Isaca app sec presentation - v3
•
3 likes•300 views
What are some major application securities risks that companies should be aware of in Application Security? I have listed 5 major application security risks that every company should address in order to enhance application security and reduce breaches: Risk 1: Incomplete Application Asset Inventory Risk 2: Lack of Secure Coding Practice (Training) Risk 3: Lack of Security Threat Modeling / Requirements Risk 4: Insufficient Security Testing Risk 5: Lack of Application Supply Chain Management
Recommended
More Related Content
What's hot
What's hot (17)
Similar to Isaca app sec presentation - v3
Similar to Isaca app sec presentation - v3 (20)
More from Kyle Lai
More from Kyle Lai (7)
Recently uploaded
Recently uploaded (20)
Isaca app sec presentation - v3
- 2. KLC CONSULTING PUBLIC INFORMATION 2 About Me Kyle Lai • Certified Security Professional (CISSP, CSSLP, CISA, CIPP/US, CIPP/G, ISO 27001 LA) • 25+ years in IT | 20 years in Information Security (Pentest, Third-party Risk, Compliance, Engineering…) • Experience in DoD, Financial, Energy, Healthcare, High Tech, Consulting… • Have consulted at Microsoft, PwC, Boeing, HP, Fidelity Investment, Akamai, Cathay Pacific Airlines, Leading Oil & Gas firm • Currently - Security Advisory Consultant for a large global oil & energy company • Former CISO of Pactera, a Global 100 IT Consulting firm, A Blackstone / HNA Company • Former CISO of Brandeis University – Heller School • Author of SMAC MAC Address Changer Tool – Over 2.5 million users worldwide • Run 3 LinkedIn Groups (i.e. Cybersecurity Community) LinkedIn: https://www.linkedin.com/in/kylelai Twitter: @KyleOnCyber
- 4. KLC CONSULTING PUBLIC INFORMATION 4 Agenda • Why Talk About Application Security? • What is Application Security? • Risk 1: Incomplete Application Asset Inventory • Risk 2: Lack of Secure Coding Practice (Training) • Risk 3: Security Threat Modeling / Requirements • Risk 4: Insufficient Security Testing • Risk 5: Lack of Application Supply Chain Management • Q&A
- 8. KLC CONSULTING PUBLIC INFORMATION 8 What is Application Security? Application security, or “AppSec,” is security measures to • protect its critical data from internal and external threats by ensuring the security of all of the software used to run the business, whether built internally, bought or downloaded. • help identify, fix and prevent security vulnerabilities in any kind of software application. Image Source: Veracode
- 9. KLC CONSULTING PUBLIC INFORMATION 9 Enterprise Application Security 1% of Security Budget Focuses on Application Security Gartner describes applications and security with the analogy of a crown jewel in a treasure chest: • The sensitive data is the crown jewel • The applications are the treasure chest Note: Applications include more than just Web Applications. IT Budget Devoted to Securing Applications
- 10. KLC CONSULTING PUBLIC INFORMATION 10 Risk 1: Incomplete Application Asset Inventory • You cannot protect an application which is not accounted for, or have inaccurate info. • Input and output of an application may come from other applications… Usually not tracked... • Owner of the application is usually not accurately documented due to personnel movement... • Some of the following might be missing in the asset inventory: • Type of application: custom developed, Commercial Off The Shelf (COTS), or open source software? • Is it a key components of other applications? (i.e. Oracle Database, SAP, SQL Server) • Is it internal use only, external use only, and both? • Is it used on servers, desktops, mobile, infrastructure, etc.? • Owner name • What type of data is collected / handled / processed? • Any PII, PHI, Privacy Information? • What is the data classification - highly confidential, confidential, internal, public, etc.…?
- 11. KLC CONSULTING PUBLIC INFORMATION 11 Risk 1: Recommendation • Automated scan for new web applications discovery • Establish and continuously update application asset inventory via tools • Update ownership information as owner changes • Define list of information to be gathered for each application (might use for app risk evaluation as well) , such as: • Custom developed, COTS, Open-Source • Data classification • Number of users • Internal, external (Internet), both • Mobile • Technology stack (if developed internally) • Relationship with other applications
- 13. KLC CONSULTING PUBLIC INFORMATION 13 Risk 2: Lack of Secure Coding Practice (Training) cont. • Developers do not have adequate training on secure coding practices • Developers are not familiar with the OWASP Top 10 vulnerabilities • Developers not familiar with secure coding practice in new environment or for new technologies, i.e. Cloud based platforms • Companies limit the budget for secure coding training • Developers want to do a good job but not empowered to do so • Fixing code during/post production costs 100 times more than fixing code during the design phase (Risk) • DevOps Movement – Automation with Increased app release frequency, making secure coding practice and app security training more critical
- 14. KLC CONSULTING PUBLIC INFORMATION 14 Risk 2: Recommendations • Continue to train the developers on Secure Coding Practice (in class or CBT) • Existing development languages and platforms • New development languages, platform, technologies, i.e. Cloud specific security features • Ensure developers understand the OWASP Top 10 vulnerabilities, and how to code properly to avoid them • OWASP Top 10 Web Application Vulnerabilities • OWASP Top 10 Mobile Application Vulnerabilities • OWASP Top 10 IoT Vulnerabilities • Provide security tools (i.e. Interactive Application Security Testing (IAST) tool) to your developers; enable them to check and fix their code security issues during the development phase.
- 18. KLC CONSULTING PUBLIC INFORMATION 18 Risk 3: Security Threat Modeling / Requirements • What are the safety code requirements to build a car? (Defined) • What are the safety code requirements to build a house? (Defined) • What are security coding requirements to build an application??? OR
- 19. KLC CONSULTING PUBLIC INFORMATION 19 Risk 3: Security Threat Modeling / Requirements • Industry has no common security requirements • Many developers are not doing security threat modeling – • Data Flow Diagram Analysis – Where can data be stolen and system be hacked? • Protocol communication between systems – Can someone tamper with the my communications? • Possible threats in the processes – • What are the different security boundaries during data flow?
- 20. KLC CONSULTING PUBLIC INFORMATION 20 Risk 3: Recommendation • Invest the time to do Threat Modeling • Develop security requirements to reduce threats • Developer friendly threat modeling tools: SD Element, Irius Risk • Microsoft offers free Threat Modeling Tool (A bit more technical)
- 23. KLC CONSULTING PUBLIC INFORMATION 23 Risk 4: Insufficient Security Testing • Many companies do not perform enough application security • Static Code Analysis (SAST) – Scan your source code • Dynamic Analysis (DAST) – Scan your web application • Interactive Testing (IAST) – Developers to test code interactively in the development environment • Runtime App Self-Protection (RASP) - Intercept and scan app request traffic • Mobile App Security Testing – Test mobile application binary, API, and back-end server interaction
- 24. KLC CONSULTING PUBLIC INFORMATION 24 Risk 4: Recommendation • Invest in experienced security professional • Invest in application security testing tools • If funding is very limited, invest in either IAST or DAST to start with, to get the most value • Expand the toolset as the application security program matures Sorry, This One Is Not Cheap…
- 25. KLC CONSULTING PUBLIC INFORMATION 25 Risk 5: Lack of Application Supply Chain Management A recent survey 2,292 IT professionals found that 80 - 90% of an application now consists of component parts. 386 applications found similar results with 82% of the applications built from open source components. Source: 2017 State of The Software Supply Chain by Sonatype
- 26. KLC CONSULTING PUBLIC INFORMATION 26 Risk 5: Lack of Application Supply Chain Management Source: Sonatype DevSecOps Community Survey 2017 • Companies are using open source components but only 6 out of 10 organizations have an open source governance policy in place • Increasing use of open source / third-party components makes tracking of bill of materials difficult! • If there’s a new vulnerability found in an open source or third-party component, would you know if any of your application is impacted?
- 28. KLC CONSULTING PUBLIC INFORMATION 28 Risk 5: Recommendation • Establish an authorized list of open source components • Make sure to establish an asset management process for open source • Establish an Open Source policy (if not done already) - • Evaluate needs and benefits • Ensure no equivalent software already been deployed in-house • Verify there is an active user community supporting the application. • Perform quality and security testing and validation • Defined quick approval process • If budget allowed, investigate into tools to manage open source components (i.e. Free: OWASP Dependency Checker; Commercial: Black Duck, Sonatype)
- 29. KLC CONSULTING PUBLIC INFORMATION 29 Note: How Mature is Your Application Security Program • Building Security In Maturity Model (BSIMM) • Measure maturity of Software Security Initiatives • http://www.bsimm.com • Free tool to assess yourself Source: Sonatype