owasp education project -developing secure applications

Copyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.

The OWASP Foundation

OWASP

http://www.owasp.org

OWASP Asia Pacific Conference 2008

OWASP Education Project -Developing Secure Applications

Martin KnoblochOWASP on the Move ProjectOWASP Speaker ProjectOWASP Education ProjectSogeti Nederland [email protected]+31-6 52 32 76 79

February 2008

OWASP

Developing Secure Applications

What Is Application Security?

Security Awareness!

Security Requirements?

Secure Development Process!

Stay Secure!

Summary, Questions And Discussion

OWASP

Quick side step- What is OWASP?

Open Web Application Security Project: The Open Web Application Security Project (OWASP) is

dedicated to finding and fighting the causes of insecure software.

Tools WebGoat Project WebScarab Project ...

Documentation AppSec FAQ Project Guide Project Legal Project Testing Guide Project Top Ten Project ...

OWASP



Security Awareness!



Stay Secure!


OWASP

What Is Application Security?What is application security?

Applications are about information!

3 pillars of Information Security:

Confidentiality

Integrity

Availability

OWASP

What Is Application Security?What is a secure application?

OWASP


Example:Hidden Fields

OWASP

Insecure Insecure

Functional

Specification

Technical

Implementation


An application is secure if it acts and reacts, as it expected, at any time!

Secure

OWASP



Security Awareness!



Stay Secure!


OWASP

Security Awareness!To be aware of what?

The environments in where the software applications run where closed.

By this, the applications could be developed ‘open’.

OWASP


The environments became more open over time.



OWASP


The environments became more open over time.

Which means, the applications have to become more closed.



OWASP

OWASP TOP TEN A1 Cross-Site Scripting (XSS)

Example:

OWASP


The Problems: Cookies, HTTP authentication, SSL.. Low learning curve Easy to attack (web) applications

OWASP


OWASP TOP TEN: 1. Cross Site Scripting 2. Injection Flaws 3. Malicious File Execution 4. Insecure Direct Object References 5. Cross Site Request Forgery 6. Information Leakage and Improper Error Handling 7. Broken Authentication and Session Management 8. Insecure Cryptographic Storage 9. Insecure Communication10. Failure to Restrict URL Access

OWASP


Source: www.mitre.org

OWASP


Consciously! Unconsciously! CRACKER HACKER SCRIPTKIDDIE

Risk =( )*Value Threats * Vulnerabilities

Countermeasures

User System Environment

OWASP

de username is 'PERSOONA'

en het wachtwoord is 'GEHEIM12‘

USERNAME: PERSOONAPASSWORD: GEHEIM12

de username is 'PERSOONA'

en het wachtwoord is 'GEHEIM12‘

of 1=1;

USERNAME: PERSOONAPASSWORD: GEHEIM12 of 1=1

OWASP TOP TEN A2 Injection Flaws

Example:

OWASP

Security Awareness!Who to make aware?

Functional Designers & Architects: It is not only about what functionality the application has to

supply, it also what it may not!

Engineers: Quality is not just ‘does it work’ .

Testers: Security weaknesses are not different from other, functional,

bugs. They can be traced down the same way.

Managers: Reserve project time for security Understand security as manditory value of an application

Security Analyst:Involve a security Analyst at the beginning of the design phase.

OWASP



Security Awareness!



Stay Secure!


OWASP

Security RequirementsFunction or Non-Fuctional?

Explanation bySponsor

Project Leaderinterpretation

Design byAnalist

Coded ProgramBus. Consultant

Description

ProjectDocumentation

OperationsInstallation Customer Billing

SupportPerformed

Actual UserWants and

Needs

OWASP

Security RequirementsSecurity requirements HOWTO!

User requirements

Businessrequirements

System requirements

F

u

n

c

t

i

o

n

a

l

Non

f

u

n

c

t

i

o

n

a

l

Businessrules

Externalinterfaces

Constraints

‘Why’

‘What’

‘How’

OWASP

OWASP TOP TEN A3 Malicious File Execution

Example:

OWASP



Security Awareness!



Stay Secure!


OWASP

PROTOCOLS

RULES

STANDARDS

BEST PRACTICES

TOOLING

Secure Development Process- How to develop secure applications!

EVALUATION

FEEDBACK

EXPERIENCE

EDUCATION

OWASP



Security Awareness!



Stay Secure!


OWASP

Stay Secure!Secure application configuration!

Development Environment

WebServer

Application Server

Database Server

Test Environment

WebServer

Application Server

Database Server

Production Environment

WebServer

Application Server

Database Server

System Environment

DMZ

Database User?

System User?System User?

FirewallFirewallFirewall

Internet

Error handling?

Error handling?

Error handling?

Private NetworkPrivate

Network

User Rights?

User Rights?

User Rights?

OWASP

OWASP TOP TEN A4 Insecure Direct Object Reference

Example:

OWASP

Stay Secure!Secure application configuration!

Development Environment

WebServer

Application Server

Database Server

Test Environment

WebServer

Application Server

Database Server

Production Environment

WebServer

Application Server

Database Server

Development Computer

Windows XP

Tomcat 5.5

JBoss 4.x

MySql 5.x

AMDLinux Suse 7.x

WebSphere 5

WebSphere 5

Oracle 8

IBMUnix

WebSphere 6

Oracle 10

WebSphere 6

OWASP



Security Awareness!



Stay Secure!


OWASP

Summary, questions and discussionQuestions?

OWASP


XSS flaws occur whenever an application takes user supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser which can hijack user sessions, deface web sites, possibly introduce worms, etc.

Making abuse of the trust a client has into a

website!

OWASP


Example:http://localhost/WebGoat/attack?Screen=15&menu=410LAB: Cross Site Scripting (XSS)

OWASP


Injection flaws, particularly SQL injection, are common in web applications. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or changing data.

OWASP

OWASP TOP TEN A2 Injection Flaws – SQL injection

Screen:USERNAME:[PERSONA]PASSWORD:[SECRET12]

On the server:username is 'PERSONA'

and the password is SECRET12';

Screen :USERNAME:[PERSONA]PASSWORD:[SECRET12 or 1=1]

On the server :username is ' PERSONA'

and the password is SECRET12' or 1=1;

OWASP


Example:http://localhost/WebGoat/attack?Screen=28&menu=610LAB: SQL Injection

OWASP


Code vulnerable to remote file inclusion (RFI) allows attackers to include hostile code and data, resulting in devastating attacks, such as total server compromise. Malicious file execution attacks affect PHP, XML and any framework which accepts filenames or files from users.

OWASP


Example:http://localhost/WebGoat/attack?Screen=2&menu=610

OWASP


A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter. Attackers can manipulate those references to access other objects without authorization.

OWASP


Example:

OWASP

OWASP TOP TEN A5 Cross-site Request Forgery (CSRF)

A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request to a vulnerable web application, which then forces the victim's browser to perform a hostile action to the benefit of the attacker. CSRF can be as powerful as the web application that it attacks.

Making abuse of the trust a client got from a website!CSRF vs. XSS

CSRF can be done by XSS XSS can be automated by CSRF

OWASP

OWASP TOP TEN A5 Cross-site Request Forgery (CSRF)

Example:http://localhost/WebGoat/attack?Screen=30&menu=210How to Perform Cross Site Request Forgery (CSRF)

OWASP

OWASP TOP TEN

A6 Information Leakage / Improper Error Handling

Applications can unintentionally leak information about their configuration, internal workings, or violate privacy through a variety of application problems. Attackers use this weakness to steal sensitive data, or conduct more serious attacks.

Gaining inside information Invalid Password / Invalid Username 404 Page not found / 403 Forbidden Stack trace on the webpage Information from log files

OWASP

OWASP TOP TEN

A6 Information Leakage / Improper Error Handling

Example:http://localhost/WebGoat/attack?Screen=49&menu=710How to Bypass a Fail Open Authentication Scheme

OWASP

OWASP TOP TEN

A7 Broken authentication and session management

Account credentials and session tokens are often not properly protected. Attackers compromise passwords, keys, or authentication tokens to assume other users' identities.

Session tokens kan be put in place by a hacker via an XSS of CSRF attack.

Session tokens kan easily be stolen because they are valid to long or insufficient protected. Session is still valid after login

OWASP

OWASP TOP TEN A8 Insecure Cryptographic Storage

Web applications rarely use cryptographic functions properly to protect data and credentials. Attackers use weakly protected data to conduct identity theft and other crimes, such as credit card fraud.

OWASP

OWASP TOP TEN A8 Insecure Cryptographic Storage

Example:

http://localhost/WebGoat/attack?Screen=14&menu=810Encoding Basics Webscarab Cookie collector 50x ofzo..

OWASP

OWASP TOP TENA9 Insecure Communication

Applications frequently fail to encrypt network traffic when it is necessary to protect sensitive communications.

OWASP

OWASP TOP TEN A10 Failure to Restrict URL Access

Frequently, an application only protects sensitive functionality by preventing the display of links or URLs to unauthorized users. Attackers can use this weakness to access and perform unauthorized operations by accessing those URLs directly.

OWASP

OWASP TOP TEN A10 Failure to Restrict URL Access

Example:

owasp education project -developing secure applications

Documents