Fortify Justin Derry-Business Software Assurance-Protecting your Assets

Protecting your Digital Assets!
Introducing Business Software Assurance Presenter: Justin Derry (Practice Director – Asia Pacific)
“Business Software Assurance”

Who am I?
? Justin Derry ? (Practice Director, Asia-Pacific, Fortify) – https://www.360docs.net/doc/0819106208.html, ? Developing Applications for 15+ years ? White Hat Hacking of Applications for 12+ years ? Spent time being an IT Admin & Security ? OWASP Brisbane Chapter Leader ? OWASP XML Interceptor Tool Lead ? OWASP Asia Pacific Conference Chair 08/09

The “Case” for Application Security

Digital Assets & Network Protection
Intellectual Property
Customer Data
Corporate Data Trade Secrets
Business Processes

Exposing your Digital Assets
Firewall
Web Services
Partners
Outsourcers

Making the Case
? Risk of a Major Data Breach is increasing 146% since 2001 ? Cost of a data breach could be $11 Million US #1 ? A breach will cost more then protecting against attack ? Attacks are focused at the Application Layer (> 76% Gartner) ? NIST: 92% of vulnerabilities in application code ? It’s not all about SQL Injection & Cross Site Scripting ? False sense of security, existing security gates don’t protect you
#1- HERTZ August 2008

Vulnerability Statistics
143,757,645 Number of “records” reported compromised since Feb 2005 45% Infosec respondents that did not know what types of attacks have occurred on their systems.
Source: CIO-PWC Survey 2007
+106% Reported breaches due to 3rd parties, such as outsources, Contractors and & Consultants since 2006
40% Infosec respondents that did not know the number of security incidents experienced in 2007
Source: CIO-PWC Survey 2007

The attacks have changed
? Recently at “BlackHat 2008” a presentation on “Get Rich or Die Trying” disclosed ? Cookie Stuffing (Online Affiliate Scams) ? Authorization Exploits in Applications ? Unauthorized disclosure of sensitive information (markets) ? “Buy” unlocking of online accounts/passwords (low as $29 USD) ? Security controls that are built, aren’t secure (i.e lost password security question challenges)
?Do you see “SQL Injection or Cross Site Scripting in this list?
Jeremiah Grossman, Trey Ford (Whitehat Security Inc)

Are you sure this is Real? Affiliate Scams
Affiliate Scams – Go undetected to the normal user, but behind the scenes hackers and companies collect thousands of $$

Hacking for a Fee! ?Hacking for a fee (small). Online services, provide a facility to request password recover of accounts, or gain access to services.

Lessons learnt from 2007-2008

Lesson #1
Whatever we are doing now, it’s not working, because the vulnerabilities aren’t going away!
12

Lesson #2
The landscape and attack vectors change very quickly, some defensive techniques can’t keep up.

Lesson #3
Percentage Likelihood that a particular web site has a vulnerability. (2008)
Jeremiah Grossman, Trey Ford (Blackhat 2008, Presentation)

Lesson #4
Business Logic exploits and direct application attacks.
Attack History
2008
Network protocols (DNS/TCP-IP) attacked
2004
Increase Application style attacks (SQL Injection, XSS etc)
2000
Internet Browsers & Social Engineering
1997
Increase Internet protocol attacks, MailBomb, SPAM etc
1994

The “Business Software Assurance” Approach

What is Business Software Assurance?
It’s NOT just a tool to install, and flick a switch!

Business Software Assurance
Importance
Industry Technical Guidance
Education Training Awareness
Security Testing Assessment Products & Automation
Business Threat-Risk & Process Policy
Business Software Assurance

Business Software Assurance “Sources”
OWASP WASC NIST etc Secure Coding Awareness Static & Dynamic Analysis Threat-Risk Policies SAMM
Industry Technical Guidance
Education Training Awareness
Security Testing Assessment Products & Automation
Business Threat-Risk & Process Policy
Business Software Assurance

Software Assurance Maturity Model “” ”Business Strategy”
“”