Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

9/3/2019
04:45 AM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
100%
0%

7 Steps to Web App Security

Emerging technologies are introducing entirely new ways to reach, act, and interact with people. That makes app security more important than ever.
Previous
1 of 8
Next

For more than two decades, Web apps were built with functionality in mind. Everything revolved around the user interface and how easy it was for users to access information and make online purchases.

No longer. The high-profile breaches of the past few years have shattered those assumptions, and companies can no longer trade off functionality for security. Today, both app security and privacy must be built into Web applications.

Setu Kulkarni, vice president of corporate strategy and business development at WhiteHat Security, says it all starts with CISOs explaining in clear terms what lackluster app security means to the company's bottom line.

And while it's important for CEOs to understand what's at stake in terms of lost revenue and brand reputation, security pros are the ones who have to "own" security, Kulkarni says. "That means moving from merely responding to breaches [to mainstreaming] security into IT project teams and the entire development process," he says.

This feature offers security pros some ideas for mainstreaming app security at their organizations. Security, after all, can't be an afterthought. It has to become a part of the company's culture, just as important to the product as quality control.

 

 

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
9/5/2019 | 6:37:13 PM
Look deeper into the Rabbit hole

 I do agree with the points you brought up to the public, we should follow these steps and do it rigoursly, but that this aspect only just scratches the surface (basically the explanations are general). I would say we should do the following:
  • Once we develop the SecDevOps teams, we should put them in specific groups (red, blue, green)
    • The red-team is responsible for identifying the possible openings in the application (create a bounty program - you had mentioned it, but internally - and then have your blue team to see if they can circumvent the security controls the red-team put in place, then the green team should look to validate if the red or blue teams identified a real vulnerability. Have the green team look up the vulnerability to see if it exists, if not, have the green team to create tools to punish the application for one final assault or Q/A session to ensure the application does not fall to external threats or buffer overflows
    • Linux - the teams should look deeper into using tools from MIT (SeLinux is one example) and determine if the tool is actually working to identify and thwart attacks (go to the "/var/log/audit/audit.log" (make sure "setenforce 1" and SeLinux is installed and working properly)
    • Windows - run "get-appxprovisionedpackage -online | out-gridview -passthru | remove-appxprovisionedpackage -online" to ensure Bing applications, games and other tools are not installed, if so, remove them or utilize Uninstaller from IoBit" (group policies are good but there are HIDS like "Comodo" that are invaluable when it comes to cyber protection at the endpoint
    • Look into performance and application optimization tools like CA or Extrahop to identify if the application is running at its optimal level, the tools will also help the user identify if there are holes in the development chain (utilize Agile Scrum methodologies but incorporate CMMI security procedures from Carnige Mellon, NIST and CoBIT
    • Mitre At&ck is another framework we should look into when it comes to "Priviledge escalation" - https://attack.mitre.org/tactics/TA0004/, this is an area that needs attention because it delves into the methods actors use to attack a subject (again this is just one of many)

Top 6 Cybersecurity Frameworks

We also need to look heavily into applications that monitor themselves; for example, AWS stated they were going to look into developing an application where it would determine if the configuration of the S3 or EBS (Elastic Block Stores) were configured wrong or with public access. This is the next level we need to start looking into (i.e. Machine Learning). We need to be conscious of bad data in and bad data out scenario, this needs to come from the vendor and the individuals who are working day today.

I do think the adoption of a language that is not on the top of the CVE list will help as well, there are some such as the "Open Vulnerability & Assessment Language", I particularly like Python for Linux and Powershell for Windows, especially when you are looking at specific vulnerable areas that exist inside DLL files and in the registry, (I have found that JSON seems to work much faster when using JSON right in the code itself).

"============================================="

Powershell
Write-Host " "
Write-Host "LSA Registry Entries"
Write-Host "--------------------"
Write-Host " "

$lsa = '{"registry":[
	{"Entry":"auditbaseobjects", "Value":"1", "Type":"Dword"},
	{"Entry":"auditbasedirectories", "Value":"1", "Type":"Dword"},
	{"Entry":"LmCompatibilityLevel", "Value":"4", "Type":"Dword"},
	{"Entry":"restrictanonymous", "Value":"1", "Type":"Dword"},
	{"Entry":"restrictanonymoussam", "Value":"1", "Type":"Dword"},
	{"Entry":"LimitBlankPasswordUse", "Value":"1", "Type":"Dword"},
    {"Entry":"SecureBoot", "Value":"1", "Type":"Dword"}
]}'

$path = "HKLM:\System\CurrentControlSet\Control\Lsa"
$regobj = ConvertFrom-Json -InputObject $lsa
$regobjects = $regobj.registry

foreach ( $i in $regobjects ) {
    $val = Get-ItemPropertyValue -Path $path -Name $i.Entry `
-ErrorAction SilentlyContinue if ( (Test-Path $path) -and ($i.Value -eq $val ) ) { Write-Host $i.Entry "registry value - ok" } else { #New-Item -path $path -Name $i.Entry -Value $i.Value -Type Dword $chg = Set-ItemProperty -Path $path -Name $i.Entry -Value $i.Value `
-Type $i.Type -Force $names = Get-ItemPropertyValue -Path $path -Name $i.Entry Write-Host $i.Entry "modified registry entry: " $names } }

 "============================================"

Just something to think about.

T
Cloud Security Threats for 2021
Or Azarzar, CTO & Co-Founder of Lightspin,  12/3/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27772
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could po...
CVE-2020-27773
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to appli...
CVE-2020-28950
PUBLISHED: 2020-12-04
The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.
CVE-2020-27774
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but co...
CVE-2020-27775
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but c...