Enterprise Application Security
Program : A cost-effective hack!
Tusnin Das
Ram Awasthi

Ingredients of an Enterprise
Application Security Program
•SAST
•DAST
•Security Analyst
•Reporting & Aggregation tools
Application Vulnerability
Management
Security Operation (Application
Level)
•WAF
•Log Monitoring

Have you thought about the cost?
SAST ,DAST & WAF
COST
YOU

What do you do when you have
nothing?

What options do we have?
SAST
DAST
Security
Vulnerability
Remediation
Testing &
Deployment
Traditional Approach Our Approach
Doing
the
right
thing
Across the application

What does it mean?
• Fix codes that result in security vulnerability
(How do I identify that?)
• Address it across the application with 100%
coverage (Is it possible?)
• Make it an iterative process

how do we do it?
Threat Modeling
Address each category
one by one
Checklist
• XSS
• XSRF
• SQL
Injection
• Privacy
violation
• Open
redirects
• Header
Injection

how to do it…continues
Checklist Action
SQL Injection Get rid of dynamic queries
XSS Output encoding across the application
XSRF •Identify forms
•Implement page token
Header Injection •Input validation
•Output encoding
Privacy violation Analyze DAR & DIM for sensitive data
Open Redirects •Input validation
•Output encoding
Configuration &
Deployment
•Get rid of default configurations
• Run dependency checker to identify
vulnerable packages/ libraries

how to do it…continues
• The IDE is not just editor. It is a
powerful search tool
• Use the search and replace function
for coverage
• Use regex to optimize your search

how to do it…almost there
• Make it a part of your SDLC
• Make it iterative
• People dependent ..however can be
scaled
• Does it mean the applications do not
have any more vulnerabilities after this
exercise?

In scope v/s out of scope
In Scope Out of scope
Code level flaws Session related flaws
Business validation
flaws

Security Operations
• Web Application Firewall (WAF)
• Log Analysis

Poor man’s arsenal
• Mod Security WAF
• ZAP Proxy / Burp Proxy
• OWASP Dependency checker
• ThreadFix
• Bugzilla
• Jenkins

Wake up. It’s Over!
Questions ?