Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

9/3/2019
04:45 AM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

7 Steps to Web App Security

Emerging technologies are introducing entirely new ways to reach, act, and interact with people. That makes app security more important than ever.
2 of 8

2 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
9/5/2019 | 6:37:13 PM
Look deeper into the Rabbit hole

 I do agree with the points you brought up to the public, we should follow these steps and do it rigoursly, but that this aspect only just scratches the surface (basically the explanations are general). I would say we should do the following:
  • Once we develop the SecDevOps teams, we should put them in specific groups (red, blue, green)
    • The red-team is responsible for identifying the possible openings in the application (create a bounty program - you had mentioned it, but internally - and then have your blue team to see if they can circumvent the security controls the red-team put in place, then the green team should look to validate if the red or blue teams identified a real vulnerability. Have the green team look up the vulnerability to see if it exists, if not, have the green team to create tools to punish the application for one final assault or Q/A session to ensure the application does not fall to external threats or buffer overflows
    • Linux - the teams should look deeper into using tools from MIT (SeLinux is one example) and determine if the tool is actually working to identify and thwart attacks (go to the "/var/log/audit/audit.log" (make sure "setenforce 1" and SeLinux is installed and working properly)
    • Windows - run "get-appxprovisionedpackage -online | out-gridview -passthru | remove-appxprovisionedpackage -online" to ensure Bing applications, games and other tools are not installed, if so, remove them or utilize Uninstaller from IoBit" (group policies are good but there are HIDS like "Comodo" that are invaluable when it comes to cyber protection at the endpoint
    • Look into performance and application optimization tools like CA or Extrahop to identify if the application is running at its optimal level, the tools will also help the user identify if there are holes in the development chain (utilize Agile Scrum methodologies but incorporate CMMI security procedures from Carnige Mellon, NIST and CoBIT
    • Mitre At&ck is another framework we should look into when it comes to "Priviledge escalation" - https://attack.mitre.org/tactics/TA0004/, this is an area that needs attention because it delves into the methods actors use to attack a subject (again this is just one of many)

Top 6 Cybersecurity Frameworks

We also need to look heavily into applications that monitor themselves; for example, AWS stated they were going to look into developing an application where it would determine if the configuration of the S3 or EBS (Elastic Block Stores) were configured wrong or with public access. This is the next level we need to start looking into (i.e. Machine Learning). We need to be conscious of bad data in and bad data out scenario, this needs to come from the vendor and the individuals who are working day today.

I do think the adoption of a language that is not on the top of the CVE list will help as well, there are some such as the "Open Vulnerability & Assessment Language", I particularly like Python for Linux and Powershell for Windows, especially when you are looking at specific vulnerable areas that exist inside DLL files and in the registry, (I have found that JSON seems to work much faster when using JSON right in the code itself).

"============================================="

Powershell
Write-Host " "
Write-Host "LSA Registry Entries"
Write-Host "--------------------"
Write-Host " "

$lsa = '{"registry":[
	{"Entry":"auditbaseobjects", "Value":"1", "Type":"Dword"},
	{"Entry":"auditbasedirectories", "Value":"1", "Type":"Dword"},
	{"Entry":"LmCompatibilityLevel", "Value":"4", "Type":"Dword"},
	{"Entry":"restrictanonymous", "Value":"1", "Type":"Dword"},
	{"Entry":"restrictanonymoussam", "Value":"1", "Type":"Dword"},
	{"Entry":"LimitBlankPasswordUse", "Value":"1", "Type":"Dword"},
    {"Entry":"SecureBoot", "Value":"1", "Type":"Dword"}
]}'

$path = "HKLM:\System\CurrentControlSet\Control\Lsa"
$regobj = ConvertFrom-Json -InputObject $lsa
$regobjects = $regobj.registry

foreach ( $i in $regobjects ) {
    $val = Get-ItemPropertyValue -Path $path -Name $i.Entry `
-ErrorAction SilentlyContinue if ( (Test-Path $path) -and ($i.Value -eq $val ) ) { Write-Host $i.Entry "registry value - ok" } else { #New-Item -path $path -Name $i.Entry -Value $i.Value -Type Dword $chg = Set-ItemProperty -Path $path -Name $i.Entry -Value $i.Value `
-Type $i.Type -Force $names = Get-ItemPropertyValue -Path $path -Name $i.Entry Write-Host $i.Entry "modified registry entry: " $names } }

 "============================================"

Just something to think about.

T
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15246
PUBLISHED: 2020-11-23
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v...
CVE-2020-15247
PUBLISHED: 2020-11-23
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permi...
CVE-2020-15248
PUBLISHED: 2020-11-23
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the ...
CVE-2020-15249
PUBLISHED: 2020-11-23
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG ...
CVE-2020-28927
PUBLISHED: 2020-11-23
There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.