
 
Smart Air Quality Monitoring with Serrax AQM190 LITE
SERRAX TECHNOLOGIES LLP
 
LLMs.txt: Easily Control How AI Crawls Your Site
Keploy
 
CIFDAQ Token Spotlight for 9th July 2025
CIFDAQ
 

42 minutes to secure your code....

  • 1. 42  minutes  to  secure  your  code…. Sébastien Gioria [email protected] OWASP  France  Leader  &   Evangelist JUG  Summer  Camp 18  Septembre 2015 LaRochelle -­‐ France
  • 2. Agenda • OWASP  ?   • Secure  Coding  ?   • 10  simply  principles  to  secure  code • Controlling  code  security   • Q&A  Beer  J 2
  • 3. 2 http://www.google.fr/#q=sebastien   gioria ‣OWASP  France  Leader  &  Founder  &   Evangelist,   ‣OWASP  ISO  Project  &  OWASP  SonarQube Project   Leader ‣Innovation  and  Technology  @Advens  &&     Application  Security  Expert Twitter  :@SPoint/@OWASP_France/@AppSecAcademy2 ‣Application  Security  group  leader  for  the   CLUSIF ‣Proud  father  of  youngs  kids  trying  to  hack  my   digital  life.   ‣Legal expert    for  Cour  of  Appeal of  Poitiers
  • 5. OWASP  publications  !   • Publications  :   – Top10  Application  Security   Risk  ;  bestseller – Testing  Guide  ;  second   bestseller – OWASP  Cheat  Sheets  !!!   – Application  Security   Verification  Standard  ;  not  the   best  well  known  document – OpenSAMM :  improve  your   application  security – OWASP  Secure  Contract   Annex   – OWASP  Top10  for  ...  (mobile,   cloud,  privacy,  ...) • Tools  /  API – OWASP  Zed  Attack  Proxy  ;   replace  WebScarab with  a  lot   of  new  functionalities – OWASP  ESAPI  :  API  for   securing  your  Software – OWASP  AppSensor ;  a  IDS/IPS   in  the  heart  of  your  software – OWASP  Cornucoppia ;   application  security  play  with   cards – OWASP  Snake  and  ladder  :   play  Top10 and  many  more....
  • 7. Yes,  this  is  you  !  
  • 8. Some  Stats.... (c)  IBM  March  2014
  • 17. @Inject EntityManager em; @Transactional public  User  updateEmail(String   username,String email)  { TypedQuery<User>   q  =  em.createQuery( String.format(”update    Users  set  email  ‘%s’  where  username   =   '%s’",  email,  username), User.class); return  q.getSingleResult(); }
  • 18. Parametrize !  don't Jeopardize !!! String  eMail=  request.getParameter("email")   ; String  userName=   request.getParameter("username"); //SQL PreparedStatement pstmt =  con.prepareStatement("update    Users  set  email  =  ?  where   username   =    ?);   pstmt.setString(1,   eMail);   pstmt.setString(2,   userName); //JPA Query  safeQuery =  entityManager.createQuery( "update  Users  u  SET  u.email =  ?1  WHERE  u.username =  ?2"); safeQuery.setParameter(1,   eMail)   ; safeQuery.setParameter(2,   userName); safeQuery.executeUpdate();
  • 19. Moral  !   NEVER  re-­implements   security mechanisms  that  are   approuved in  a  core  library  !! This  is  the  same  thing  for  crypto  and  other  mechanisms  that  are  not  security....
  • 20. public final class InsertEmployeeActionextends Action{ public ActionForward execute(ActionMappingmapping,ActionForm form, HttpServletRequest request,HttpServletResponseresponse)throws Exception{ Obj1 service= new Obj1(); ObjForm objForm = (ObjForm) form; InfoADT adt = new InfoADT(); BeanUtils.copyProperties(adt,objForm); String searchQuery= objForm.getqueryString(); String payload = objForm.getPayLoad(); try { service.doWork(adt); / /do somethingwith thedata ActionMessages messages = new ActionMessages(); ActionMessagemessage= new ActionMessage("success",adt.getName()); messages.add(ActionMessages.GLOBAL_MESSAGE,message); saveMessages(request, messages ); request.setAttribute("Record",adt); return (mapping.findForward("success")); } catch( DatabaseExceptionde) { ActionErrors errors = new ActionErrors(); ActionError error = new ActionError("error.employee.databaseException" + “Payload:“+payload); errors.add(ActionErrors.GLOBAL_ERROR,error ); saveErrors(request,errors ); return (mapping.findForward("error: "+ searchQuery)); } } } Spot  the  vuln(s)  !
  • 21. XSS  risks • Session  Hijacking • Site  Defacement • Network  Scanning • Undermining  CSRF  Defenses • Site  Redirection/Phishing • Load  of  Remotely  Hosted  Scripts • Data  Theft • Keystroke  Logging • Attackers  using  XSS  more  frequently
  • 22. <
  • 23. &lt;
  • 24. Encoding  Output Characters Decimal Hexadecimal HTML  Character   Set Unicode "  (double   quotation   marks) &#34; &#x22; &quot; u0022 '  (single   quotation  mark) &#39; &#x27; &apos; u0027 &  (ampersand) &#38; &#x26; &amp; u0026 <  (less  than) &#60; &#x3C; &lt; u003c >  (greater  than) &#62; &#x3E; &gt; u003e Safe  ways  to  represent  dangerous  characters  in  a  web  page
  • 25. OWASP  Java  Encoder  Project https://www.owasp.org/index.php/OWASP_Java_Encoder_Project • No  third  party  libraries  or  configuration  necessary • This  code  was  designed  for  high-­availability/high-­ performance  encoding  functionality • Simple  drop-­in  encoding  functionality • Redesigned  for  performance • More  complete  API  (uri and  uri component  encoding,   etc)  in  some  regards. • Java  1.5+
  • 28. OWASP  HTML  Sanitizer  Project https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project • HTML  Sanitizer  written  in  Java  which  lets  you  include  HTML   authored  by  third-­parties  in  your  web  application  while  protecting   against  XSS.   • This  code  was  written  with  security  best  practices  in  mind,  has  an   extensive  test  suite,  and  has  undergone  adversarial  security  review   https://code.google.com/p/owasp-­java-­html-­ sanitizer/wiki/AttackReviewGroundRules.   • It  allows  for  simple  programmatic  POSITIVE  policy  configuration.   No  XML  config.   • Actively  maintained  by  Mike  Samuel  from  Google's  AppSec team!   • This  is  code  from  the  Caja project  that  was  donated  by  Google.  It   is  rather  high  performance  and  low  memory  utilization.  
  • 29. • Upload  Verification – Filename   and  Size  validation   +  antivirus • Upload  Storage – Use  only  trusted  filenames  +  separate  domain • Beware  of  "special"  files – "crossdomain.xml"    or    "clientaccesspolicy.xml".   • Image  Upload  Verification – Enforce  proper  image  size  limits – Use  image  rewriting  libraries – Set  the  extension  of  the  stored  image  to  be  a  valid  image  extension – Ensure  the  detected  content  type  of  the  image  is  safe • Generic  Upload  Verification – Ensure  decompressed   size  of  file  <  maximum  size   – Ensure  that  an  uploaded   archive  matches  the  type  expected  (zip,  rar) – Ensure  structured  uploads   such  as  an  add-­on  follow  proper  standard
  • 31. What  is  Access  Control? • Authorization  is  the  process  where  a  system  determines if  a  specific  user  has  access  to  a  resource • Permission:  Represents  app  behavior  only • Entitlement:  What  a  user  is  actually  allowed  to  do • Principle/User:  Who/what  you  are  entitling • Implicit  Role:    Named  permission,  user  associated – if  (user.isRole(“Manager”));; • Explicit  Role:  Named  permission,  resource  associated – if  (user.isAuthorized(“report:view:3324”);;
  • 32. Access  Control  Anti-­Patterns • Hard-­coded  role  checks  in  application  code • Lack  of  centralized  access  control  logic • Untrusted  data  driving  access  control  decisions • Access  control  that  is  “open  by  default” • Lack  of  addressing  horizontal  access  control  in  a   standardized  way  (if  at  all) • Access  control  logic  that  needs  to  be  manually   added  to  every  endpoint  in  code • Access  Control  that  is  “sticky”  per  session • Access  Control  that  requires  per-­user  policy
  • 33. Access  Controls  Impact • Loss  of  accountability – Attackers  maliciously  execute  actions  as  other  users – Attackers  maliciously  execute  higher  level  actions • Disclosure  of  confidential  data – Compromising  admin-­‐level  accounts  often  results  in   access  to  user’s  confidential  data • Data  tampering – Privilege  levels  do  not  distinguish  users  who  can  only   view  data  and  users  permitted  to  modify  data
  • 34. void editProfile(User u, EditUser eu) { if (u.isManager()) { editUser(eu) } } HardCode Auth Rule
  • 35. void editProfile(User u, EditUser eu) { if ((user.isManager() || user.isAdministrator() || user.isEditor()) && user.id() != 1132)) { // do stuff } } Policy  evolution....
  • 36. 36
  • 37. Hard-­‐Coded  Roles • Makes  “proving”  the  policy  of  an  application   difficult  for  audit  or  Q/A  purposes • Any  time  access  control  policy  needs  to   change,  new  code  need  to  be  pushed • RBAC(http://en.wikipedia.org/wiki/Role-­‐ based_access_control)  is  often  not  granular   enough   • Fragile,  easy  to  make  mistakes
  • 38. Never  Depend  on  Untrusted  Data • Never  trust  request  data  for  access  control  decisions • Never  make  access  control  decisions  in  JavaScript • Never  make  authorization  decisions  based  solely  on:   hidden  fields cookie  values form  parameters URL  parameters anything  else  from  the  request • Never  depend  on  the  order  of  values  sent  from  the  client
  • 39. Best  Practice:  Centralized  AuthZ • Define  a  centralized  access  controller – ACLService.isAuthorized(PERMISSION_CONSTANT) – ACLService.assertAuthorized(PERMISSION_CONSTANT) • Access  control  decisions  go  through  these  simple   API’s • Centralized  logic  to  drive  policy  behavior  and   persistence • May  contain  data-­‐driven  access  control  policy   information
  • 40. int userId= request.getInt(”userID"); //Best to get it from sessionID.... if (validateUser(userId) ) { if ( currentUser.isPermitted( ”module:function:" + userId) ) { log.info(userId + “are permitted to access ."); doStuff(userId); } else { log.info(userId + “ is notallowed to access!"); throw new AuthorizationException (userId); } } Should  be  like  this...
  • 41. Establish  Authentication  and   Identity  Controls
  • 42. 1) Do  not  limit  the  type  of  characters  or  length   of  user  password  within  reason • Be  wary  of  systems  that  allow  unlimited  password   sizes  (Django DOS  Sept  2013) • 2)  Use  a  cryptographically  strong  credential-­‐specific   salt • 3)  Impose  difficult  verification   • on  the  attacker  and  defender  :  use  PBKDF2  or   script • on  only the  attacker  :  use  HMAC-­‐SHA-­‐256  
  • 43. 2)  Use  a  cryptographically  strong  credential-­‐ specific  salt • protect(  [salt]  +  [password]  ); • Use  a  32char  or  64char  salt  (actual  size  dependent   on  protection  function); • Do  not  depend  on  hiding,  splitting,  or  otherwise   obscuring  the  salt
  • 44. 3a)  Impose  difficult  verification  on  the  attacker   and  defender •PBKDF2([salt]  +  [password],  c=140,000);   •Use  PBKDF2 when  FIPS  certification  or  enterprise   support  on  many  platforms  is  required •Use  Scrypt where  resisting  any/all  hardware   accelerated  attacks  is  necessary  but  enterprise  support   and  scale  is  not.  (bcrypt is  also  a  reasonable  choice)
  • 45. 3b)  Impose  difficult  verification  on  only the   attacker   •HMAC-­‐SHA-­‐256(  [private  key],  [salt]  +  [password]  ) •Protect  this  key  as  any  private  key  using  best  practices •Store  the  key  outside  the  credential  store •Build  the  password-­‐to-­‐hash  conversion  as  a  separate   webservice (cryptograpic isolation).
  • 47. Require  2  identity  questions   <Last  name,  account  number,  email,  DOB <Enforce  lockout  policy Ask  one  or  more  good  security  questions <https://www.owasp.org/index.php/Choosing_and_Using_Security_ Questions_Cheat_Sheet Send  the  user  a  randomly  generated  token  via  out-­‐of-­‐band <app,  SMS  or  token   Verify  code  in  same  web  session <Enforce  lockout  policy Change  password <Enforce password policy Changing  Password
  • 48. //import  java.security and  java.crypto and  java.util needed //  Based on  recommendation from NIST  SP800-­‐132.pdf public  class  PasswordEncryptionService { public  boolean authenticate(String  attemptedPassword,  byte[]  encryptedPassword,  byte[]  salt) throws NoSuchAlgorithmException,  InvalidKeySpecException { byte[]  encryptedAttemptedPassword =  getEncryptedPassword(attemptedPassword,  salt); return  Arrays.equals(encryptedPassword,  encryptedAttemptedPassword); } public  byte[]  getEncryptedPassword(String  password,  byte[]  salt) throws NoSuchAlgorithmException,  InvalidKeySpecException { String  algorithm =  "PBKDF2WithHmacSHA1’’;    //  SHA1  recommende by  nist int derivedKeyLength =  160; int iterations =  20000;  //  minimum  1000  its from NIST KeySpec spec =  new  PBEKeySpec(password.toCharArray(),  salt,  iterations,  derivedKeyLength); SecretKeyFactory f  =  SecretKeyFactory.getInstance(algorithm); return  f.generateSecret(spec).getEncoded(); } public  byte[]  generateSalt()  throws NoSuchAlgorithmException { SecureRandom random =  SecureRandom.getInstance("SHA1PRNG"); byte[]  salt =  new  byte[8]; random.nextBytes(salt); return  salt; SecurePasswordStorage
  • 49. • Authentication  Cheat  Sheet – https://www.owasp.org/index.php/Authentication_Cheat_Sheet • Password  Storage  Cheat  Sheet – https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet • Forgot  Password  Cheat  Sheet – https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet • Session  Management  Cheat  Sheet – https://www.owasp.org/index.php/Session_Management_Cheat_Sheet • ASVS  AuthN and  Session  Requirements – https://www.owasp.org/index.php/OWASP_Application_Security_Verific ation_Standard_Project • Choose  Security  Questions – https://www.owasp.org/index.php/Choosing_and_Using_Security_Quest ions_Cheat_Sheet
  • 51. • What  benefits  do  HTTPS  provide? – Confidentiality,  Integrity  and  Authenticity – Confidentiality:  Spy  cannot  view  your  data – Integrity:  Spy  cannot  change  your  data – Authenticity:  Server  you  are  visiting  is  the   right  one
  • 52. Encryption  in  Transit  (HTTPS/TLS) • HTTPS  configuration  best  practices – https://www.owasp.org/index.php/Transport_L ayer_Protection_Cheat_Sheet – https://www.ssllabs.com/projects/best-­ practices/
  • 53. • Certificate  Pinning – https://www.owasp.org/index.php/Pinning_Cheat_Sheet • HSTS  (Strict  Transport  Security) – http://www.youtube.com/watch?v=zEV3HOuM_Vw – Strict-­‐Transport-­‐Security:   max-­‐age=31536000 • Forward  Secrecy – https://whispersystems.org/blog/asynchronous-­‐security/ • Certificate  Creation  Transparency – http://certificate-­‐transparency.org • Browser  Certificate  Pruning – Etsy/Zane  Lackey
  • 54. HSTS  – Strict  Transport  Security • HSTS  (Strict  Transport  Security) – http://www.youtube.com/watch?v=zEV3HOuM_Vw – Strict-­‐Transport-­‐Security:  max-­‐age=31536000;   includeSubdomains • Forces  browser  to  only  make  HTTPS  connection  to  server • Must  be  initially  delivered  over  a  HTTPS  connection
  • 57. Risks  ?   • Error messages  can disclose information   valuable to  an  attacker • Failure can lead  to  an  unhandled state,  which can lead  to  denial of  service  – Unhandled failures can lead  to  malicious behavior being unnoticed
  • 58. Fail  Securely  !   • Not  Just  catching  exception • Not  Just  logging  exception/errors Handle  all  failures  securely  and  return  the   system  to  a  proper  state  
  • 59. Design  Patterns • Don't assume  that an  error condition  won't occur • It's what the  attackers want you to  assume   • Errors are  like accidents,  you don't expect them,  but  they happen • Any code  that can throw an  exception  should be in  a  Try Block   • Handle all  possible  exceptions   • Use  Finally Blocks:  leaving files  open  or  exceptions  defined after use  creates resource leaks and  possible  system  failure • Short  specific Try Blocks  give you more  control  over  the   error state  
  • 60. App  Layer  Intrusion  Detection • Great  detection  points  to  start  with – Input  validation  failure  server  side  when  client  side   validation  exists – Input  validation  failure  server  side  on  non-­user   editable  parameters  such  as  hidden  fields,   checkboxes,  radio  buttons  or  select  lists – Forced  browsing  to  common  attack  entry  points   – Honeypot  URL  (e.g.  a  fake  path  listed  in  robots.txt like  e.g.  /admin/secretlogin.jsp)  
  • 61. App  Layer  Intrusion  Detection • Others – Blatant  SQLi or  XSS  injection  attacks – Workflow  sequence  abuse  (e.g.  multi-­part  form  in   wrong  order) – Custom  business  logic  (e.g.  basket  vs catalogue   price  mismatch) – Further  Study: • “libinjection:  from  SQLi to  XSS” – Nick  Galbreath • “Attack  Driven  Defense”  – Zane  Lackey
  • 62. OWASP  AppSensor (Java) • Project  and  mailing  list   https://www.owasp.org/index.php/OWASP_A ppSensor_Project • Four-­page  briefing,  Crosstalk,  Journal  of   Defense  Software  Engineering • http://www.crosstalkonline.org/storage/issue-­ archives/2011/201109/201109-­Watson.pdf
  • 66. Security  Architecture  and  Design Strategic  effort • Business,  technical  and  security  stakeholders   • Functional  and  non-­‐functional  security  properties • Different  flavors/efforts  based  on  SDL/culture Example:  state • Should  you  use  the  request?   • Should  you  use  a  web  session?   • Should  you  use  the  database?   These  decisions  have  dramatic  security  implications
  • 67. Trusting  Input • Treating  all  client  side  data  as  untrusted  is   important,  and  can  be  tied  back  to  trust   zones/boundaries  in  design/architecture.   • Ideally  we  want  to  consider  all  tiers  to  be   untrusted  and  build  controls  at  all  layers,   but  this  is  not  practical  or  even  possible  for   some  very  large  systems.
  • 68. Security  Architecture  and  Design Additional  Considerations • Overall  Architecture/Design • Trust  Zones/Boundaries/Tiers 1. User  Interface,    API  (Webservices),   2. Business  Layer  (Custom  Logic),   3. Data  Layer  (Keys  to  the  Kingdom) 4. What  sources  can/cannot  be  trusted? • What  is  inside/outside  of  a  trust  zone/boundary • Specific  controls  need  to  exist  at  certain  layers • Attack  Surface
  • 69. Controlling  code  in  one  picture
  • 70. Pentest or  code  review  for   CISO   Top10 Web Pentest Code  Review A1-­‐Injection ++ +++ A2-­‐Broken  Authentication  and  Session   Management ++ + A3-­‐Cross-­‐Site  Scripting  (XSS) +++ +++ A4-­‐Insecure  Direct  Object  References + +++ A5-­‐Security  Misconfiguration + ++ A6-­‐Sensitive  Data  Exposure ++ + A7-­‐Missing  Function  Level  Access   Control + + A8-­‐Cross-­‐Site  Request  Forgery  (CSRF) ++ + A9-­‐Using  Components  with  Known   Vulnerabilities +++ A10-­‐Unvalidated  Redirects  and   Forwards + +
  • 71. Pentesting and  code  review  for  a   developer
  • 72. 10  reasons to  use  .... • Written in  Java  J • Integrated with CI  Tools   (Jenkins/Hudson/Bamboo) • Modular (plugins  by  languages) • Developer tools • Dashboard • OWASP  project J • Open-­‐Source  (and  commercial  too)
  • 75. LAST  BUT  NOT  LEAST....
  • 76. Lack  of  knowledge... String  myString =  "insecure"; myString.replace("i","1") //  do  Stuff
  • 77. Good  Try...but...catch  J public  class  BadCatch { public  void mymethodErr1()  { try { //do  Stuff }  catch  (SecurityException se){ System.err.println (se); } } }
  • 78. Nice  comments //  Pattern  to  match  the  string Pattern  myPattern =  "bword1W+(?:w+/W+){1,6}?word2b"; String  updated =  MYCONSTANT1.replaceAll(mypattern,  "$2"); //  i  iterate from 0  to  10 for  (int i=0;  i  <10  ;  i++)  { //  do  stuff myMethod(updated); }
  • 79. Unit  testing • In  computer  programming,  unit  testing is a  software  testing method by  which individual units of  source  code,  sets  of  one  or  more  computer  program   modules  together with associated control  data,  usage  procedures,  and   operating  procedures,  are  tested to  determine whether they are  fit  for  use..   (c)  Wikipedia