presentatie php benelux groep

Protect your image & brand

Application Security

Who we are

SEBYDE (se-bie-de)

– Secure by Design

Derk Yntema

– 20+ year experience in ICT and IT Security

– IT management architect

– Portfolio manager security

Rob Koch

– 20+ years experience in account management at software companies and telecom industry

IBM business partner

IBM authorised reseller

Gartner: 75% of all attacks on web sites and web applications target the application level and not the infrastructure.

The Dutch developer

“ The Dutch developer works more iterative (agile) than linear (waterfall).”

(source: automatiseringsgids 10th may 2012)

Internet has changed the world

Is ICT Security important?

The world has changed

– We work differently; “Het nieuwe werken”, BYOD

– More data in more applications

Internet

– Remote access to business networks

– Wireless Networks / Mobile applications

– Populair apps, email, Whatsapp, LinkedIn, Facebook, etc.

Hackers change their tactics

– Infrastructure -> applications

– Risk of digital theft become bigger and bigger …

Internet / Web-based applications

Internet has become a very important business platform

– B2C

– B2B

Business use Internet for marketing, communication, customer services, customer care etc

– 2,3 billion Internet users;

– 85% buy online;

– $ 200 billion turnover worldwide;

Applications are “Web-based” or “Web-facing”

Webshops

10,000

15,000

20,000

25,000

30,000

35,000

40,000

# of webshops in NL

Aantal webwinkels in

Turnover online shopping

Online winkelen (in

miljard euro)

The Dutch developer

“ the Dutch developer uses little to non supporting resources in the preliminary phase: when gathering requirements, or when making a design. A formal use case method (UML) is very seldom used. Tools like Requisite Pro, ClearCase, Rational Rose, Visual Pardigm are hardly ever used.”

(source: automatiseringsgids 10th May 2012)

Cybercrime

Cybercrime has surpassed illegal drug trafficking as a criminal moneymaker

Every 3 seconds an identity is stolen

Without security, your unprotected PC can become infected within four minutes of connecting to the internet

It is often facilitated by crime-ware programs such as keystroke loggers, viruses, rootkits or Trojan horses.

Software flaws or vulnerabilities often provide the foothold for the attacker. For example, criminals controlling a website may take advantage of a vulnerability in a Web browser to place a Trojan horse on the victim's computer.

The reality …

Cybercrime is no temporary phenomenon

Two “Leagues”: Junior en Major

If you think safety is expensive … try an accident

Criminals look differently at the value of assets

Effective security needs a short and long term approach

100% security is an illusion … prevention is key !

The “Tone at the top” is important

Source : Summary of KPMG Advisory NV report “Een genuanceerde visie op cybercrime. Nieuwe perspectieven vragen om actie”

TNO: Damage Cybercrime: yearly € 10 billion

Cybercrime damage NL 10-30 billion / year

9 % aimed at web applications 0,9 – 2,7 billion

60% SQL injection / XSS 0,5 – 1,6 billion

Vulnerabilities in websites

14%10%

Probability

Information leakage

Cross Site Scripting

Content Spoofing

Cross Site Request Forgery

Brute Force

Insufficient authorisation

Predictable Resource Location

SQL Injection

Session fixation

Abuse of functionality

The Dutch developer

“ Release management is generally accepted. Coding standards are commonly used.”

Target organisations

Financials

– Internet banking

– Financial transactions

Industries

– SCADA networks

Companies

– IP

– Merger & takeovers

– Customer data

Governments

– Espionage

– Identity fraud

Hosting providers

– Image

– Outages

Application developers

– Liability

– High development costs

Healthcare

– Privacy (WBP; EU privacy act)

IBM’s X-Force Report 2011: 41% of all security incidents are caused byWeb applications.

Damage

Reputation / Brand

– Defacement

– Costs: ????

– Indirect (ISP)

Liability claims

Information damage

– Financial

– Business information

– Privacy info

– Identity

System outage

– Availability

81% of the Web applications do not comply to the PCI-DSS standard (Payment Card Industry Digital Security Standard).

But still ….

Security is not my responsibility.

Security? “That is done by the ICT department”

I do not work with computers so I can’t be hurt!

I don’t work with sensitive information.

Our company is not a target.

I am not a target!

What can they steal here?

We have several firewalls.

We are safe, we have security guidelines.

It is not our responsibility, we have out-sourced our IT.

We use the cloud so our cloud provider has arranged security

On average, every 1,000 lines of code has at least 5 to 15 defects (United States Department of Defense)

I am no target?

Febelfin

– Belgium federation of the financial sector.

http://www.youtube.com/watch?v=F7pYHN9iC9I

“What can they get here?”

“We will not be hacked!”

“We have firewalls”

“We have procedures!”

Security in real life

We have to

– Government

– Noted on exchange (NYSE)

– Law and directives

– Privacy

– Industry standards

Incidents

– Reactive

– Panic

Testing is done for

– Functionality

– Performance

Google : Over 2 million searches every month on “how to hack”.

The Dutch developer

“ Too little time is spend on testing. Still testing, traditionally done at the end of development, is being compromised.”

Focus shift hackers

FromInfrastructure

75% of all hacks are performed on Web applications / Websites

ToApplications

From Chinese walls to integrated security

More facts …

60-80% of the Web applications / Websites have a minimum of one security weak point.

75% of all hacks are performed on Web applications / Websites

IDC Research: 25% of all companies are “exploited” via a weak spot in Web Application security.

Ignorant users are contaminated by websites with malware on it.

Google : >2 Million searches on “how to hack” every month, or to download hacking tools etcetera.

Why are applications unsafe?

Time to market

– Business pressure

– Project budget

Software is complex

– Windows 7 contains 50 million lines of code

Networking

– Internet technology

Globalizing

– Software comes from everywhere

Extensibility

– JAVA VM, .NET, …etc.

No education

Chinese walls

– False sense of security

Security awareness

– Continue process

– Attitude / behavior

Software ages

Application security is not sexy

1) SQL-Injection

2) Cross Site Scripting (XSS)

3) Broken Authentication and Session Management

4) Insecure Direct Object References

5) Cross Site Request Forgery (CSRF)

6) Security Misconfiguration

7) Failure to Restrict URL Access

8) Unvalidated Redirects and Forwards

9) Insecure Cryptographic Storage

10) Insufficient Transport Layer Protection

60% of all attacks !!!

OWASP top ten

1. Injection

Ability to inject commandstrings

– Database (SQL)

– Operating System

– LDAP

– Directories

Vulnerability

The best way to determine whether an application is vulnerable to injection is by checking whether input data is kept separate from a command or query.Poor error handling makes injection vulnerability easy to detect.

Example

The application uses non-validated data in the composition of the SQL call:

String query = "SELECT * FROM accounts WHEREcustID = '" + request.getParameter ("id") + "'";

The attacker changes the 'id' parameter in their browser and sends: 'or '1' = '1. This change will query all records returned from the accounts database, instead of just one customer.

http://example.com/app/accountView?id = 'or '1' = '1

In the worst case, the attacker can control a stored procedure so that the entire database is copied or even the operating system is controlled.

Mitigation

For SQL calls, this means the use of static queries or stored procedures. Avoid dynamic SQL!

Use parameters to commands to send. Please note that improper use of parameters.

Validate input through a white list. So only that which you know do you allow.

Apply strict access control to what an application may systems; least privilege.

https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

The pressure mounts

Government

– EU

– NCSC

Law & regulations

– Privacy law (CBP)

– Industry regulations (PCI-DSS, Basel III, NEN7510)

What can we do

Prevent

– Awareness

– Design & build secure

Reduce

– Monitor

– Manage

Transfer

– Insurance

Accept

The Dutch developer

“Documenting is reluctantly done. This is considered the most annoying aspect of the work.”

Complete security

People

Process

Security

Secure byDesign

Technology

Zero incident culture

Security awareness

– Training

– Education

– Awareness

– Motivation

– Attitude

From “unconscious unsafe” to“unconscious safe”

Security awareness must rest in the cortex

IDC research: 25% van alle bedrijven worden “exploited” via een zwakke plek in de Web Application security.

Awareness: Information has value

Customer data

annual figures, the profit forecast

(Re)modelling plans

Employee data

Tenders and contracts

Bookkeeping

Phone & email lists

“Smoelenboek”

Adding security during coding costs 6.5 times more than architecting it during software design process.

Unconscious unsafe

Conscious unsafe

Conscious safe

Unconscious safe

What to achieve?

Not only doing the right things, but do things right

Attitude

Behavior

Training

Education

Instruction

Repetition

The Dutch developer

“The appeal to the creativity and solving logical problems is considered to be the best aspect of his work, more fun than delivering a useful product.”

Processes

Policy

– Laws and regulations

– Guidelines, standards, rules

Organisation

– Helpdesk

– CERT-team

Processes

– Identity/access management

– Incident management

– Patch management

– SDLC

IDC research: 25% of all companies are exploited through a weakspot in their Web Application security.

Evaluate

Analyse

Resolve

Prevent: Test

Manual

Automated

Black box

White box

Network

– Pentesting

Systems

Applications

– Dynamic

– Source code

Design

Secure by Design

Development

Static testen

Test phase

Acceptance testen

Deployment phase

Dynamic testen

Test early!

Early on testing saves a lot of money. 80% of development costs are spent on finding and solving problems.

Solving a vulnerability in the production phase costs 100 times more than addressing it in the design phase.

Loss of customer trust

Lawsuits

Brand damage

Test often

New releases

– Application

– Infrastructure

Periodic

– ½ year, a year

Framework upgrades

Integral part of the Software Development Life Cycle (UTAP)

Technology

Network

– Zoning (ie. DMZ)

– Firewalls, IPS, WAF

Systemen

– Hardening

– Accesscontrol

– Updates / Patching

– Malware scanners

Applicaties

– Testing

– Audits

– Secure by Design

Why secure coding

Governance

– Manageability

– Reputation

Compliance

– PCI-DSS

– Privacy law

– EU directive

Efficiency

– Early on security saves money

About the Dutch developer

“Repetitive tasks, like testing, is the most annoying aspect of the work.”

Best practices

Prevention is key; test early & often

Validate all input and output

Deny by default, Fail Secure (closed)

Fail Safe

Make it simple (KISS)

Defense in depth

Only as secure as your weakest link

Wrong: “Security by obscurity”

https://www.owasp.org/index.php/How_to_write_insecure_code

Important sources

OWASP www.owasp.org

Sans www.sans.org

NCSC www.ncsc.nl

CVE http://cve.mitre.org/

www.waarschuwingsdienst.nl

Contact us

E-mail info@sebyde.nl

Web www.sebyde.nl

Twitter http://www.twitter.com/SebydeBV

LinkedIn http://www.linkedin.com/company/sebyde-bv

Facebook http://facebook.com/SebydeBV

Prezi http://t.co/eKr7VzE8

Rob Koch (rob.koch@sebyde.nl)Derk Yntema (derk.yntema@sebyde.nl)

Thank You

presentatie php benelux groep

sebyde bvtno

sebyde bvwho

sebyde bvwebshops

sebyde bvcybercrimecybercrime

sebyde bvons

sebyde bvvulnerabilities

sebyde bv tar

web sites

Documents

digital groep congres 2011 presentatie henk mensink

presentatie startbijeenkomst kwaliteitsverantwoording groep...

presentatie 100% groep

rabobank groep halfjaarverslag 2013 presentatie

presentatie groep 5 en 6

presentatie groep 8 mariaschool ulft

presentatie gepersonaliseerd leren in groep

presentatie ve interactive benelux shopping innovation expo

presentatie startbijeenkomst kwaliteitsverantwoording groep...

kpc groep presentatie group travel & events 2013

persoonlijke marketing presentatie voor abc-groep

presentatie walbeek groep

presentatie koudijs groep bv

algemene presentatie wvs-groep

presentatie gids groep

presentatie tuinte groep 2012@linkedin

digital groep congres 2011 presentatie henk sligman

presentatie numac groep kort

werelderfgoed presentatie groep nl 2010

presentatie hanze media groep