Denim Group, Ltd.

Denim Group at OWASP AppSec USA 2010 in Irvine

By Dan Cornell

OWASP AppSec USA is coming up next week at UC-Irvine.  This is shaping up to be a great conference.  Denim Group is a sponsor and we will doing some training and giving some talks.

I’ll be teaching a 1-day course on Software Security Remediation on Tuesday September 7^th, 2010.  This isn’t a “how to hack” course or a theoretical “build new software securely” course.  Instead we will be dealing with how you can fix existing software that is full of vulnerabilities.  There is material on process and theory mixed with hands-on examples.  Should be a good time.

Then John Dickson will be chairing a panel discussion on Thursday at 10:35am titled “Characterizing Software Security as a Mainstream Business Risk – How to Talk to Other CXOs about Software Security”  He has folks such as Tom Brennan (Proactive Risk), Ed Pagett (Lender Processing Services), Richard Greenberg (Los Angeles County Department of Public Health) and John Sapp (McKesson) so this should be a spirited and interesting discussion.

Then I’m giving a presentation at 3:30 on Thursday on smartphone application security: “Smart Phones, Dumb Apps”  We will be looking at threat models for smartphone applications as well as assessment techniques and defense mechanisms.

We will also have a booth and generally be running around.  Contact us if you would like to meet up at OWASP AppSec US 2010.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

KartCon 2010

By John Dickson

Over 100 hard core web application security gurus recently gathered in Las Vegas for what is becoming one of the most popular side events for the annual Black Hat/DefCon security conferences.  The 2010 KartCon sponsored by the Open Web Application Security Conference (OWASP) let many of web application security deep thinkers to let off some steam and get to know each other outside the context of a conference setting.  Denim Group was a key sponsor of the event, and Dan Cornell and I both tried our skills on the go kart track.  Good news: no one was seriously physically injured, although at least one racer has his pride injured when Tom Brennan of ProActive Risk lapped him on the track.  In the end, it was good fun, and industry leaders had a chance to meet and great and use the event as a great excuse to drive go karts for hours.

See attached pictures and videos to get a sense of the excitement of KartCon 2010:

John

--

john _at_ denimgroup.com

@johnbdickson

See and download the full gallery on posterous

Posted via email from Denim Group's Posterous

Smartphone Application Security Interview on Untether.tv

By Dan Cornell

Rob Woodbridge from Untether.tv interviewed me about smartphone application security and the video interview went online today:

We talked a lot about application and software security in general as well as threat models specific to smartphone applications.  There was also a lot of discussion of OWASP and the upcoming OWASP AppSec USA conference in LA.

Contact us for more information about smartphone security.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

"Five Things for Smart Mobile Application Developers to Know About Security" article on Smart Products Ecosystem Connections (SPEC)

By Dan Cornell

The Smart Products Ecosystem Connections (SPEC) folks published an article of mine titled Smart Mobile | Five Things for Smart Mobile Application Developers to Know About Security.  The article provides recommendations to help developers designing and building smartphone applications build their systems securely from the ground up.

Contact us for help securing your smartphone applications.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Software Security Remediation Course at OWASP AppSec USA: September 7th, 2010

By Dan Cornell

I will be teaching a one-day course on Software Security Remediation at AppSec USA 2010 on September 7^th.  The course fee is only $675 - click here to register.

There are lots of courses that teach you how to build secure software from the ground up.  There are also lots of courses that will teach you how to assess the security of existing software.  This course is unique because it focuses on a HUGE problem all organizations have: dealing with a large number of identified vulnerabilities in deployed code.

Course Description:

This class teaches attendees how to fix security vulnerabilities in existing software. It provides a mix of discussion of project concerns for planning and managing remediation efforts with hands-on coding examples fixing specific vulnerabilities. Attendees will learn how to risk-rank vulnerabilities, estimate remediation tasks, perform coding fixes for vulnerabilities and demonstrate the effectiveness of fixes applied. The focus is on the practical: how to use limited resources to make significant improvements to the security of target applications. Code examples use the OWASP ESAPI Java and Microsoft Web Protection Library. Many classes teach developers how to build secure code from the ground up or teach security analysts how to test applications for security vulnerabilities. This class teaches developers and security analysts how to deal with their existing portfolio of insecure applications.

Duration:  1 day

Primary Audience: Software developers

Secondary Audience: Project managers, application security testers, quality assurance testers

Prerequisites: Experience developing enterprise applications in Java or .NET, knowledge of software and application security topics.

Syllabus:

1. Introduction and Background

2. Structure of Remediation Projects

a. Inception

b. Planning

c. Execution

3. Virtual Patching

a. Overview

b. Applicability

c. Approaches

4. Inception in Detail

a. Identifying stakeholders

b. Setting goals

5. Exercise: Fixing SQL Injection Vulnerabilities

a. String SQL Injection

b. Integer SQL Injection

6. Planning in Detail

a. Calculating risk

b. Determining fix approaches and confirmation tests

c. Calculating level of effort

i. Technical vulnerabilities

ii. Logical vulnerabilities

d. Scheduling

i. Waterfall methodologies

ii. Agile methodologies

7. Exercise: Fixing Cross-Site Scripting (XSS) Vulnerabilities

a. Reflected XSS

b. Stored XSS

c. DOM-based XSS

8. Execution in Detail

a. Fixing vulnerabilities

b. Confirming fixes

c. Functional and regression testing

d. Deployment

9. Exercise: Fixing Authorization Vulnerabilities

a. Failure to restrict URL access

b. Insecure direct object reference

10. Remediation Metrics

a. What to track

b. Benchmarking versus emerging industry data

11. Exercise: Remediating Sample RiskEUtility Application

a. Inception

b. Planning

12. Conclusion and Final Questions

Here is the main training page for OWASP AppSec USA 2010 and you can click here to register.

Contact us for help fixing security issues you have identified in your applications.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Jeremiah Grossman to Present at OWASP San Antonio: Wednesday August 18, 2010

By Dan Cornell

The regularly-scheduled August meeting for OWASP San Antonio will feature WhiteHat Security Founder and CTO Jeremiah Grossman.  He will be presenting on their 9^th Web Security Statistics Report on “Which Web Programming Languages are Most Secure”

More information below:

  

San Antonio OWASP Chapter: Wed August 18, 2010

Topic: Which Web Programming Languages are Most Secure?

Presenter: Jeremiah Grossman, Founder and CTO, WhiteHat Security

Date: Wednesday, August 18, 2010 11:30am – 1:00pm

Location:

San Antonio Technology Center (Web Room)

3463 Magic Drive

San Antonio, TX 78229

View Larger Map

Abstract:

Security-conscious organizations make implementing a software security development lifecycle a priority. As part of the process, they evaluate a large number of development technologies for building websites. The assumption by many is that not all development environments are created equal. So the question often asked is, “What is the most secure programming language or development framework available?”

Clearly, familiarity with a specific product, whether it is designed to be secure-by-default or must be configured properly, and whether various libraries are available, can drastically impact the outcome. Still, conventional wisdom suggests that most popular modern languages / frameworks (commercial & open source) perform relatively similarly when it comes to an overall security posture. At least in theory, none is markedly or noticeably more secure than another. Suggesting PHP, Java, C# and others are any more secure than other frameworks is sure to spark heated debate.

As has been said in the past, “In theory, there is no difference between theory and practice. But, in practice, there is.” Until now, no website security study has provided empirical research measuring how various Web programming languages / frameworks actively perform in the field. To which classes of attack are they most prone, how often and for how long; and, how do they fare against popular alternatives? Is it really true that popular modern languages / frameworks yield similar results in production websites?

By analyzing the vulnerability assessment results of nearly 1,700 websites under WhiteHat Sentinel management, we may begin to answer some of these questions. These answers may enable the website security community to ask better and deeper questions, which will eventually lead to more secure websites. Organizations deploying these technologies can have a closer look at particularly risk-prone areas; software vendors may focus on areas found lacking; and, developers will increase their familiarity with the strength and weaknesses of their technology stack. All of this is vitally important because security must be baked into development frameworks and be virtually transparent. Only then will application security progress be made.

Presenter Bio:

Jeremiah Grossman founded WhiteHat Security in August 2001.

A world-renowned expert in Web security, Mr. Grossman is a founder of the Web Application Security Consortium (WASC), and was named to InfoWorld's Top 25 CTOs for 2007.

Mr. Grossman is a frequent speaker at industry events including the Black Hat Briefings, RSA Conference, ISACA, CSI, InfoSec World, OWASP, ISSA, and Defcon as well as a number of large universities. He has authored dozens of articles and white papers, is credited with the discovery of many cutting-edge attack and defensive techniques and is a co-author of XSS Attacks: Cross Site Scripting Exploits and Defense.

Mr. Grossman is frequently quoted in major media outlets such as USA Today, the Washington Post, The Financial Times, InformationWeek, InfoWorld, USA Today, PC World, Dark Reading, SC Magazine, CNET, CSO and NBC news. He frequently alerts the media community to the latest attacks and is not only able to offer in-depth commentary, but also provide his perspective of what’s to come.

Mr. Grossman was named a “friend of Google” and is also an influential blogger (www.jeremiahgrossman.blogspot.com) who offers insight and encourages open dialogue regarding current research and vulnerability trend information.

Prior to WhiteHat, Mr. Grossman was an information security officer at Yahoo! responsible for performing security reviews on the company's hundreds of websites. Before Yahoo!, Mr. Grossman worked for Amgen, Inc.

Sodas and snacks will be provided.  Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com  or call (210) 572-4400.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Dinis Cruz to Present at OWASP San Antonio: Friday August 13, 2010

By Dan Cornell

The San Antonio chapter of OWASP is lucky to be hosting a special meeting with a presentation from OWASP Board Member Dinis Cruz on Friday August 13^th, 2010.  Dinis is doing a whirlwind tour of US-based OWASP chapters to talk about two big topics:

1.    How OWASP Works / Guided Tour of OWASP Projects

2.    Using the O2 Platform to Consume OWASP Projects

More information below:

Sponsored by:

  

San Antonio OWASP Chapter: Fri. August 13, 2010

Topic: 1)How OWASP Works and Guided Tour of OWASP Projects /

           2) Using the O2 Platform to Consume OWASP projects

Presenter: Dinis Cruz

Date: Friday, August 13, 2010, 2010 11:30am – 1:00pm

Location:

San Antonio Technology Center (Web Room)

3463 Magic Drive

San Antonio, TX 78229

View Larger Map

Abstract:

1) How OWASP Works and Guided Tour of OWASP Projects - This presentation will focus on my experience in getting things done at OWASP, what resources are available and what types of initiatives should the local chapters be doing. In addition to a quick overview of a number of key OWASP projects, this talk will also provide a tutorial on how the OWASP WIKI (MediaWiki based) can be used as a database (using the MediaWiki templates technology)

2) Using the O2 Platform to Consume OWASP projects - This presentation will focus on how to consume the OWASP Wiki and a number of OWASP projects using the OWASP O2 Platform. The O2 Platform has powerful technology and capabilities for both BlackBox and WhiteBox analysis and this presentation will provide examples on how to use O2 with: WebGoat, WebScarab, Code Crawler, Dir Buster,  Testing Guide, Code Review Guide and OpenSAMM

The O2 Platform is focused on automating application security knowledge and workflows. It is specifically designed for developers and security consultants to be able to perform quick, effective and thorough 'source-code-driven' application security reviews (BlackBox + WhiteBox). In addition to the manual findings created/discovered by security consultants, the OWASP O2 Platform allows the easy consumption of results from multiple OWASP  projects and commercial scanning tools. This allows security consultants to find, exploit and automate (via Unit Tests) security vulnerabilities usually dismissed by the community as impossible to find/recreate. More importantly, it provides the Security Consultants a mechanism to: a) 'talk' with developers (via UnitTest) ,  b) give developers a way to replicate + "check if it's fixed" the vulnerabilities reported and c) engage on a two-way conversion on the best way to fix/remediate those vulnerabilities.

Presenter Bio:

Dinis Cruz is a Security Consultant based in London (UK) and specialized in: ASP.NET/J2EE Application Security, Application Security audits and .NET Security Curriculum Development.

For the past years Dinis has focused on the field of Static Source Code analysis, from May 2007 to Dec 2009 he worked as a independent consultant for Ounce Labs (bought by IBM in July 2009) where during active security engagements using Ounce's technology he developed the Open Source codebase which now is the foundation of the OWASP O2 Platform.

Dinis is currently focused on making the O2 Platform the industry standard for consuming, instrumenting and data-sharing between the multiple WebAppSec tools, the Security consultants and the final developers.

Dinis is a also active trainer on .Net security having written and delivered courses for IOActive, Foundstone, Intense School and KPMG (at multiple locations including BlackHat), and has delivered a number of presentations and keynote speeches at multiple OWASP and Security related conferences

At OWASP, Dinis is the leader of the OWASP O2 Platform project, member of the OWASP Global Projects Committee, chair of the OWASP Connections Committee and member of the OWASP Board.

Sodas and snacks will be provided.  Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com  or call (210) 572-4400.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Preview of My Interview with Untether.tv on Smartphone Application Security

By Dan Cornell

I had a great time talking with Rob Woodbridge from Untether.tv today about smartphone application security.  He posted a short clip with some thoughts on resources for developers who want to build secure applications as well as enterprises who want to purchase secure applications:

I mention a number of OWASP resources in the clip:

·         OWASP Top 10 2010

·         OWASP Secure Development Guide

·         OWASP Testing Guide

·         OWASP OpenSAMM

·         OWASP Application Security Verification Standard (ASVS)

The rest of the interview should be online next week and I will post a link once it is available.

Contact us for help securing your smartphone applications.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Denim Group Recommends 10 Ways for Software Developers to Interact More Effectively with Information Security Teams

By Dan Cornell

Denim Group just posted a release about 10 ways for software developers to interact more effectively with Information Security teams.  Since we do both software development and remediation as well as software security consulting we have a unique perspective on how these groups can come to a better understanding.

You can see a copy of the release here: Denim Group Recommends 10 Ways for Software Developers to Interact More Effectively with Information Security Teams.

Contact us for help getting your development and security teams to work better together.

--Dan

dan _at_ denimgroup.com

@danielcornell

Media Advisory

Agency Contact:                                                                                Denim Group Contact:

Alan Weinkrantz                                                                                 John Dickson

210.410-3075                                                                                      210.572.4400

alan@weinkrantz.com                                                                        john@denimgroup.com

Denim Group Recommends 10 Ways for Software Developers to Interact More Effectively with Information Security Teams

Development teams can use these steps to address security concerns and minimize disruptions to project release commitments.

San Antonio, TX – July 21, 2010 - Denim Group, an IT consultancy that develops secure software and helps organizations assess and mitigate risk with their existing software, provides guidance to software development teams looking to collaborate better with security teams. 

Software development teams are constantly under pressure to release new software products on a timely basis. While security requirements are acknowledged as important, features and functionality are typically at the top of the priority list for new releases. Given the increase in application level attacks, inclusion of security requirements will be a constant facet of software development efforts in the future.

The following list represents best practices Denim Group has observed in client environments where software development teams collaborate effectively with security teams:

1.      Have at least one developer on the team who is able to speak in depth about security. Hire someone specifically for this purpose, or grow someone within the team.

2.      Run all developers through some form of security awareness training.

3.      Make a list of your applications with some of their characteristics, and share this list with your security team.

4.      Use one of the freely available web proxies or application scanners to test one or two of your applications.

5.      Download an easily attainable source code scanning tool, and run it against your code.

6.      Benchmark your team against a software security maturity model, such as OpenSAMM.

7.      Reach out to your security team with the results of your initial efforts. Take the initiative in order to encourage activity on your schedule.

8.      Move any vulnerabilities that have been identified into your defect tracking system so they can be prioritized and systematically addressed.

9.      Fix some of the vulnerabilities identified in your applications. Prove you are taking security seriously by picking a handful of the most critical vulnerabilities and fixing them.

10.  Ask for input from the security team at the beginning of a new project or development effort.

Follow these steps to get your development team on the right track to addressing security concerns. For further analysis, the detailed list of best practices with descriptions can be found at the Denim Group blog at: http://tinyurl.com/3xefvh2.

“Security requirements for software projects are becoming a more consistent reality for development teams,” said Dan Cornell, Chief Technology Officer of Denim Group.  “Proactively opening lines of communication between software developers and information security professionals will help ensure vulnerabilities are identified and fixed more quickly.  This will help avoid business disruption and ultimately save organizations time and money.”

About Denim Group

Denim Group develops secure software, helps organizations assess and mitigate risk with existing software, and provides training on best practices in software security. Denim Group has worked with a range of Fortune 500 companies and public sector organizations, bringing a focused software development approach to the world of software security. Denim Group is a strong contributor to the larger application security community, and has been involved with the Open Web Application Security Project (OWASP) since shortly after its inception. Additionally, Denim Group was ranked 1,751 in Inc. Magazine's 5000 Fastest-Growing Private Companies in America in 2009. For more information about Denim Group, visit www.denimgroup.com.

Reader Contact Information:
Denim Group, 3463 Magic Drive, Suite 315; San Antonio, TX 78229, Tel: 210-572-4400, Fax: 210-572-4401, www.denimgroup.com, john@denimgroup.com.

###

Posted via email from Denim Group's Posterous

10 Ways for Software Developers to Interact More Effectively with Information Security Teams

By Dan Cornell

[This is an expansion on a previous blog post titled 5 Things Every Development Manager Should Do Before the Security Team Shows Up.]

The following list represents a list of best practices that Denim Group has observed in innovative client environments where software development teams have collaborated effectively with their security counterparts:

1.    Have at least one developer on the team who is able to speak in depth about security. Hire someone specifically for this purpose, or grow someone within the team.  Send them to an OWASP conference or at least have them read up on the OWASP site as well as other materials available online and in books.  This shouldn’t be a hard sell for your developers – security is an interesting discipline and a growing concern – talented developers interested in advancing their careers know this is a hot area and will dive in to learn more.

2.    Run all developers through some form of security awareness training.  Not every developer is going to be an expert in security, but all of them need to at least know the fundamentals.  There are classes and eLearning available to teach these fundamentals, but even having some informal lunch and learn sessions is better than nothing.  Keep track of the attendees for these events – this is valuable because you can prove that your team is not completely in the dark with regard to security.

3.    Make a list of your applications with some of their characteristics, and share this list with your security team.  Which are the important ones?  What technologies are in use?  What sort of data do they store and manipulate?  How many page or lines of code do they have?  Down the road you will likely have to provide security teams with much more information about your applications, but this is a starting point and you can use it to provide evidence that you have thought about your application portfolio.

4.    Use one of the freely available web proxies or application scanners to test one or two of your applications.  At this stage efforts will be ad hoc.  This is fine – consult the OWASP Testing Guide for guidance and set reasonable expectations.  This should not be mistaken for a comprehensive application testing program, but will provide some insight on how this activity can be incorporated into development processes.  Also – save the results of your testing.  You can offer these up to the security folks as evidence of your fledging efforts.

5.    Download an easily attainable source code scanning tool, and run it against your code.  You should expect to see some false positives as well as results that might be hard to interpret.  Again – this is not a substitute for a comprehensive security code review program but should provide some insights.  As with the dynamic testing – save the results.

6.    Benchmark your team against a software security maturity model, such as OpenSAMM.  These models provide a comprehensive view of how security can be integrated into the software development lifecycle and can provide structure for prioritizing activities.  Perform an informal assessment of your practices and save the results.

7.    Reach out to your security team with the results of your initial efforts. Take the initiative in order to encourage activity on your schedule.  Discuss the results of any code or application scanning as well as your informal maturity model assessment.  This helps to demonstrate that you take their concerns seriously and helps allow you to control the conversation.

8.    Move any vulnerabilities that have been identified into your defect tracking system so they can be prioritized and systematically addressed.  Translating security vulnerabilities into software defects is an important step when integrating security into the development lifecycle.

9.    Fix some of the vulnerabilities identified in your applications. Prove you are taking security seriously by picking a handful of the most critical vulnerabilities and fixing them.  This is often the best way to demonstrate to security teams that you have heard their concerns and are willing to work to address them.  Work with security to determine the most serious vulnerabilities to address first as well as what changes should be made in order to successfully address the issues.

10.  Ask for input from the security team at the beginning of a new project or development effort.  As with software defects, security vulnerabilities – especially those that stem from poor architecture or design – are much cheaper and easier to address if caught earlier in the development effort.  Proactively requesting some guidance on threat modeling and coding standards can help avoid frustrating and costly late-project hassles.

Security teams need to know that developers have a lot of work to do and not all of it involves security.  Conversely, development teams need to understand that the applications they build affect the security of their customers and organizations.

Contact us for help getting your develment and security teams working together.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous