Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
The Staggering Complexity of Application Security
Oldest First  |  Newest First  |  Threaded View
Whoopty
100%
0%
Whoopty,
User Rank: Ninja
11/10/2014 | 12:19:33 PM
Devils you know
I know a few people who do a little freelance tech security work and several of them have pointed out major bugs to corporations about their sites or apps and often times, the flaw isn't fixed because it would require such an upheavel. It's worrying and makes you wonder when a big breach occurs, whether the company knew about it and chose to do nothing.

The delemna of course is that those firms will be damned if they interrupt service for a fix, and damned if they get caught out later. It's a difficult situation to be in. 
Stratustician
100%
0%
Stratustician,
User Rank: Moderator
11/10/2014 | 1:27:02 PM
Re: Devils you know
So true.  For me I find it's usually one of 2 issues that cause these security issues. Often DevOps teams don't have good security input early enough in the design stage, or don't keep up with testing prior to release. The other option is they bring security in way too late and then plug their ears when vulnerabilities in the code are detected by the security team after release, and then it's much harder to pull the app or change it without causing downtime. 

That or overall folks just don't feel that app security is that important to the overall security posture of an organization, which sadly is why we might be in this position in the first place.
TerryB
100%
0%
TerryB,
User Rank: Ninja
11/10/2014 | 1:27:34 PM
What can you control?
Great article and insight. But doesn't this only work if EVERYONE in the stack does it? Your testing may show that your product is fine but holes in o/s or browser still expose you. Maybe I'm just naive but were the old mainframes running MVS-370 as vulnerable as Windows/browser you run apps on today?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/10/2014 | 3:43:24 PM
Re: What can you control?
It's  hard for me to imagine getting 100 percent compliance with anything. So anything that moves the needle in the right direction would seem to make sense to me..
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/11/2014 | 9:39:44 AM
Re: Devils you know
@Stratustician It's hard for me to imagine that DevOps can still be so tone deaf when it comes to appsec when vulnerabilities like Heartbleed and POODLE have become so commonplace in security news reports. 
af_bugcrowd
50%
50%
af_bugcrowd,
User Rank: Author
11/12/2014 | 6:31:52 PM
Re: Devils you know
It's only going to be worse in mobile vulnerabilities once the eyeballs and money on them catches up to usage. There are so many different devices that are going to be unique creases in many of them.  


Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10694
PUBLISHED: 2019-12-12
The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1....
CVE-2019-10695
PUBLISHED: 2019-12-12
When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user�s username and password were exposed in the job�s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the ...
CVE-2019-5085
PUBLISHED: 2019-12-12
An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially crafted packet can cause an integer overflow, resulting in heap corruption. An attacker can send a packet to trigger this vulnerability.
CVE-2019-5090
PUBLISHED: 2019-12-12
An exploitable information disclosure vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially crafted packet can cause an out-of-bounds read, resulting in information disclosure. An attacker can send a packet to trigger this vulner...
CVE-2019-5091
PUBLISHED: 2019-12-12
An exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15. A specially crafted packet can cause an infinite loop, resulting in a denial of service. An attacker can send a packet to trigger this vulnerability.