Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

9/3/2019
04:45 AM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
100%
0%

7 Steps to Web App Security

Emerging technologies are introducing entirely new ways to reach, act, and interact with people. That makes app security more important than ever.
Previous
1 of 8
Next

Image Source: tashatuvango

Image Source: tashatuvango

For more than two decades, Web apps were built with functionality in mind. Everything revolved around the user interface and how easy it was for users to access information and make online purchases.

No longer. The high-profile breaches of the past few years have shattered those assumptions, and companies can no longer trade off functionality for security. Today, both app security and privacy must be built into Web applications.

Setu Kulkarni, vice president of corporate strategy and business development at WhiteHat Security, says it all starts with CISOs explaining in clear terms what lackluster app security means to the company's bottom line.

And while it's important for CEOs to understand what's at stake in terms of lost revenue and brand reputation, security pros are the ones who have to "own" security, Kulkarni says. "That means moving from merely responding to breaches [to mainstreaming] security into IT project teams and the entire development process," he says.

This feature offers security pros some ideas for mainstreaming app security at their organizations. Security, after all, can't be an afterthought. It has to become a part of the company's culture, just as important to the product as quality control.

 

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
9/5/2019 | 6:37:13 PM
Look deeper into the Rabbit hole

 I do agree with the points you brought up to the public, we should follow these steps and do it rigoursly, but that this aspect only just scratches the surface (basically the explanations are general). I would say we should do the following:
  • Once we develop the SecDevOps teams, we should put them in specific groups (red, blue, green)
    • The red-team is responsible for identifying the possible openings in the application (create a bounty program - you had mentioned it, but internally - and then have your blue team to see if they can circumvent the security controls the red-team put in place, then the green team should look to validate if the red or blue teams identified a real vulnerability. Have the green team look up the vulnerability to see if it exists, if not, have the green team to create tools to punish the application for one final assault or Q/A session to ensure the application does not fall to external threats or buffer overflows
    • Linux - the teams should look deeper into using tools from MIT (SeLinux is one example) and determine if the tool is actually working to identify and thwart attacks (go to the "/var/log/audit/audit.log" (make sure "setenforce 1" and SeLinux is installed and working properly)
    • Windows - run "get-appxprovisionedpackage -online | out-gridview -passthru | remove-appxprovisionedpackage -online" to ensure Bing applications, games and other tools are not installed, if so, remove them or utilize Uninstaller from IoBit" (group policies are good but there are HIDS like "Comodo" that are invaluable when it comes to cyber protection at the endpoint
    • Look into performance and application optimization tools like CA or Extrahop to identify if the application is running at its optimal level, the tools will also help the user identify if there are holes in the development chain (utilize Agile Scrum methodologies but incorporate CMMI security procedures from Carnige Mellon, NIST and CoBIT
    • Mitre At&ck is another framework we should look into when it comes to "Priviledge escalation" - https://attack.mitre.org/tactics/TA0004/, this is an area that needs attention because it delves into the methods actors use to attack a subject (again this is just one of many)

Top 6 Cybersecurity Frameworks

We also need to look heavily into applications that monitor themselves; for example, AWS stated they were going to look into developing an application where it would determine if the configuration of the S3 or EBS (Elastic Block Stores) were configured wrong or with public access. This is the next level we need to start looking into (i.e. Machine Learning). We need to be conscious of bad data in and bad data out scenario, this needs to come from the vendor and the individuals who are working day today.

I do think the adoption of a language that is not on the top of the CVE list will help as well, there are some such as the "Open Vulnerability & Assessment Language", I particularly like Python for Linux and Powershell for Windows, especially when you are looking at specific vulnerable areas that exist inside DLL files and in the registry, (I have found that JSON seems to work much faster when using JSON right in the code itself).

"============================================="

Powershell
Write-Host " "
Write-Host "LSA Registry Entries"
Write-Host "--------------------"
Write-Host " "

$lsa = '{"registry":[
	{"Entry":"auditbaseobjects", "Value":"1", "Type":"Dword"},
	{"Entry":"auditbasedirectories", "Value":"1", "Type":"Dword"},
	{"Entry":"LmCompatibilityLevel", "Value":"4", "Type":"Dword"},
	{"Entry":"restrictanonymous", "Value":"1", "Type":"Dword"},
	{"Entry":"restrictanonymoussam", "Value":"1", "Type":"Dword"},
	{"Entry":"LimitBlankPasswordUse", "Value":"1", "Type":"Dword"},
    {"Entry":"SecureBoot", "Value":"1", "Type":"Dword"}
]}'

$path = "HKLM:\System\CurrentControlSet\Control\Lsa"
$regobj = ConvertFrom-Json -InputObject $lsa
$regobjects = $regobj.registry

foreach ( $i in $regobjects ) {
    $val = Get-ItemPropertyValue -Path $path -Name $i.Entry `
-ErrorAction SilentlyContinue if ( (Test-Path $path) -and ($i.Value -eq $val ) ) { Write-Host $i.Entry "registry value - ok" } else { #New-Item -path $path -Name $i.Entry -Value $i.Value -Type Dword $chg = Set-ItemProperty -Path $path -Name $i.Entry -Value $i.Value `
-Type $i.Type -Force $names = Get-ItemPropertyValue -Path $path -Name $i.Entry Write-Host $i.Entry "modified registry entry: " $names } }

 "============================================"

Just something to think about.

T
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11931
PUBLISHED: 2019-11-14
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prio...
CVE-2019-18980
PUBLISHED: 2019-11-14
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The o...
CVE-2019-17391
PUBLISHED: 2019-11-14
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and sec...
CVE-2019-18651
PUBLISHED: 2019-11-14
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document to a user that the website trusts. The user needs to have ...
CVE-2019-18978
PUBLISHED: 2019-11-14
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.