Every IT manager, sysAdmin, or developer is facing an increasing demand to put in place security measures that improve infrastructure and applications, while complying with projects requirements. You've probably heard all this before, but with very few solid ways to tackle the real security issues. We're here to cut through the jargon overdose and show you practical, live examples of a few common - and surprisingly simple - vulnerabilities being exploited in real time. We’ll also show you how quickly we can solve them in OutSystems. Learn about: - Layered Security in OutSystems - Open Communication Channels, Cookies, and Session Fixation Attacks - Code Injection - Open Redirection Attacks - * Sensitive User Forms Protection in OutSystems Free Online training: https://www.outsystems.com/learn/courses/ Follow us on Twitter http://www.twitter.com/OutSystemsDev Like us on Facebook http://www.Facebook.com/OutSystemsDev

1. Cover Your Bases
A Security Webinar

2. Ivo Gonçalves
Platform Operations
Expert Services
ivo.goncalves@outsystems.com
https://www.linkedin.com/in/ivomgoncalves
Paulo Costa
Platform Operations
Expert Services
paulo.costa@outsystems.com
https://www.linkedin.com/in/pauloalex

3. Agenda
• What is IT security?
• Layered security.
• Secure your infrastructure and your application with OutSystems recommendations:
○ 7 common vulnerabilities.
■ Vulnerability explanation and mitigation.

4. What is IT security?
“IT Security is the process of implementing measures and systems designed to securely
protect and safeguard information (...) against any unauthorized access, misuse,
malfunction, modification, destruction, or improper disclosure (...)”
Sans Institute
Confidentiality
Availability
Integrity
CIA Triad
Confidentiality
Prevent unauthorized parties to access the information.
Integrity
Prevent data manipulation and deletion by unauthorized parties.
Availability
Information is always available to authorized parties.

5. Layered security
“Layered security combines multiple security measures to make sure that you don't
have all your security eggs in one basket. This protects you from different sources and
different types of threats.”
Fortinet blog, 14 January 2014
Application
Application Servers
Systems and Network
Development practices
Security configurations deployed in the surrounding infrastructure
Security configurations deployed in the application servers

6. Security and OutSystems
● Generated code is subject of advanced vulnerability scanning.
○ OutSystems applications are mostly secure.
● Exploits on user code can still be present.
● Application Servers and Systems and Network layers may have vulnerabilities.
● No system is 100% secure.

7. Security assessment
Improve your applications security

8. 1) Open communication channels

9. Description
Open communication channels
• Information exchanged in plain text.
• Network monitoring:
○ Eavesdropping and tampering.

10. Mitigation

11. Mitigation — HTTPS
Application Server Layer
• Acquire a digital certificate.
• Configure your application server to support HTTPS.
• Disable SSL 2.0 and 3.0.
• Prevent BEAST attacks.
• Mobile requires valid and trusted certificates.

12. • Enforce HSTS headers.
Mitigation — HTTPS
Application Server Layer
Service Center Lifetime

13. • HTTPS for all screens and integrations.
Mitigation — HTTPS
Application Server Layer
Service Center Lifetime

14. • HTTPS for all screens and integrations.
Mitigation — HTTPS
Application Layer
Web Screens
Integrations
Web Flows

15. 2) Session cookies without “secure”
flag

16. Description
Session cookie without “secure” flag
• Session cookies transmitted in plain text:
○ E.g. Session ID.
• Session hijack.

17. Mitigation — Secure Session Cookies
Application Layer
• Set ‘secure’ flag for session cookies.
○ Factory Configuration.

18. 3) Session fixation

19. Description
Session Fixation
• Session ID doesn’t change.
• Session hijack.

20. Mitigation — Session Fixation
Application Layer
• Implement Token-based authentication and session ID regeneration.

21. 4) Injections

22. Description
Injection/Code injection
• Application handles untrusted data poorly.
• Application allows relaying malicious code to other systems (e.g. SQL Injection).
• Application allows injecting code that is then interpreted/executed (e.g. XSS,
HTML injection).

23. Mitigation — Injection/Code Injection
Application Layer
• Escape content.
• Encode/Sanitize content.
• Mobile apps escape all inputted content.

24. 5) Open redirect

25. Description
Open redirect
• AKA Unvalidated Redirects and Forwards.
• Application allows redirect requests to an untrusted URL.
• Commonly used for phishing attacks.

26. Mitigation — Open Redirect
Application Layer
• Don’t use dynamic URL redirects from input.
• If you do, use built-in functions:
○ ReplaceURLDomain
• If you need to redirect to other domains, check the input URL against a whitelist.

27. 6) Sensitive user forms with
autocomplete

28. Description
Sensitive user forms with autocomplete
• User forms cache sensitive information (e.g. credit card number, email, etc).
• Allows retrieving previously used data.

29. Mitigation — Sensitive Information User Forms
Application Layer
• Disable autocomplete for sensitive user forms.

30. 7) User enumeration

31. Description
User enumeration
• Application reveals if the username exists.
• Dictionary attack.
• OutSystems 10 has built-in brute force login protection.

32. Mitigation — User Enumeration
Application Layer
• Display generic messages.
• Update the code that reveals user information.

33. OWASP 10 Matrix
OWASP Reference Webinar Reference
A1 Injection 4) Injections
A2 Broken Authentication and Session Management
1) Open communication channels
2) Session cookies without “secure” flag
3) Session fixation
A3 Cross-Site Scripting 4) Injections
A6 Sensitive Data Exposure
6) Sensitive user forms with autocomplete
7) User Enumeration
A10 Unvalidated Redirects and Forward 5) Open redirect

34. Thank you!