Application Security - Enterprise...

Application Security –Enterprise Strategies

K. K. Mookhey, CISA, CISSP, CISM

www.niiconsulting.com

K. K. Mookhey, CISA, CISSP, CISMPrincipal Consultant

Agenda

� The Biggest Hack in History

� How the Cookie Crumbles?


� Answers!

Speaker Introduction

� Founder & Principal Consultant, Network Intelligence

� Speaker at Blackhat 2004, Interop 2005, IT Underground 2005, OWASP Asia 2008,2009

� Co-author of book on Metasploit Framework


� Co-author of book on Metasploit Framework (Syngress), Linux Security & Controls (ISACA)

� Author of numerous articles on SecurityFocus, IT Audit, IS Controls (ISACA)

� Conducted numerous pen-tests, application security assessments, forensics, etc.


THE BIGGEST HACK IN HISTORY

Gonzalez, TJX and Heart-break-land

� >200 million credit card number stolen

� Heartland Payment Systems, TJX, and 2 US national retailers hacked

� Modus operandi

� Visit retail stores to understand workings


� Visit retail stores to understand workings

� Analyze websites for vulnerabilities

� Hack in using SQL injection

� Inject malware

� Sniff for card numbers and details

� Hide tracks

The hacker underground

� Albert Gonzalez

� a/k/a “segvec,”

� a/k/a “soupnazi,”

� a/k/a “j4guar17”

� Malware, scripts and hacked data hosted on servers in:


� Malware, scripts and hacked data hosted on servers in:

� Latvia

� Netherlands

� IRC chats

� March 2007: Gonzalez “planning my second phase against Hannaford”

� December 2007: Hacker P.T. “that’s how [HACKER 2] hacked Hannaford.”

UkraineNew JerseyCalifornia

Where does all this end up?

IRC Channels#cc#ccards#ccinfo#ccpower#ccs#masterccs


� Commands used on IRC

� !cardable

� !cc, !cclimit, !chk, !cvv2, !exploit, !order.log, !proxychk

#masterccs#thacc#thecc#virgincc

TJX direct costs

$24 million to

$41 million to Visa

$200 million in fines/penalties


$24 million to Mastercard

Cost of an incident

� $6.6 million average cost of a data breach

� From this, cost of lost business is $4.6 million

� More than $200 per compromised record


On the other hand:

� Fixing a bug costs $400 to $4000

� Cost increases exponentially as time lapses

How the Cookie Crumbles


Betting blind!

� DB Name

� Table Names

� User IDs

� Table Structure

� Data


� Data

Net Result


Enterprise Owned!

Other aspects


• App2App interaction requires an authentication process

– Calling application needs to send credentials to target application

• Common use cases

– Applications and Scripts connecting to databases

– 3rd Party Products accessing network resources

App2App Communication


– 3rd Party Products accessing network resources

– Job Scheduling

– Application Server Connection Pools

– Distributed Computing Centers

– Application Encryption Key Management

– ATM, Kiosks, etc.

Answers!


Technology Solutions

� Web Application Firewalls

� Privileged Identity Management Suites


� Application-Aware Firewalls

� Application-Aware SIEMS

� Database Access Management Solutions

Before we get to the technology…


Design

Application Security – Holistic Solution


Develop/

Manage

Test

Train

Secure Design

� Secure Designing Models

� Client Inputs

� Client Education


� Client Education

� Threat Modeling

� Vulnerability Classification – STRIDE

� Risk Classification – DREAD

Microsoft’s Threat Modeling Tool


Secure Coding Overview

Secure coding isn’t taught in school

� Homeland Security's Build Security In Maturity Model (BSIMM)

� Microsoft's Security Development Lifecycle


� Microsoft's Security Development Lifecycle (SDL)

� OpenSAMM (Software Assurance Maturity Model)

� OWASP Secure Coding Guides

Secure Coding Principles

1. Minimize attack surface area

2. Establish secure defaults

3. Principle of least privilege

4. Principle of defense in depth

5. Fail securely


5. Fail securely

6. Don’t trust input – user or services

7. Separation of duties

8. Avoid security by obscurity

9. Keep security simple

10.Fix security issues correctly

Vendor Management

� Big names != Good security

� Contractual weaknesses


� Lack of vendor oversight

� No penalties for blatantly buggy code!

Secure Hosting

� Web Security

� Secured web server

� Secured application server –all components

� Web application firewalls

� Database Security

� OS Security

� Security Patches

� Users and Groups

� Access Control

� Security Policies

� Secured Login


� Database Security

� Security Patches

� Users and Roles

� Access Control

� Logging

� Password Security

� Database Table Encryption

� Data Masking

� Secured Login

� Logging

Secure Testing

� Security testing options

� Blackbox

� Greybox

� Whitebox

� Source Code Review


� OWASP Top Ten (www.owasp.org)

� OWASP Testing Guide

Tools of the tradeOpen source – Wikto, Paros, Webscarab, Firefox pluginsCommercial – Acunetix, Cenzic, Netsparker, Burpsuite

Training

� Back to basics

� Natural thought process


� Look at larger picture

� Make it fun

� Giving back to the community

Design

Application Security Vision


Develop/

Manage

Test

Train

Thank you!Questions?

[email protected]

Information Security Institute of Information


Information Security Consulting Services

Institute of Information Security

Application Security - Enterprise...

Documents

Transcript of Application Security - Enterprise...