Setting up a secure development life cycle with OWASP - seba deleersnyder


Published on

Using the OWASP Software Assurance Maturity Model (OpenSAMM) as a framework, this talk covers the major application security controls of a secure development lifecycle program as provided by OWASP. Featured OWASP open source material include: OWASP guidelines and tools such as ESAPI, ZAProxy, as well as educational resources.

Published in: Technology
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • REMEMBER… OWASP IS JUST PEOPLEAppSec is about not about tools or technology… it’s about people. OWASP is about community.______________
  • Define building blocks for an assurance programDelineate all functions within an organization that could be improved over timeDefine how building blocks should be combinedMake creating change in iterations a no-brainerDefine details for each building block clearlyClarify the security-relevant parts in a widely applicable way (for any org doing software development)
  • Three successive Objectives under each Practice define how it can be improved over timeThis establishes a notion of a Level at which an organization fulfills a given PracticeThe three Levels for a Practice generally correspond to:(0: Implicit starting point with the Practice unfulfilled)1: Initial understanding and ad hoc provision of the Practice2: Increase efficiency and/or effectiveness of the Practice3: Comprehensive mastery of the Practice at scale
  • The Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development lifecycle. At only 17 pages long, it is easy to read and digest.The focus is on secure coding requirements, rather then on vulnerabilities and exploits. It includes an introduction to Software Security Principles and a glossary of key terms.It is designed to serve as a secure coding kick-start tool and easy reference, to help development teams quickly understand secure coding practices.
  • LAPSE+ is a security scanner for detecting vulnerabilities of untrusted data injection in Java EE Applications. It has been developed as a plugin for Eclipse Java Development Environment,FxCop: An application that analyzes managed code assemblies for conformance to the Microsoft .NET Framework Design GuidelinesIn addition to security checks, FxCop analyzes assemblies for areas of improvement in design, localization, and performanceCAT.NET is a snap-in to the Visual Studio IDE that helps you identify security flaws within a managed code (C#, Visual Basic .NET, J#) application you are developing. It does so by scanning the binary and/or assembly of the application, and tracing the data flow among its statements, methods, and assemblies. This includes indirect data types such as property assignments and instance tainting operations. The engine works by reading the target assembly and all reference assemblies used in the application -- module-by-module -- and then analyzing all of the methods contained within each. It finally displays the issues its finds in a list that you can use to jump directly to the places in your application's source code where those issues were found. The following rules are currently support by this version of the tool. - Cross Site Scripting - SQL Injection - Process Command Injection - File Canonicalization - Exception Information - LDAP Injection - XPATH Injection - Redirection to User Controlled SiteWhile MS has not released the new version, the good news is you can still use the old Add-in for CAT.NET in Visual Studio 2010. tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.
  • ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.The ESAPI is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway. The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers. ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.Allowing for language-specific differences, all OWASP ESAPI versions have the same basic design:There is a set of security control interfaces. They define for example types of parameters that are passed to types of security controls.There is a reference implementation for each security control. The logic is not organization‐specific and the logic is not application‐specific. An example: string‐based input validation.There are optionally your own implementations for each security control. There may be application logic contained in these classes which may be developed by or for your organization. An example: enterprise authentication.
  • The attacker can send data in any encoding. And the interpreters downstream from your application may decide to handle any encoding.CanonicalizeInput could be in any character setDouble-encodingMultiple encoding schemesDouble-encoding with multiple encoding schemesValidationSimple to configure for positive rulesImpossible to do perfectly, since you need special charactersGetSafeValueRich content – strip out bad stuff and continueDifficult – need to fully parse HTMLCanonicalize and Validate from databaseWatch out mass SQL injection?EncodeForHTMLNot perfect since browsers allow encoded characters to execute (particularly in attributes)Have to avoid double-encodingSetCharacterSetBrowser will try to guess the encoding
  • Stable quality projects are generally the level of quality of professional tools or documents.PROTECT - These are tools and documents that can be used to guard against security-related design and implementation flaws.Tools: AntiSamy Java/:NET, Enterprise Security API (ESAPI), ModSecurity Core Rule Set ProjectDocumentation: Development Guide, .NET, Ruby on Rails Security Guide, Secure Coding Practices - Quick Reference GuideDETECT - These are tools and documents that can be used to find security-related design and implementation flaws.LIFE CYCLE - These are tools and documents that can be used to add security-related activities into the Software Development Life Cycle (SDLC).
  • Setting up a secure development life cycle with OWASP - seba deleersnyder

    1. 1. BrightTALKApplication Security summit The OWASP Foundation 14-Nov-2012 Setting up a Secure Development Life Cycle with OWASP Seba Deleersnyder OWASP Foundation Board Member 1
    2. 2. Seba Deleersnyder?  Based in Belgium  5 years developer experience / 12 years information security experience  AppSec consultant, specialised in secure development lifecycle projects  Belgian OWASP chapter founder  OWASP board member   Co-organizer 2
    3. 3. OWASP WorldOWASP is a worldwide free and Everyone is free to participate inopen community focused on OWASP and all of our materialsimproving the security of are available under a free andapplication software. open software license.Our mission is to make The OWASP Foundation is aapplication security visible so 501c3 not-for-profit charitablethat people and organizations organization that ensures thecan make informed decisions ongoing availability and supportabout application security risks. for our work. 3
    4. 4. The web application security challenge Your security “perimeter” has huge holes at the application layerApplication Layer Legacy Systems Human Resrcs Web Services Directories Databases Billing Custom Developed Application Code APPLICATION ATTACK App Server Web ServerNetwork Layer Hardened OS Firewall Firewall You can’t use network layer protection (firewall, SSL, IDS, hardening) to stop or detect application layer attacks 4
    5. 5. D B T P SAMM “Build in” software assurance proactive reactive security coding guidelines security testing vulnerability requirements / code reviews dynamic test scanning - threat modeling static test tools tools WAF Design Build Test Production Secure Development Lifecycle (SAMM)5  5
    6. 6. Software development lifecycle (SDLC) Waterfall Agile 6
    7. 7. D B T P SAMMWe need a Maturity Model An organization‟s Changes must behavior be iterative while changes slowly working toward over time long-term goals There is no A solution must single recipe that enable risk- based choices works for all tailored to the organizations organization Guidance related A solution must to security provide enough activities must be details for non- prescriptive security-people Overall, must be OWASP simple, well- Software Assurance defined, and Maturity Model measurable (SAMM) 7
    8. 8. D B T P SAMMSAMM Security Practices • From each of the Business Functions, 3 Security Practices are defined • The Security Practices cover all areas relevant to software security assurance • Each one is a „silo‟ for improvement 8
    9. 9. D B T P SAMMThree successive Objectivesunder each Practice 9
    10. 10. D B T P SAMM Education & GuidanceGive a man a fish and you feed him for a day;Teach a man to fish and you feed him for a lifetime.Chinese proverb Resources: • OWASP Top 10 • OWASP Education • WebGoat 10
    11. 11. D B T P SAMM Secure Coding Practices Quick Reference Guide• Technology agnostic coding practices• What to do, not how to do it• Compact, but comprehensive checklist format• Focuses on secure coding requirements, rather then on vulnerabilities and exploits• Includes a cross referenced glossary to get developers and security folks talking the same language 11
    12. 12. D B T P SAMM Code Review SDL Integration: • Multiple reviews defined as deliverables in your SDLC • Structured, repeatable process with management support • Reviews are exit criteria for the development and test phasesResources:• OWASP Code Review Guide 12
    13. 13. D B T P SAMMOWASP Cheat Sheets 13
    14. 14. D B T P SAMM Code review tooling Code review tools: • OWASP LAPSE (Security scanner for Java EE Applications) • MS FxCop / CAT.NET (Code Analysis Tool for .NET) • Agnitio (open source Manual source code review support tool) 14
    15. 15. D B T P SAMM Security Testing SDL Integration: • Integrate dynamic security testing as part of you test cycles • Derive test cases from the security requirements that apply • Check business logic soundness as well as common vulnerabilities • Review results with stakeholders prior to release Resources: • OWASP ASVS • OWASP Testing Guide 15
    16. 16. D B T P SAMM Security TestingZed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applicationsProvides automated scanners as well as a set of tools that allow you to find security vulnerabilities manuallyFeatures:• Intercepting proxy• Automated scanner• Passive scanner• Brute force scanner• Spider• Fuzzer• Port scanner• Dynamic SSL Certificates• API• Beanshell integration 16
    17. 17. D B T P SAMM Web Application Firewalls Malicious web traffic Legitimate web traffic Port 80 Web Web client Network Web Application (browser) Firewall Server FirewallModSecurity: Worlds No 1 open source Web Application• HTTP Traffic Logging• Real-Time Monitoring and Attack Detection• Attack Prevention and Just-in-time Patching• Flexible Rule Engine• Embedded Deployment (Apache, IIS7 and Nginx)• Network-Based Deployment (reverse proxy)OWASP ModSecurity Core Rule Set Project, generic, plug-n-play set of WAF rules 17
    18. 18. D B T P SAMM The OWASP Enterprise Security API Custom Enterprise Web Application Enterprise Security API SecurityConfiguration AccessReferenceMap EncryptedProperties Exception Handling IntrusionDetector AccessControllerAuthenticator HTTPUtilities Randomizer Encryptor Validator Encoder Logger User Existing Enterprise Security Services/Libraries 18
    19. 19. D B T P SAMM Validation, Encoding, and Injection Global Validate Any Interpreter Specific Validate Canonicalize Sanitize Web Service Any Encoding Controller Database Mainframe User Business Data Functions Layer Etc… User Interface File System Set Character Set Canonicalize Encode For HTML ValidateExample and working code snippets to perform input validation and output encoding 19
    20. 20. 150+ OWASP Projects PROTECT Tools: AntiSamy Java/:NET, Enterprise Security API (ESAPI), ModSecurity Core Rule Set Project Docs: Development Guide, .NET, Ruby on Rails Security Guide, Secure Coding Practices - Quick Reference Guide DETECT Tools: JBroFuzz, Lice CD, WebScarab, Zed Attack Proxy Docs: Application Security Verification Standard, Code Review Guide, Testing Guide, Top Ten Project LIFE CYCLE SAMM, WebGoat, Legal Project 20
    21. 21. D B T P SAMM Get started Step 1: Step 2: define Step 3: definequestionnaire your maturity phased as-is goal roadmap 21
    22. 22. Get involved• Use and donate back!• Attend OWASP chapter meetings and conferences• Support OWASP become personal/company member 22
    23. 23. Q&A 23
    24. 24. Contact• @sebadele••• 24