Denim Group, Ltd. Blog

alan@weinkrantz.com john@denimgroup.com

PRESS RELEASE

Agency Contact: Denim Group Contact:

Alan Weinkrantz John Dickson

210.820.3070 210.572.4400

Denim Group Contributes First-ever Web Application Attack Component to College Cyber Defense Competition

Event Focuses on Teaching Students to Protect Networks – and Now Web Applications –

Against Cyber Attacks

San Antonio, TX – March 23, 2010 – Denim Group, an IT consultancy that develops secure software and helps organizations assess and mitigate risks with their existing software, announced today that it is contributing a first-ever web application-based attack component to the National Collegiate Cyber Defense Competition (NCCDC). The NCCDC, to be held April 16-18, exposes students to threats they will encounter in corporate IT environments upon graduation. With the addition of Denim Group’s web application attacks, competitors will be exposed to more sophisticated threats that exist when sensitive software systems are exposed on the web. A related video may be viewed at: http://tinyurl.com/ydphkzd.

Each team in the competition is responsible for maintaining services on a network while attackers try to interrupt and deny these services to corporate users. Increasingly, employers are demanding that security professionals understand application-level threats, which was the motivation behind Denim Group donating the application scenario. These risks are confirmed by the SANS Institute, who has observed that more than 70 percent of hacker attacks worldwide target web applications.

“Having Denim Group participate in this event makes this competition even more invaluable because this is the first time we’ve been able to include application-level attack scenarios for these competitors to deal with,” said Dwayne Williams, Associate Director – Special Programs at the Center for Infrastructure Assurance at the University of Texas at San Antonio. “The NCCDC is the national championship of many state level CCDC events, and so the competitors here are the best of the lot, ready to take on complex challenges.”

“The national trend is for more enhanced cyber security training - these application-level components help take the NCCDC’s competition to a new level,” said Dan Cornell, CTO of Denim Group. “The Rockefeller-Snowe legislation and Howard Schmidt, the White House Cyber Security Czar, have both emphasized the importance of realistic training for our next generation of cyber security professionals, and this contribution is in that spirit.”

About Denim Group

Denim Group develops secure software, helps organizations assess and mitigate risk with existing software, and provides training on best practices in software security. Denim Group has worked with a range of Fortune 500 companies and public sector organizations, bringing a focused software development approach to the world of software security. Denim Group is a strong contributor to the larger application security community, and has been involved with the Open Web Application Security Project (OWASP) since shortly after its inception. Additionally, Denim Group was ranked 1,751 in Inc. Magazine's 5000 Fastest-Growing Private Companies in America in 2009. For more information about Denim Group, visit www.denimgroup.com.

About the NCCDC

The NCCDC is a three day event and the first competition that specifically focuses on the operational aspect of managing and protecting an existing “commercial” network infrastructure. The event gives students a chance to test their knowledge in an operational environment and network with industry professionals who are always on the look out for up-and-coming engineers. The NCCDC is an annual event that began in 2006 and the championship of the CCDC competition events at the state level. Up to 600 people compete in the CCDC state events, with more than 60 competitors making it to the NCCDC championship competition.

Reader Contact Information:

Denim Group, 3463 Magic Drive, Suite 315; San Antonio, TX 78229, Tel: 210-572-4400, Fax: 210-572-4401, www.denimgroup.com, john@denimgroup.com.

# # #

March 23, 2010 | Permalink | Comments (0) | TrackBack (0)

March 22, 2010

Example of Scripting OWASP WebScarab: The Poor-Man's Client-Side mod_rewrite

OWASP’s WebScarab is a Java-based web proxy. We use it quite a bit in our web application security assessments and training classes. It also comes in handy as a debugging tool when building web applications.

This weekend I was having problems with a misconfigured off-the-shelf web application that was rendering URLs incorrectly on the server side. It was sending back bad URLs for the included images and stylesheets, causing the pages to render incorrectly and basically making the site unusable. If I had all sorts of time on my hands perhaps I would do something like “go and find the root cause and actually fix the underlying problem” Since I’m kind of lazy and was in a bit of a time crunch I decided to just write a quick script in WebScarab to rewrite the URLs on the client side. That way the request URLs get changed before they reach the server side, the server sends back the proper resources and the site works like it should.

I didn’t want to rewrite all of the request URLs because the ones for dynamic content were being rendered correctly. I only wanted to modify the ones for static HTML/image/stylesheets. So… if the server tells the browser to request:

/cgi-bin/cgi.exe/application/html/images/logo.gif

what I actually want to request is:

/html/images/logo.gif

Below is the code I used. To make it work you should just have to set the stringToFind and stringToReplace variables.

/* Please read the JavaDoc and/or the source to understand what methods are available */

import org.owasp.webscarab.model.Request;

import org.owasp.webscarab.model.Response;

import org.owasp.webscarab.httpclient.HTTPClient;

import org.owasp.webscarab.model.HttpUrl;

import java.io.IOException;

public Response fetchResponse(HTTPClient nextPlugin, Request request) throws IOException {

// TODO - Update these strings for the desired replacement

String stringToFind = "/cgi-bin/cgi.exe/application/html";

String stringToReplace = "/cgi-bin/cgi.exe/application";

String originalUrl = request.getURL().toString();

if(originalUrl != null) {

int startIndex = originalUrl.indexOf(stringToFind);

if(startIndex >= 0) {

String newUrlStart = originalUrl.substring(0, startIndex);

String newUrlEnd = originalUrl.substring(startIndex + stringToReplace.length());

String newUrl = newUrlStart + newUrlEnd;

request.setURL(new HttpUrl(newUrl));

} else {

// No need to rewrite the URL

}

response = nextPlugin.fetchResponse(request);

return response;

}

This code gets placed in the Proxy -> Bean Shell tab and you click Commit to enable it. Worked like a champ.

--Dan

dan _at_ denimgroup.com

March 22, 2010 | Permalink | Comments (1) | TrackBack (0)

March 17, 2010

4 Tips for Making the Most of Your Developer Security Training Program

I’ve had the opportunity to work with a number of firms training their developers in secure development techniques. Obviously the quality of the training content and the trainer is key – especially for a topic area such as application security where you are trying to give students the ability to think on their feet (or at the keyboard or whiteboard or whatever). However there are also other things organizations can do to make sure they get the most out of the money and time they spend on training that rely on how they promote and follow up after the training and have less to do with the training provider. Here are some tips from my experiences:

1. Provide context for the training – One firm we worked with did an obviously poor job of letting developers know what the training class was for and why they were receiving the training. The class was advertised to attendees as “PCI Training” when it was actually secure development training being undertaken in part to meet PCI requirements. At the beginning of the class when I asked one of the attendees why he was there he said “the only reason I am here is because my boss said I had to be” If the attendees know more about what they are learning and how it fits into their jobs they will retain more of the information and providing this context and setting expectations has to happen before the trainer sets foot on site.

2. Use the right tool for the job – eLearning is great for making sure everyone has a baseline of knowledge and for dealing with employee turnover, but for the people you really want to be the “go-to” security mavens it is really valuable to give them an opportunity to interact with an instructor. Firms that rely solely on eLearning run the risk of not developing this leader-class of security-smart developers who can act as internal resources. And most firms can’t afford the money and time to run every developer through extensive classroom training. A blended approach helps to address the need for baselining knowledge as well as the need to develop some internal security superstars. We have used this approach successfully with a number of firms.

3. Don’t train developers and then declare victory – Just because developers know what they should do doesn’t mean they will actually do it. We have seen this repeatedly – an organization runs a training class or two and then is shocked when their next round of external testing still identifies new vulnerabilities. Training is one aspect of a overall software security program but so is threat modeling, code review, penetration testing and so on. Look to resources such as the Software Assurance Maturity Model (OpenSAMM) for more information on the variety of practices and checkpoints leading organizations use when constructing their assurance programs. Training done in a vacuum runs the risk of not actually changing behavior.

4. Demonstrate that management cares about developing secure software – Another firm we worked with had us start out every training class with two videos. One was from the CIO and the other was from the head of application development, and both of them carried the message “Protecting customer information keeps me up at night. We have to do it well to earn our customers’ trust and if we do it poorly it will seriously damage our relationship with them.” As mentioned above – letting the attendees know that management cares about the outcome of the class beyond just being able to check a compliance box is key if you want attendees to pay attention and retain the material. These videos got attendees’ attention right from the outset.

Training is an important part of any software security program. Hopefully by following these tips folks can get more value out of their time and effort they are putting into training their developers.

Contact us for more information on instructor-led training and eLearning for teaching developers how to build secure applications.

--Dan

dan _at_ denimgroup.com

March 17, 2010 | Permalink | Comments (0) | TrackBack (0)

Denim Group is Hiring: Come and Help Us Create a World Where Technology is Trusted

Denim Group is hiring! You should get in touch if you are interested in:

· Writing secure code and building secure systems

· Testing systems for security weaknesses via code review and dynamic (penetration) testing

· Teaching other developers how to build and test for themselves

We are looking for people with a “builder” mentality who also have “breaker” skills. People tend to rotate between roles so we aren’t just looking for pen testers – we need folks who are looking to write code as well.

You can see more information about the job description here.

You can apply online here.

Or contact us for more information.

--Dan

dan _at_ denimgroup.com

March 17, 2010 | Permalink | Comments (0) | TrackBack (0)

March 09, 2010

John Dickson Video On His Talk at RSA

Denim Group’s John Dickson was interviewed after he led a discussion at RSA 2010 about building management support for software security programs. The video is online here:

--Dan

dan _at_ denimgroup.com

March 09, 2010 | Permalink | Comments (0) | TrackBack (0)

March 05, 2010

Vulnerability Manager: Summary of the Tech Preview Release

Over the past week or so I’ve put up a number of posts with additional information about the Vulnerability Manager, how its internals are structured as well as future plans. This post consolidates all of that information into a single reference with links to the blog posts and the specific related pages on the Vulnerability Manager website.

*Topic Area*	*Main Web Page*	*Blog Post*
Application Portfolio Management	Portfolio Management	Portfolio Management
Vulnerability Import and Consolidation	Import and Consolidation	Import and Consolidation
Automatic Virtual Patch Generation	Virtual Patch Generation	Virtual Patch Generation
Attack Tracking	Attack Tracking	Attack Tracking
Converting Security Vulnerabilities to Software Defects	Defect Tracker Integration	Defect Tracker Integration
Team Maturity Evaluation	Maturity Evaluation	Maturity Evaluation

I spent most of the week at RSA and had a lot of great conversations with customers and product vendors about the current state of Vulnerability Manager, our plans for the future as well as opportunities for new features and new integrations. People tend to agree that for the application and software security industry to mature we need to move beyond a focus on finding vulnerabilities to a more holistic view of the process of creating and maintaining secure software. Also, having open, standards-based tools available for software security teams will help more organizations get started addressing application security issues.

Please feel free to suggest features or improvements and contact us if you would like help standing up a software security team.

--Dan

dan _at_ denimgroup.com

March 05, 2010 in Application Security Remediation | Permalink | Comments (0) | TrackBack (0)

March 02, 2010

Vulnerability Manager: Team Maturity Evaluation

Up to this point, all of the Vulnerability Manager functionality we have talked about has been centered around applications and vulnerabilities: tracking your application portfolio, importing and consolidating vulnerabilities, auto-generating virtual patches, and integrating with defect tracking systems. However, security isn’t only about vulnerabilities and their remediation – you also need to understand your organization’s practices for creating security software. How good are they and are they getting better over time?

Vulnerability Manager allows you to evaluate development teams and their practices against common maturity models. This provies a central location for sofware securty teams to compare teams to one another as well as lay out roadmaps for improving team practices over time.

The current implementation works by uploading XML templates describing the maturity model you want to use for evaluation as well as interview questions to help determine if the described practices are in place. Right now we support the Software Assurance Maturity Model and the evaluation interview questions are adapted from work done by Nick Coblentz. In the future we will likely support other maturity models in the space such as the Building Security In Maturity Model (BSI-MM).

Just for the fun of it – and to see how well we could support different maturity models – I put together an XML version of Joel Spolsky’s Joel Test. This is a basic 12-question survey to see if a software development team has basic best-practices in place. It isn’t security specific, but does serve as a useful guide for basic development practices. It isn’t included in the “technology preview” release but email me if you would like a copy. It will probably be included in subsequent releases.

Down the road we hope to be able to correlate team practices and maturity levels to the security of the software those teams are creating. That will let software security teams answer questions like “Are the teams we provided secure coding training to introducing fewer vulnerabilities?” and “Did deploying a static analysis tool reduce the time required to fix vulnerabilities?”

So Vulnerability Manager isn’t all about vulnerabilities. A goal is to provide a central place for software security teams to perform their job functions and to be able to use that central data to make better business decisions. Provding facilities to track team maturity and lay out roadmaps helps software security teams both see the state of their world today as well as plan for the future.

--Dan

dan _at_ denimgroup.com

March 02, 2010 in Application Security Remediation | Permalink | Comments (0) | TrackBack (0)

San Antonio OWASP Chapter: Wed March 17, 2010

The March meeting of OWASP San Antonio is coming up in about two weeks. Details for the meeting are below – hope to see folks there.

--Dan

dan _at_ denimgroup.com

Sponsored by:

San Antonio OWASP Chapter: Wed March 17, 2010

Topic: Protecting Your Applications: How to Secure Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration

Presenter: Clint Pollock

Date: Wednesday, March 17th, 2010 11:30am – 1:00pm

Location:

San Antonio Technology Center (Web Room)

3463 Magic Drive

San Antonio, TX 78229

View Larger Map

Abstract:

With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers.

Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams.

In this session we will cover;

· Prevalence of backdoors and malicious code in third party attacks

· Definitions and classifications of backdoors and their impact on your applications

· Methods to identify, track and remediate these vulnerabilities

Presenter Bio:

Clint Pollock is a Senior Solutions Architect at Veracode. Since 1997, he has also created security solutions for large-scale enterprise environments on behalf of CREDANT Technologies and Netegrity. In his current role, Clint helps globally distributed organizations evaluate, track, and mitigate their online business risk. Clint’s greatest strengths are his enthusiasm, experience and determination to help customers succeed in maintaining secure, compliant systems, and avoid the consequences and bad headlines that come with application security breaches. Clint resides in Chicago, IL.

FREE PIZZA will be provided, courtesy of our friends from Veracode.

Please RSVP: E-mail owasprsvp@denimgroup.com or call (210) 572-4400.