The Secure SDLC Panel Real answers from real experience
OWASP Czech Republic Chapter Meeting The OWASP Foundation http://www.owasp.org OpenSAMM Software Assurance Maturity Model Seba Deleersnyder [email protected] OWASP Foundation Board Member OWASP Belgium Chapter Leader SAMM project co-leader Billing APPLICATION ATTACK Human Resrcs Custom Developed Application Code Directories Your security perimeter has huge holes at the application layer Databases Legacy Systems Web Services Application Layer The web application security challenge Web Server Hardened OS Firewall Firewall
Network Layer App Server You cant use network layer protection (firewall, SSL, IDS, hardening) to stop or detect application layer attacks D B T SAMM Build in software assurance proactive reactive security coding guidelines security testing requirements / code reviews dynamic test threat modeling static test tools tools Design Build Test Secure Development Lifecycle (SAMM) 3 vulnerability scanning WAF Production P CLASP Comprehensive, Lightweight Application Security Process Centered around 7 AppSec Best Practices
Cover the entire software lifecycle (not just development) Adaptable to any development process Defines roles across the SDLC 24 role-based process components Start small and dial-in to your needs Microsoft SDL Built internally for MS software Extended and made public for others MS-only versions since public release Touchpoints Gary McGraws and Cigitals model BSIMM Gary McGraws and Cigitals model Quantifies activities of software security initiatives of 51 firms Derived from SAMM beta BSI MM SAMM BSI MM Code SAMM Code SMCode 3.2 - Code SM 3.2 - T 3.3 3.3 CRT1.1 CR- 1.A 1.A CRCR 1.21.1 CRCR 1.B 1.B CRCR 1.41.2 CRCR 2.A 2.A CRCR 3.11.4 CRCR 3.A 3.A
1.B SRSR 1.21.1 EGEG 1.B 1.2 EGEG 1.B CPSR 2.5 2.A CP 2.5 EGEG 2.A T 2.1 2.A T 2.1 2.A T 2.2 EGEG 2.A T 2.2 2.A T 2.4 EGEG 2.A T 2.4 2.A T 3.2 EGEG 2.A T 3.2 2.A T 3.4 EGEG 2.A 3.4 2.A AAT2.3 EGEG 2.B 2.B AAAA 3.12.3 EGEG 2.B 3.1 EGEG 2.B AMAA 2.4
2.B 2.B CRAM 2.52.4 EGEG 2.B 2.5 EGEG 2.B SMCR 2.3 2.B SM 2.3 EGEG 2.B T 1.3 2.B T 1.3 EG 2.B BSI MM Activity O penSAMM Activity MM Activity OpenSAMM Activity run external marketing BSI program 0 runexternal externalsoftw marketing program host are security events 0 0 host top external softw security events (T: training) 0 create N bugs list are (real data preferred) Create review checklists from know n security requirements create N bugs
(real data preferred) (T: training) Perform Createpoint-review review checklists from know have SSGtop perform adlist hoc review of high-risk coden security requirements have SSG perform hoc w review Perform point-review of high-risk code use automated tools ad along ith manual review Utilize automated code analysis tools use automated tools along w ith rules manual review Utilize automated code for analysis tools use automated tools w ith tailored Customize
code analysis application-specifi c concerns usecapability automated w ith tailored Customize code analysis application-specifi c concerns build fortools eradicating specificrules bugs from entire codebase Customize code analysis forfor application-specifi c concerns buildcode capability eradicating c bugs from entire codebase Customize codegates analysis for application-specifi c concerns make reviewfor mandatory forspecifi all projects Establish release for code review make code review mandatory Establish release gates
for ncode review perform security feature review for all projects Analyze design against know security requirements perform feature review Analyze against knowof n security mechanisms requirements defi n e/ use security AA process I nspect fordesign complete provision defin e/design use AA review processfor high-risk applications I nspect for complete provision of security mechanisms perform Deploy design review service for project teams perform design review Deploy design review
service project teams have SSG lead review effofor rts high-risk applications Deploy design review service forfor project teams have SSG lead review eff o rts Deploydata-fl design service for project teams standardize architectural descriptions (include data flo w ) Develop o wreview diagrams for sensitive resources standardize architectural descriptions (include data flo w )Conduct Develop data-flo security w diagrams for sensitive resources educate executives technical aw areness training educate Conduct technical
security areness training provide aw executives areness training Conduct technical security awaw areness training provide aw areness training Conduct technical security areness training hold satellite training/ events Conduct technical security awaw areness training hold security satellite standards training/events Conduct technicaltechnical security guidelines aw areness training create (T: sec features/ design) Build and maintain create security standards (T: sec features/design) Build and maintain
technical guidelines create security portal Build and maintain technical guidelines create executive security portal Build and maintain technical guidelines promote aw areness of compliance/ privacy obligations Conduct role-specifi c application security training executive aw areness of compliance/ privacy obligations Conduct role-specifi c application security training offepromote r role-specifi c advanced curriculum (tools, technology stacks, Conduct bugrole-specifi parade) c application security training offe r role-specifi c advanced (tools, technology stacks, Conduct
bug role-specifi parade)c application c application security training create/ use material specific tocurriculum company history Conduct role-specifi security training material specifi c to company history Conduct role-specifi c application security training offecreate/use r on-demand individual training Conduct role-specifi c application security training offe r on-demand training Conduct role-specifi c application security training provide training forindividual vendors or outsource w orkers Conduct role-specifi c application security
training provide training for vendors or outsource w orkers Conduct role-specifi c application security training require annual refresher Conduct role-specifi c application security training require refresher Conduct role-specifi c application make SSGannual available as AA resource/mentor Utilize security coaches to enhancesecurity project training teams make SSG available as lead AA resource/ mentor Utilize security coaches enhance project teams have softw
are architects review eff o rts Utilize security coaches to to enhance project teams have softw are architects lead review(T: effo rts Utilize security coaches enhance project teams build internal forum to discuss attacks standards/ req) Utilize security coaches to to enhance project teams build tool internal forum to dis cuss attacks (T: standards/req)Utilize Utilize security coaches enhance project teams
assign mentors security coaches to to enhance project teams assign Utilize security coaches enhance project teams create or tool growmentors social netw ork/satellite system Utilize security coaches to to enhance project teams create or grow Utilize security coaches enhance project teams establish SSG offi cesocial hoursnetw ork/ satellite system Utilize security coaches to to enhance project teams
establish SSG offi ce hours Utilize security coaches to enhance project teams BSIMM Open SAMM Mapping Lessons Learned Microsoft SDL Heavyweight, good for large ISVs Touchpoints High-level, not enough details to execute against BSIMM Stats, but what to do with them? CLASP Large collection of activities, but no priority ordering ALL: Good for experts to use as a guide, but hard for non-security folks to use off the shelf D B T P SAMM We need a Maturity Model An organizations behavior changes slowly over time Changes must be iterative while working toward long-term goals There is no single recipe that works for all organizations A solution must enable riskbased choices tailored to the
organization Guidance related to security activities must be prescriptive A solution must provide enough details for nonsecurity-people Overall, must be simple, welldefined, and measurable OWASP Software Assurance Maturity Model (SAMM) https://www.owasp.org/index.php/Category:Software_Assurance_Maturity_Model D B T SAMM SAMM Security Practices From each of the Business Functions, 3 Security Practices are defined The Security Practices cover all areas relevant to software security assurance Each one is a silo for improvement P D B T SAMM Under each Security Practice
Three successive Objectives under each Practice define how it can be improved over time This establishes a notion of a Level at which an organization fulfills a given Practice The three Levels for a Practice generally correspond to: (0: Implicit starting point with the Practice unfulfilled) 1: Initial understanding and ad hoc provision of the Practice 2: Increase efficiency and/or effectiveness of the Practice 3: Comprehensive mastery of the Practice at scale P D B T SAMM Per Level, SAMM defines... Objective
Activities Results Success Metrics Costs Personnel Related Levels P D B T P SAMM Strategy & Metrics 1 D B T P SAMM Policy & Compliance 1 D B T P SAMM Education & Guidance 1 D B
T P SAMM Education & Guidance ve a man a fish and you feed him for a day; ach a man to fish and you feed him for a lifetime. A1: Injection A1: Injection A2: Cross-Site Scripting (XSS) A3: Broken Authentication and Session Management A4: Insecure Direct Object References A5: Cross Site Request Forgery (CSRF) A6: Security Misconfiguration A7: Failure to Restrict URL Access A8: Insecure Cryptographic Storage A9: Insufficient Transport Layer Protection A10:
Unvalidated Redirects and Forwards inese proverb Resources: OWASP Top 10 OWASP Education WebGoat https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project https://www.owasp.org/index.php/Category:OWASP_Education_Project https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project D B T P SAMM OWASP Cheat Sheets Developer Cheat Sheets (Builder) Authentication Cheat Sheet Choosing and Using Security Questions Cheat Sheet Cross-Site Request Forgery (CSRF) Prevention Cheat Cryptographic Storage Cheat Sheet DOM based XSS Prevention Cheat Sheet Forgot Password Cheat Sheet HTML5 Security Cheat Sheet Input Validation Cheat Sheet JAAS Cheat Sheet Logging Cheat Sheet OWASP Top Ten Cheat Sheet Query Parameterization Cheat Sheet Session Management Cheat Sheet
SQL Injection Prevention Cheat Sheet Transport Layer Protection Cheat Sheet Web Service Security Cheat Sheet XSS (Cross Site Scripting) Prevention Cheat Sheet User Privacy Protection Cheat Sheet Assessment Cheat Sheets (Breaker) Sheet Attack Surface Analysis Cheat Sheet XSS Filter Evasion Cheat Sheet Mobile Cheat Sheets IOS Developer Cheat Sheet Mobile Jailbreaking Cheat Sheet Draft Cheat Sheets Access Control Cheat Sheet Application Security Architecture Cheat Sheet Clickjacking Cheat Sheet Password Storage Cheat Sheet PHP Security Cheat Sheet REST Security Cheat Sheet Secure Coding Cheat Sheet Secure SDLC Cheat Sheet Threat Modeling Cheat Sheet Virtual Patching Cheat Sheet Web Application Security Testing Cheat Sheet https://www.owasp.org/index.php/Cheat_Sheets D B T P SAMM Threat Assessment 1 D B T P
SAMM Security Requirements 1 D B T P SAMM Secure Coding Practices Quick Reference Guide Technology agnostic coding practices What to do, not how to do it Compact, but comprehensive checklist format Focuses on secure coding requirements, rather then on vulnerabilities and exploits Includes a cross referenced glossary to get developers and security folks talking the same language https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide D B T
P SAMM Secure Architecture 2 D B T P SAMM The OWASP Enterprise Security API Custom Enterprise Web Application SecurityConfiguration IntrusionDetector Logger Exception Handling Randomizer EncryptedProperties Encryptor HTTPUtilities Encoder Validator AccessReferenceMap AccessController User Authenticator
Enterprise Security API Existing Enterprise Security Services/Libraries https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API D B T P SAMM Design Review 2 D B T P SAMM Code Review 2 D B T P SAMM Code Review SDL Integration: Multiple reviews defined as deliverables in your SDLC Structured, repeatable process with management support Reviews are exit criteria for the development and test phases Resources:
OWASP Code Review Guide https://www.owasp.org/index.php/Category:OWASP_Code_Review_Project D B T SAMM Code review tooling Code review tools: OWASP LAPSE (Security scanner for Java EE Applications) MS FxCop / CAT.NET (Code Analysis Tool for .NET) Agnitio (open source Manual source code review support tool) https://www.owasp.org/index.php/OWASP_LAPSE_Project http://www.microsoft.com/security/sdl/discover/implementation.aspx http://agnitiotool.sourceforge.net/ P D B T P SAMM Security Testing 2 D B
T SAMM Security Testing SDL Integration: Integrate dynamic security testing as part of you test cycles Derive test cases from the security requirements that apply Check business logic soundness as well as common vulnerabilities Review results with stakeholders prior to release Resources: OWASP ASVS OWASP Testing Guide https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project https://www.owasp.org/index.php/OWASP_Testing_Project P D B T P SAMM Security Testing Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications
Provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually Features: Intercepting proxy Automated scanner Passive scanner Brute force scanner Spider Fuzzer Port scanner Dynamic SSL Certificates API Beanshell integration https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project D B T P SAMM Vulnerability Management 3 D B T P SAMM Environment Hardening 3 D B T
P SAMM Web Application Firewalls Malicious web traffic Legitimate web traffic Port 80 Web client (browser) Network Firewall Web Application Firewall Web Server ModSecurity: Worlds No 1 open source Web Application Firewall www.modsecurity.org HTTP Traffic Logging Real-Time Monitoring and Attack Detection Attack Prevention and Just-in-time Patching Flexible Rule Engine Embedded Deployment (Apache, IIS7 and Nginx) Network-Based Deployment (reverse proxy) OWASP ModSecurity Core Rule Set Project, generic, plug-n-play set of WAF rules https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Projec D B T P SAMM Operational Enablement
3 150+ OWASP Projects PROTECT Tools: AntiSamy Java/:NET, Enterprise Security API (ESAPI), ModSecurity Core Rule Set Project Docs: Development Guide, .NET, Ruby on Rails Security Guide, Secure Coding Practices - Quick Reference Guide DETECT Tools: JBroFuzz, Lice CD, WebScarab, Zed Attack Proxy Docs: Application Security Verification Standard, Code Review Guide, Testing Guide, Top Ten Project LIFE CYCLE SAMM, WebGoat, Legal Project Mapping Projects / SAMM Project Project AntiSamy AntiSamy Enterprise Security API Enterprise Security API ModSecurity Core Rule Set ModSecurity Core Rule Set CSRFGuard CSRFGuard Web Testing Environment Web Testing Environment WebGoat WebGoat Zed Attack Proxy Zed Attack Proxy Application Security Verification Standard Application Security Verification Standard Application Security Verification Standard Application Security Verification Standard Application Security Verification Standard Application Security Verification Standard Code Review Guide Code Review Guide Codes of Conduct Codes of Conduct Development Guide Development Guide Secure Coding Practices - Quick Reference Guide Secure Coding Practices - Quick Reference Guide
Softw are Assurance Maturity Model Softw are Assurance Maturity Model Testing Guide Testing Guide Top Ten Top Ten Type Level SAMM Practice Remarks Type Level SAMM Practice Remarks Code Flagship SA2 Code Flagship SA2 Project Code Flagship SA3 Project Code Flagship SA3 Broken Web Applications Broken Web Applications Code Flagship EH3 Code Flagship EH3 CSRFTester CSRFTester EnDe Code Flagship SA2 EnDe Code Flagship SA2 Fiddler Addons for Security Testing Tools Flagship ST2 Fiddler Addons for Security Testing Tools Flagship ST2 Forward Exploit Tool Tools Flagship EG2 Forward Exploit Tool Tools Flagship EG2 Hackademic Challenges
EH3 3 OE3 0 0 3 0 0 3 0 7 28 28 3 3 3 D B T SAMM Get started Step 1: questionnaire as-is Step 2: define your maturity goal Step 3: define phased roadmap P D B
T SAMM Conducting assessments SAMM includes assessment worksheets for each Security Practice P D B T SAMM Assessment process Supports both lightweight and detailed assessments P D B T SAMM Creating Scorecards Gap analysis Capturing scores from detailed assessments versus expected performance levels Demonstrating improvement Capturing scores from before and after an iteration of assurance program build-out Ongoing measurement Capturing scores over consistent time frames for an assurance program that is already in place P D B
T SAMM Roadmap templates To make the building blocks usable, SAMM defines Roadmaps templates for typical kinds of organizations Independent Software Vendors Online Service Providers Financial Services Organizations Government Organizations Tune these to your own targets / speed P SAMM Resources www.opensamm.org Presentations Tools Assessment worksheets / templates Roadmap templates Scorecard chart generation Translations (Spanish / Japanese) SAMM mappings to ISO/EIC 27034 / BSIMM 4 Critical Success Factors Get initiative buy-in from all stakeholders Adopt a risk-based approach
Awareness / education is the foundation Integrate security in your development / acquisition and deployment processes Provide management visibility 4 Project Roadmap Build the SAMM community: List of SAMM adopters Workshops at AppSecEU and AppSecUSA V1.1: Incorporate tools / guidance / OWASP projects Revamp SAMM wiki V2.0: Revise scoring model Model revision necessary ? (12 practices, 3 levels, ...) Application to agile Roadmap planning: how to measure effort ? Presentations & teaching material 4 Get involved Use and donate back! Attend OWASP chapter meetings and conferences Support OWASP become personal/company member https://www.owasp.org/index.php/Membership Q&A Thank you @sebadele [email protected][email protected] www.linkedin.com/in/sebadele
Waste Reduction and Reuse. How can we create less waste in the first place? 4. Hard-To-Recycle Materials. Material not accepted at curb or typical drop-off recycling center. Convenient access must be considered. Need reliable end-markets. 5. Organics Management
Christ have mercy. Notes accompanying each slide The notes section of each of the slides that follows comprises the liturgy that goes with each Station, as written by Maria Graf-Huber and published in a handbook, "Way of the Cross from...
Chapter 8: Cryptography 05/06/19 * Cryptography * * * * * * * * Birthday Attack The brute-force birthday attack aims at finding a collision for a hash function h Randomly generate a sequence of plaintexts X1, X2, X3,…
Each isomer of a hydrocarbon molecule has a different number of C-H bonds and therefore the isomers have different physical and chemical properties. Melting and boiling points can be significantly different as shown in Table 24.3 of text.
"Cooking up" Cumulative Impact Assessment. Objective - take concept of CEIA out of realm of fearful "black magic"…. Can't expect to make it "child's play," but recognize it as a valid, understandable, professional undertaking which results in a desirable final...
Cost-plus pricing - Uses a base-cost figure per unit and adds a markup to cover unassigned costs and to provide a profit. Allows businesses with low costs to set prices lower than those of competitors' and still make a profit...
SciVal Funding provides personalized funding recommendations from more than 11,000 public and private sponsors. SciVal Funding uses the same account login information as SciVal. Get an account. Visit SciVal.com from the Penn State network, e.g., from your office. (You must...
Motiva Enterprises LLC Port Arthur Expansion Project Team "C" Jacob Munoz Aaron Hebert Joseph Nasser Outline Motiva Overview Expansion Highlights Insurance Programs Contractor Wrap-Up Contractor's Equipment Floater Builders Risk Marine Cargo Motiva Overview Formed in 1998 Dual ownership between Shell...
Ready to download the document? Go ahead and hit continue!