Bohdan Serednytskiy

1. Security fix or workaround:
which way to select?
Bohdan Serednytskyi, OWASP Lviv

2. • OWASP Lviv Chapter
• Security Consulting Team at SoftServe
We are…

3. Communication with client
Project Execution
Delivering Results
Consulting Dev Team in issues fixing
Usual Project Flow

4. Tools will solve all our problems
Clients Vision

5. https://www.outpost24.com/wp-content/uploads/2014/12/Picture1-1024x610.jpg
Automated Tools Effectiveness

6. • All application security tool vendors’ claims put
together cover only 45% of the known vulnerability
types (over 600 in CWE).
• They also found very little overlap between tools, so
to get 45% you need them all (assuming their
claims are true)
MITRE Claims

7. Case with One Educational Application

8. Risk Vulnerability
Critical CROSS-SITE REQUEST FORGERY (CSRF)
CROSS-SITE SCRIPTING (STORED)
High SESSION TOKEN DOES NOT CHANGE AFTER LOGIN
Medium USERLOGINID ENUMERATION
WEAK PASSWORD REQUIREMENTS
NO LOGOUT FUNCTION IMPLEMENTED
ACCOUNT ENUMERATION
IMPROPER ACCESS CONTROL
STUDENT CAN REVEAL TEACHERS LOGIN FROM SERVER RESPONSE
Low
ERROR MESSAGES REVEAL SENSITIVE INFORMATION
INTERNAL IP ADDRESS DISCLOSURE
INSUFFICIENT PASSWORD HISTORY MANAGEMENT
Remediation Status
PARTIALLY FIXED
NEED IMPROVEMENT
FIXED
FIXED
FIXED
FIXED
FIXED
FIXED
NOT FIXED
FIXED
FIXED
FIXED
Security Test Results

9. XSS Vulnerability Fixing
‘});alert(1)”
Initial payload
Protection implemented by Developers Team
‘});alert(1)”
‘});alert(1)”
Modified payload
‘});alert(1)”

10. CSRF and Information Leakage Fixing

11. Best Practices

12. Every security flaw is a process problem

13. Security vulnerabilities are “patterned”.

14. Security issue could be widespread
amongst all code bases.

15. Ensure that root cause analysis is used
Remove as many vulnerabilities of this type as is possible within
the prescribed time frame or budget
Involve Security Expert
Recommendations

16. Use Fast Fix Methods - WAFs
A security solution on the
web application level which
does not depend on the
application itself

17. Security Expert is not a Developer

18. •OWASP Secure Coding Practices
•OWASP Guide Project
•OWASP Enterprise Security API
•Microsoft Web Protection Library
Resources

19. Security is a Journey
Not a Destination

20. • Patching
• Updating
• Continuous Security Monitoring
• Regular Security Tests

21. Questions?

22. Thank You!
http://owasp-lviv.blogspot.com/