Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/21/2013
05:44 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Financial Services Industry Proposes Security Controls For Third-Party, Open-Source Software

FS-ISAC addresses potential dangers of insecure software components used by financial firms

The financial services industry has come up with a proposed strategy for deploying third-party software -- including open-source -- and services securely in financial institutions.

Members of a working group of the FS-ISAC (Financial Services Information Sharing and Analysis Center) this week proposed three basic security controls for ensuring the security of third-party software used by financial services firms: a vendor-focused Building Security In Maturity Model (BSIMM) assessment, binary static analysis, and policy management for open-source software libraries and components.

"What we're doing here is adding some controls that are based on knowledge [larger financial institutions] have obtained in software security maturity ... and adding those to third-party software governance," says Jim Routh, CISO at Aetna, and a member of the FS-ISAC Product & Services Committee who worked on the proposed controls.

The growing threats to Web-based applications and emerging mobile apps were factors in the development of the software security requirements for third-party software used in the financial services industry, he says. And vulnerabilities and weaknesses in third-party software and open-source software have increasingly become a concern for enterprises adopting those elements into their applications and systems.

"Software security controls are an integral part of building high quality software," the FS-ISAC's "Appropriate Software Security Control Types for Third Party Service and Product Providers" whitepaper says. A working group made up of executives from Fidelity, Morgan Stanley, Goldman Sachs, Capital One, Thomson Reuters, and Citi worked on the controls.

[While there is certainly room for improvement, the software vendor and financial services communities are making a steadily improving progression in maturing their software security practices. See Software Security Maturity Plods Along .].

Aetna's Routh says the Vendor BSIMM, vBSIMM, is basically a subset of BSIMM, a study of actual secure software development programs at companies so other companies can measure their efforts with their counterparts. vBSIMM is a way to measure the maturity of software security of vendors selling to the financial industry. "This is a better indicator of risk," Routh says.

Scanning binary code in software provides a vulnerability density score for a particular version of software at a specific point in time, Routh says. So software firms selling to the financial services industry would theoretically have their binary code scanned by HP Fortify or Veracode, which provide that type of software vulnerability scanning, for example.

"The results of the scans would be shared with the financial industry," Routh says. "Today the model is the financial [firms] paying for that," but Veracode, for instance, has a program that in the future would shift that cost to the vendors, he says.

Third-party software and services vendors would then share the cost of one assessment for multiple financial services clients, he says. The same goes for vBSIMM: "If I am a software vendor and do a BSIMM assessment, that same assessment is shared with many of my clients."

The open-source policy management control, meanwhile, helps financial industry firms to ensure their developers are employing the newest versions of open-source software, as well as more reliable and resilient libraries.

"Today, 80 to 90 percent of custom development uses open-source libraries to build an application," Routh says. "And 26 percent of the most commonly downloaded open-source libraries are riddled with high-risk vulnerabilities."

Policies would enforce using reliable sources for open-source software and ensuring that only the most current versions are used.

Still, the FS-ISAC won't be enforcing the recommended security policies for third-party software and services. "The working group is saying this has been a problem for some time, and there are no easy answers or quick fixes. But these controls should be considered to be adding to third-party [software] governance," Routh says. "We're looking at standardizing on a set of controls that improve risk management across the [financial services] industry, and also make it easier on vendors at the same time."

The FS-ISAC working group's white paper is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
marktroester
50%
50%
marktroester,
User Rank: Apprentice
12/4/2013 | 7:16:38 PM
re: Financial Services Industry Proposes Security Controls For Third-Party, Open-Source Software
The third control type of the FS-ISAC report relates to the usage of open source components. As Jim noted, applications now consist of 80-90% components, so it's now critical that these components be managed correctly. The FS-ISAC report refers to the Sonatype CLM as a new approach that leverages policies to help manage the development process. This approach helps architects control version usage, accelerate development by using resilient open source libraries, and reduces operating costs of replacing old component versions.

More information about this control type is available here: http://blog.sonatype.com/peopl...

Thanks,

Mark Troester
Sonatype
@mtroester
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11558
PUBLISHED: 2020-04-05
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_m...
CVE-2020-11547
PUBLISHED: 2020-04-05
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVE-2020-11548
PUBLISHED: 2020-04-05
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
CVE-2020-11542
PUBLISHED: 2020-04-04
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.
CVE-2020-11533
PUBLISHED: 2020-04-04
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).