Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

9/3/2019
04:45 AM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
100%
0%

7 Steps to Web App Security

Emerging technologies are introducing entirely new ways to reach, act, and interact with people. That makes app security more important than ever.
Previous
1 of 8
Next

Image Source: tashatuvango

Image Source: tashatuvango

For more than two decades, Web apps were built with functionality in mind. Everything revolved around the user interface and how easy it was for users to access information and make online purchases.

No longer. The high-profile breaches of the past few years have shattered those assumptions, and companies can no longer trade off functionality for security. Today, both app security and privacy must be built into Web applications.

Setu Kulkarni, vice president of corporate strategy and business development at WhiteHat Security, says it all starts with CISOs explaining in clear terms what lackluster app security means to the company's bottom line.

And while it's important for CEOs to understand what's at stake in terms of lost revenue and brand reputation, security pros are the ones who have to "own" security, Kulkarni says. "That means moving from merely responding to breaches [to mainstreaming] security into IT project teams and the entire development process," he says.

This feature offers security pros some ideas for mainstreaming app security at their organizations. Security, after all, can't be an afterthought. It has to become a part of the company's culture, just as important to the product as quality control.

 

 

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
9/5/2019 | 6:37:13 PM
Look deeper into the Rabbit hole

 I do agree with the points you brought up to the public, we should follow these steps and do it rigoursly, but that this aspect only just scratches the surface (basically the explanations are general). I would say we should do the following:
  • Once we develop the SecDevOps teams, we should put them in specific groups (red, blue, green)
    • The red-team is responsible for identifying the possible openings in the application (create a bounty program - you had mentioned it, but internally - and then have your blue team to see if they can circumvent the security controls the red-team put in place, then the green team should look to validate if the red or blue teams identified a real vulnerability. Have the green team look up the vulnerability to see if it exists, if not, have the green team to create tools to punish the application for one final assault or Q/A session to ensure the application does not fall to external threats or buffer overflows
    • Linux - the teams should look deeper into using tools from MIT (SeLinux is one example) and determine if the tool is actually working to identify and thwart attacks (go to the "/var/log/audit/audit.log" (make sure "setenforce 1" and SeLinux is installed and working properly)
    • Windows - run "get-appxprovisionedpackage -online | out-gridview -passthru | remove-appxprovisionedpackage -online" to ensure Bing applications, games and other tools are not installed, if so, remove them or utilize Uninstaller from IoBit" (group policies are good but there are HIDS like "Comodo" that are invaluable when it comes to cyber protection at the endpoint
    • Look into performance and application optimization tools like CA or Extrahop to identify if the application is running at its optimal level, the tools will also help the user identify if there are holes in the development chain (utilize Agile Scrum methodologies but incorporate CMMI security procedures from Carnige Mellon, NIST and CoBIT
    • Mitre At&ck is another framework we should look into when it comes to "Priviledge escalation" - https://attack.mitre.org/tactics/TA0004/, this is an area that needs attention because it delves into the methods actors use to attack a subject (again this is just one of many)

Top 6 Cybersecurity Frameworks

We also need to look heavily into applications that monitor themselves; for example, AWS stated they were going to look into developing an application where it would determine if the configuration of the S3 or EBS (Elastic Block Stores) were configured wrong or with public access. This is the next level we need to start looking into (i.e. Machine Learning). We need to be conscious of bad data in and bad data out scenario, this needs to come from the vendor and the individuals who are working day today.

I do think the adoption of a language that is not on the top of the CVE list will help as well, there are some such as the "Open Vulnerability & Assessment Language", I particularly like Python for Linux and Powershell for Windows, especially when you are looking at specific vulnerable areas that exist inside DLL files and in the registry, (I have found that JSON seems to work much faster when using JSON right in the code itself).

"============================================="

Powershell
Write-Host " "
Write-Host "LSA Registry Entries"
Write-Host "--------------------"
Write-Host " "

$lsa = '{"registry":[
	{"Entry":"auditbaseobjects", "Value":"1", "Type":"Dword"},
	{"Entry":"auditbasedirectories", "Value":"1", "Type":"Dword"},
	{"Entry":"LmCompatibilityLevel", "Value":"4", "Type":"Dword"},
	{"Entry":"restrictanonymous", "Value":"1", "Type":"Dword"},
	{"Entry":"restrictanonymoussam", "Value":"1", "Type":"Dword"},
	{"Entry":"LimitBlankPasswordUse", "Value":"1", "Type":"Dword"},
    {"Entry":"SecureBoot", "Value":"1", "Type":"Dword"}
]}'

$path = "HKLM:\System\CurrentControlSet\Control\Lsa"
$regobj = ConvertFrom-Json -InputObject $lsa
$regobjects = $regobj.registry

foreach ( $i in $regobjects ) {
    $val = Get-ItemPropertyValue -Path $path -Name $i.Entry `
-ErrorAction SilentlyContinue if ( (Test-Path $path) -and ($i.Value -eq $val ) ) { Write-Host $i.Entry "registry value - ok" } else { #New-Item -path $path -Name $i.Entry -Value $i.Value -Type Dword $chg = Set-ItemProperty -Path $path -Name $i.Entry -Value $i.Value `
-Type $i.Type -Force $names = Get-ItemPropertyValue -Path $path -Name $i.Entry Write-Host $i.Entry "modified registry entry: " $names } }

 "============================================"

Just something to think about.

T
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3035
PUBLISHED: 2021-04-20
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.
CVE-2021-3036
PUBLISHED: 2021-04-20
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to us...
CVE-2021-3037
PUBLISHED: 2021-04-20
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS conf...
CVE-2021-3038
PUBLISHED: 2021-04-20
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions...
CVE-2021-3506
PUBLISHED: 2021-04-19
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The hi...