Application Security
1/15/2014
11:06 AM
Jeff Williams
Jeff Williams
Commentary
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

What Healthcare Can Teach Us About App Security

The Centers for Disease Control protects people from health threats and increases the health security of our nation. It's a mission that's not so different from InfoSec.

Here’s our challenge: our increasing reliance on software is occurring exactly when two other trends are making security more difficult. First, software size, complexity, interconnection, and even development speed are increasing rapidly. Second, advances in software technology are rapidly making traditional security scanners and code analyzers obsolete. Seriously… this won’t end well.

Poor visibility is poor security
Most organizations, even those with "mature" application security programs, have terrible visibility into the security of their application portfolios. They might be tracking some risks from penetration tests or automated scans. They might have a spotty application and component inventory. But when you get right down to it, they probably have very little real evidence that their defenses are correct and properly used across their application portfolios. And the information that they have gathered is so far out of date that it is of little use to development projects.

Ironically, the biggest risk in a risk assessment report isn’t even captured in its pages: the risk that the assessment itself has missed something important. Typical risk assessments don’t capture all the details about what code was covered, which defenses were checked, and what tests were performed. So, for example, if an assessment doesn’t cover authentication or access control (most don’t), the report reveals nothing, and the development team is left with a very dangerous false sense of security.

With a little tweaking and some perspective, we can transform techniques like dynamic scanning, static analysis, penetration testing, code review, architecture review, and threat modeling to generate a lot of assurance.

Battling the flu with instrumentation
We can learn a lot from the world of healthcare. Did you know the mission of the Centers for Disease Control (CDC) is to protect people from “health threats” and increase the “health security” of our nation? Its mission is not as different from information technology security as you might think.

The CDC fights disease, but they’re not your typical doctors. The size and complexity of their problem forces them to use very different techniques -- techniques that scale. The CDC is using sensors and instrumentation to gather data from people, doctors, hospitals, and labs at scale. It's now monitoring more than 700,000 flu patients every week.

The CDC uses this sensor data to combat influenza. The chart below shows that this year’s flu is peaking at a similar time but is less intense than in last years. Researchers are using this data to identify strains with more accuracy and create better defenses (flu shots) to protect people.

As application security challenges continue to mount, we can take advantage of sensors and instrumentation to increase visibility and create assurance. Imagine new sensors that track security-critical information across your entire application portfolio in real time. Below is a snapshot of a real-time software assurance dashboard generated from a small organization’s application portfolio:

Using Sensors & Instrumentation for Application Security Visibility

Each of the expected defenses represents one part of a more detailed security story. The dashboard illustrates the level of assurance for each of the expected security defenses in each application. Sampling and circumstantial evidence can be used at the lower levels, but the higher levels require more rigorous verification.

New sensor technology can gather this information directly from applications in development, test, integration, and even production. Traditional application security tools, both static and dynamic, can be retooled to generate this kind of evidence. For example, tools like OWASP’s ZAP proxy can be used to identify vulnerabilities, but can also be set up as a passive sensor. A simple ZEST script can generate continuous evidence that Cross-Site Request Forgery (CSRF) token defenses are working across an entire application portfolio.

Focusing your application security program on generating portfolio assurance has many benefits. You can learn more about this approach in my recent OWASP talk, Application Security at DevOps Speed and Portfolio Scale. This approach is far more compatible with Agile and DevOps style development than the traditional annual security test. But more importantly, it actually produces security and increases the health of your application security program.

Jeff Williams has more than 20 years of experience in software development and security. He is the founder and CEO of Aspect Security and served as the Global Chairman of the OWASP Foundation for eight years.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/16/2014 | 3:49:26 PM
Wow! Check out this dashboard that tracks critical application security info in real time
Jeff, Can you expand a little bit more on how the company that developed this dashboard came up with the idea, some examples of how they are using it and some of their big sucess stories! Very cool stuff!
planetlevel
50%
50%
planetlevel,
User Rank: Author
1/17/2014 | 8:54:23 AM
Re: Wow! Check out this dashboard that tracks critical application security info in real time
Sure!  They have set up a variety of tools to report to a central server.  It's not as clean as they would like.  Some of the tools report via files, others by REST services, etc...   And their reporting engine doesn't generate a beautiful heatmap yet.  But they've got a great set of sensors started and they are adding more every day.  Their penetration testing costs are plummeting, because they no longer need to test for the items they are monitoring.  And (I believe) their assurance is going up, because the sensor they are deploying get better coverage and have more accuracy than the traditional ways of doing application security.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/17/2014 | 10:05:36 AM
Re: Wow! Check out this dashboard that tracks critical application security info in real time
Sounds very promising. Who's idea was it or was it a project initiated by management. Sounds like it is already showing an ROI, but what was the initial investment (ball park) in terms of h/w, s/w and other related costs?
planetlevel
50%
50%
planetlevel,
User Rank: Author
1/17/2014 | 11:24:08 AM
Re: Wow! Check out this dashboard that tracks critical application security info in real time
In this case, we worked with security team to put in place some tools to monitor application security continuously. One was ZAP proxy, which we put in place in their CI/CD environment to *passively* look for security practices. We have been adding some custom ZEST scripts to verify *their* security defenses.  There are a lot of tools -- some static, some dynamic, and some using instrumentation -- that can all help generate assurance continuously. Their initial investment was very low.  They started small just looking to verify SQL Injection defenses across their entire application inventory.  They use *positive* static analysis to verify that only parameterized queries are used across all their apps.  Now if any developer introduced a potential SQL injection problem it would show up on the dashboard immediately.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/21/2014 | 9:02:01 AM
Re: Wow! Check out this dashboard that tracks critical application security info in real time
Thanks for the great detail, Jeff. One last question from me (Others -- feel free to add yours to the thread!). What were some of the gotchas in the project that you would have done differently, or that didn't work out as well as you expected. 
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
DevOps’ Impact on Application Security
DevOps’ Impact on Application Security
Managing the interdependency between software and infrastructure is a thorny challenge. Often, it’s a “developers are from Mars, systems engineers are from Venus” situation.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-3828
Published: 2014-10-22
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.