Application Security
2/7/2017
10:30 AM
Jason Kent
Jason Kent
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

The Promise & Peril Of The App Era

Sure, apps are convenient. But when not properly assessed, they can cause security holes.

As the app frenzy that captivated consumers now blazes through the business world, it's creating an unfortunate by-product: disconcerting security blunders and disasters.

After realizing apps boost businesses by simplifying life for employees, partners, and customers, organizations are feverishly "appifying" their operations: order management, payments, inventory control — you name it. But in their rush, many companies aren't rigorously assessing the security of these Web and mobile apps, despite their multiple links to critical back-end systems and data.

The Road to Hell Is Paved with Insecure Apps
With the app era's benefits also comes a tremendous potential for danger, if vulnerabilities exist in those interconnection points. Bad actors are looking to exploit these security gaps and sneak in through the app door.

Compared with other attack patterns, Web app attacks have become the most likely to trigger a data breach, according to Verizon's 2016 Data Breach Investigation Report. This means Web apps aren't just exposed, but "disproportionately vulnerable" compared to other attack vectors, according to Verizon. Furthermore, Ponemon Institutefound that data breach costs to organizations jumped almost 30% since 2013 to $4 million on average per incident in 2016.

Let's shift now from the big picture and zoom in on two app security failures of which I have firsthand knowledge.

A Bank Winds Up with Egg on Its Face
When I was at a previous job, a large bank called me in to help after a faulty app turned a seemingly simple project into a nightmare. Seeking more shareholder participation in proxy voting, the bank decided to make the process more convenient with a mobile app. The bank accepted a low bid from a fledgling contractor and didn't specify security requirements, except to give the app a sign-in gate. Incorrectly assuming the app had been built with native authentication, the bank distributed it to investors, without reviewing its code or development process.

What the bank didn't know was that the contractor had used a flawed authentication library available online, which stealthily transferred contacts on users' phones to a third-party server in China. The bank found out only after scammers flooded its shareholders with phishing attacks.

What's Inside My Sushi Roll? Phish?
App fiascos aren't limited to large organizations. When small companies ignore security, consequences can be disproportionately large.

I recently received an email resembling a FedEx notification, but the tracking number format looked strange. Upon further inspection, I found that the "track package" and "unsubscribe" links pointed to a Singapore sushi roll shop's WordPress website with an open "file upload" function. A hacker, likely armed with a simple script, found the Web app's vulnerability — the site builder's mistake — uploaded malicious code, and crafted the phishing attack. I didn't fall for this one, but others likely did. Study after study reveals disturbingly high success rates for phishing scams.

The RSA Q2 2016 Threat Report, released in September, found the following:

  • 1 million+ unique phishing attacks were identified in the prior 12 months — one every 30 seconds.
  • In the second quarter of 2016, phishing attacks jumped 308% year-on-year.
  • The total cost to global organizations from phishing was $9.1 billion.

See, Assess, and Remediate
Before the cloud and mobility revolutions, applications had simpler, linear architectures, which made securing them easier. Today, apps are intertwined with other apps, Web services, and legacy back-end systems via APIs and custom integrations. They also expose many more functions to many more people via the Internet. This makes them a conveniently accessible target for hackers. The result: it's much more complicated to find security gaps and weak links.

Consider these three areas where you can take concrete steps to build a safer enterprise and a culture of clean code.

Focus Area #1: See
You need full, uninterrupted visibility into all your applications, whether they were purchased or developed internally. A comprehensive, continuously updated app inventory puts you in control to manage apps' security. This means understanding development methods and frameworks employed, and knowing all the modular components within the apps. That way, when vulnerabilities affecting these components are disclosed, you'll know instantly which among your apps are affected.

Visibility also means understanding the threats posed by the Web of third-party service and resource interconnections tapped by your apps. For example, the bank would have avoided embarrassment if it had bothered finding out the components the contractor had used in the app and understood their risks.

Focus Area #2: Assess
Assessment involves probing your apps with a broad, deep scope and getting many parties involved, including app dev, quality assurance (QA), and information security. To reduce coding errors and catch most other ones before code makes it to production, you should do the following:

  • Train QA staffers in Web application assessment
  • Teach developers secure coding techniques
  • Invest in continuous integration environments to automate and accelerate code development and testing

Assessment is an area where the Singapore shop failed badly, as it couldn't detect a glaring flaw in its website that hackers exploited for a phishing campaign.

Focus Area #3: Remediate
Organizations need to prioritize remediation granularly. They can't just focus on "crown jewel" apps. Simple code reused in many apps poses threats if it contains vulnerabilities. Remediation also presents an opportunity to promote using secure components and make everyone on the team feel empowered to protect the organization. Finally, the remediation process highlights successes and failures, so you can take steps to continually improve.

The bank and shop can learn valuable lessons from their app blunders and remediation, and lead them to adopt new app security best practices, processes, and tools.

Promise, Not Peril
In the end, don't lose sight that the goal is to create a safe, efficient environment where the promise of the app era is realized and the peril is diminished.

Related Content:

 

Jason Kent is Vice President, Web Application Security Product Management at Qualys. Prior to that, he held technical security positions at Veracode, BlueCoat, Aruba, and Verizon. Through more than a decade of dedicated AppSec experience, he has established expertise in ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.