Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/21/2013
05:44 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Financial Services Industry Proposes Security Controls For Third-Party, Open-Source Software

FS-ISAC addresses potential dangers of insecure software components used by financial firms

The financial services industry has come up with a proposed strategy for deploying third-party software -- including open-source -- and services securely in financial institutions.

Members of a working group of the FS-ISAC (Financial Services Information Sharing and Analysis Center) this week proposed three basic security controls for ensuring the security of third-party software used by financial services firms: a vendor-focused Building Security In Maturity Model (BSIMM) assessment, binary static analysis, and policy management for open-source software libraries and components.

"What we're doing here is adding some controls that are based on knowledge [larger financial institutions] have obtained in software security maturity ... and adding those to third-party software governance," says Jim Routh, CISO at Aetna, and a member of the FS-ISAC Product & Services Committee who worked on the proposed controls.

The growing threats to Web-based applications and emerging mobile apps were factors in the development of the software security requirements for third-party software used in the financial services industry, he says. And vulnerabilities and weaknesses in third-party software and open-source software have increasingly become a concern for enterprises adopting those elements into their applications and systems.

"Software security controls are an integral part of building high quality software," the FS-ISAC's "Appropriate Software Security Control Types for Third Party Service and Product Providers" whitepaper says. A working group made up of executives from Fidelity, Morgan Stanley, Goldman Sachs, Capital One, Thomson Reuters, and Citi worked on the controls.

[While there is certainly room for improvement, the software vendor and financial services communities are making a steadily improving progression in maturing their software security practices. See Software Security Maturity Plods Along .].

Aetna's Routh says the Vendor BSIMM, vBSIMM, is basically a subset of BSIMM, a study of actual secure software development programs at companies so other companies can measure their efforts with their counterparts. vBSIMM is a way to measure the maturity of software security of vendors selling to the financial industry. "This is a better indicator of risk," Routh says.

Scanning binary code in software provides a vulnerability density score for a particular version of software at a specific point in time, Routh says. So software firms selling to the financial services industry would theoretically have their binary code scanned by HP Fortify or Veracode, which provide that type of software vulnerability scanning, for example.

"The results of the scans would be shared with the financial industry," Routh says. "Today the model is the financial [firms] paying for that," but Veracode, for instance, has a program that in the future would shift that cost to the vendors, he says.

Third-party software and services vendors would then share the cost of one assessment for multiple financial services clients, he says. The same goes for vBSIMM: "If I am a software vendor and do a BSIMM assessment, that same assessment is shared with many of my clients."

The open-source policy management control, meanwhile, helps financial industry firms to ensure their developers are employing the newest versions of open-source software, as well as more reliable and resilient libraries.

"Today, 80 to 90 percent of custom development uses open-source libraries to build an application," Routh says. "And 26 percent of the most commonly downloaded open-source libraries are riddled with high-risk vulnerabilities."

Policies would enforce using reliable sources for open-source software and ensuring that only the most current versions are used.

Still, the FS-ISAC won't be enforcing the recommended security policies for third-party software and services. "The working group is saying this has been a problem for some time, and there are no easy answers or quick fixes. But these controls should be considered to be adding to third-party [software] governance," Routh says. "We're looking at standardizing on a set of controls that improve risk management across the [financial services] industry, and also make it easier on vendors at the same time."

The FS-ISAC working group's white paper is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
marktroester
50%
50%
marktroester,
User Rank: Apprentice
12/4/2013 | 7:16:38 PM
re: Financial Services Industry Proposes Security Controls For Third-Party, Open-Source Software
The third control type of the FS-ISAC report relates to the usage of open source components. As Jim noted, applications now consist of 80-90% components, so it's now critical that these components be managed correctly. The FS-ISAC report refers to the Sonatype CLM as a new approach that leverages policies to help manage the development process. This approach helps architects control version usage, accelerate development by using resilient open source libraries, and reduces operating costs of replacing old component versions.

More information about this control type is available here: http://blog.sonatype.com/peopl...

Thanks,

Mark Troester
Sonatype
@mtroester
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13643
PUBLISHED: 2019-07-18
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on the...
CVE-2019-13644
PUBLISHED: 2019-07-18
Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page.
CVE-2019-13645
PUBLISHED: 2019-07-18
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing.
CVE-2019-13646
PUBLISHED: 2019-07-18
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.
CVE-2019-13647
PUBLISHED: 2019-07-18
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing.