Denim Group, Ltd. Blog

May 20, 2010 | Permalink | Comments (1) | TrackBack (0)

Denim Group at the 2010 Front Range OWASP Conference

Once again it is time for Colorado’s premiere application security conference: Front Range OWASP Conference 2010. Denim Group will be sponsoring. We will also be giving two presentations and John Dickson will be moderating a panel including Brian Chess and Jeremiah Grossman.

John Dickson will be giving the presentation: The Permanent Campaign: Driving a Secure Software Initiative in the Enterprise where he discusses strategies for getting upper management support for software security initiatives.

The abstract is:

The majority of information that exists about software security either focuses on technical means to build secure applications, or strategies to put controls in a software development process. There is a dearth of information regarding how managers should push secure initiatives forward, convincing executives that software security is critical to trusted business operations. This presentation focuses on how security officers or development leaders can apply a disciplined approach to building internal consensus to build secure software. A five-step process will be laid out that will enable a manager to characterize the landscape, secure management buy-in, baseline the existing risks, set modest goals and attempt to achieve them, and sustain the initiative. Emphasis will be on actionable steps that successful managers have used to drive the adoption of secure software strategies in large organizations.

Also Bryan Beverly will be giving the presentation: Application Security Program Management with Vulnerability Manager where he will demonstrate our open source Vulnerability Manager application and talking about how it can be used to centrally manage an organization’s application security efforts.

The abstract is:

Using free Java-based software, application security managers can now have increased visibility into and control of enterprise security programs as well as the data that can be used to support sophisticated conversations with their managers and executives. Denim Group's Vulnerability Manager works through a centralized system to allow security teams to import and consolidate application-level vulnerabilities, automatically generate virtual patches, monitor attack attempts, communicate with defect tracking systems, and evaluate team maturity. Vulnerability Manager is a Java-based web application available for free under the Mozilla Public License.

This demonstration will cover the major functional areas of the Vulnerability Manager:

• Application portfolio management – Creating a portfolio of application under management and tracking critical information about those applications such as associated technologies and sensitivity of data under management.

• Vulnerability import and merging – Importing results of both static and dynamic scans of code, de-duplicating results and merging the output from multiple tools into a unified view of the security state of an application.

• Automated virtual patch generation – Automatically creating IDS/IPS and WAF rules to provide real-time protection for certain classes of vulnerabilities as well as consuming log results from WAF/IDS/IPS in order to identify which vulnerabilities are under active attack.

• Defect tracker integration – Bundling multiple vulnerabilities into packages, sending them to software defect tracking systems, and monitoring the defects to identify when software developers have closed them out.

• Team maturity evaluation – Tracking interviews with development teams related to the security practices they have adopted based on maturity models such as OpenSAMM.

In addition, the presentation will explain the internals of the Vulnerability Manager software – the design decisions made as well as opportunities to extend the system to support additional technologies.

Registration for FROC 2010 is now open. This has always been a great conference and we hope to see folks there.

Contact us for information about driving secure software initiatives in your enterprise and centrally managing your application security program.

--Dan

dan _at_ denimgroup.com

May 20, 2010 | Permalink | Comments (0) | TrackBack (0)

May 19, 2010

451 Group Webcast: What It Means to Be Rugged

Josh Corman from the 451 Group, along with Wendy Nather from Texas Education Agency (TEA) recently released a webinar about What It Means to Be Rugged.

At Denim Group we’ve been a big fan of developing secure, resilient software for quite some time so the “rugged” concept really resonates with us. “Rugged” isn’t just about security – it is about developing software that is able to survive and thrive in the real-world environment of malicious attackers, legitimate users that make mistakes, and inter-related systems that fail unexpectedly. Just as “agile” has inspired developers to be nimble and focus on customer-centric concerns, we hope that “rugged” gets developers to take pride in the software they develop because they developed it to run successfully in the hostile environment in which it will inevitably be deployed.

The entire webinar is great; for purely selfish reasons there were several portions of specific interest:

· 43:30 – Discussion of rugged remediation and using example code to help developers when you do not have time for formal training

· 44:25 – Discussion of the value of software development firms that focus on building rugged code and teaching other developers how to build rugged code

· 53:00 – Discussion of some of the work we are doing with WhiteHat Security to help firms prioritize their remediation efforts

A recording of the webinar can be downloaded here. And be sure to check out the Rugged Manifesto.

--Dan

dan _at_ denimgroup.com

May 19, 2010 in Application Security Remediation | Permalink | Comments (0) | TrackBack (0)

Threat Modeling: RFID Integration for Morgan's Wonderland

Last week we released some details about work we did for the Morgan’s Wonderland fun park for special-needs children. One of the exciting aspects of that project was the integration with the park’s RFID tracking system. The RFID system itself was built by RFIDTec, based in California, and we integrated their work with the online reservation platform we constructed.

RFID Journal did a write-up on the Morgan’s Wonderland RFID system, including some comments from Denim Group’s Sheridan Chambers.

An important aspect of securing this integration was the use of Threat Modeling to proactively identify potential security problems during the design stage so they could be addressed early in the development process. Understanding the communication channels in a system as well as trust boundaries between parts of the system is critical to creating secure applications. This applies to RFID systems, Web 2.0 mashups, software as a service (SaaS) and smartphone applications – any system that is composed of multiple independent subsystems.

Here are some photos of different aspects of the RFID tracking system:

The tracking wristband

A closed location station.

Identifying a user to the location station.

--Dan

dan _at_ denimgroup.com

May 19, 2010 | Permalink | Comments (1) | TrackBack (0)

May 11, 2010

Goofus and Gallant: Transferring Data Between Applications

Does everyone remember Goofus and Gallant? That was the cartoon series in Highlights Magazine that tried to teach kids good manners and social skills by example: “Goofus burns ants with a magnifying glass; Gallant respects all living creatures” And so on.

I think Goofus and Gallant both grew up to be software developers.

Business analysts, architects and software developers all have many opportunitites every day to make decisions that can either help or hurt the security of the systems they are building. Decisions made in Visio, on whiteboards and at the keyboard can either produce applications that are secure and resilient against attack or are brittle and riddled with vulnerabilities. When we work with teams helping them build secure software we see the types of decisions they are faced with and help them make good choices up-front – when they are less expensive.

Here is a scenario we saw recently: Application A needs to update some of its data tables periodically with data provided by Application B developed and hosted by an untrusted 3^rd party.

What would Goofus and Gallant do?

· Goofus has Application B send him raw SQL statements because it is really easy to write the code to execute them in his database.

· Gallant has Application B provide him with structured data in a format such as CSV or XML so he be sure the data is not treated as executable code and so he can validate it and put it in the database only if it passes positive checks for data type, length, range and business logic validity.

Goofus might come back and argue that he would set up a separate database user for these queries and make sure that it had limited permissions to access the database to prevent SQL statements that would “DROP TABLE” and so on. Gallant does all that stuff too, but most importantly made the fundamental decision to force communication between the applications to consist of data rather than executable code.

Eventually someone – good guy or bad – is going to figure out they can send Goofus’ application arbitrary SQL statements. Then Goofus not only has to fix the way his application works, but he also has to convince the 3^rd party developing and hosting Application B that they need to change the way they are sending him data. This is frustrating, time-consuming and diverts resources away from building cool new features in the application.

Developers – you have control ove the security of the systems you develop. Think through the security implications of your design decisions early-on and please don’t be a Goofus.

--Dan

dan _at_ denimgroup.com

May 11, 2010 | Permalink | Comments (0) | TrackBack (0)

Denim Group Provides Specialized Online Registration Platform for the World's First Family Fun Park For Special-Needs Children

Denim Group just posted a release about some work we did for Morgan’s Wonderland – the world’s first fun park for special-needs children, adults and their families. We were thrilled to have the opportunity to work on this project and we are looking forward to working with them going forward because they are doing some really valuable and cutting-edge work.

You can find more information about Morgan’s Wonderland here:

· Web

· Facebook

· Twitter: @morganswndrlnd

There is also a copy of the release online: Denim Group Provides Specialized Online Registration Platform for the World’s First-Ever Family Fun Park for Special-Needs Children

--Dan

dan _at_ denimgroup.com

alan@weinkrantz.com john@denimgroup.com

PRESS RELEASE

Agency Contact: Denim Group Contact:

Alan Weinkrantz John Dickson

210.820.3070 210.572.4400

Denim Group Provides Specialized Online Registration Platform for the World’s First-Ever Family Fun Park For

Special-Needs Children

Web applications allow Morgan’s Wonderland guests to securely pre-register online,

enable park management to control attendance, and make it easy to donate.

San Antonio, TX – May 11, 2010 –Denim Group, an IT consultancy that develops secure software and helps organizations assess and mitigate risks with their existing software, announced today that it has developed a unique online registration platform of web-based applications for Morgan’s Wonderland, the world’s first fun park for special-needs children, adults, and their families.

Morgan’s Wonderland, a 25-acre park, was designed with the safety of every guest in mind, using state-of-the art technology to make the park as safe as possible, including secured entry and exit, Radio Frequency Identification (RFID) wristbands and monitors, public address and emergency notification systems, video surveillance, and much more.

Sports Outdoor and Recreation (SOAR), the nonprofit running Morgan’s Wonderland, selected Denim Group to develop a web-based online registration and donation portal for the park. The system allows guests to pre-register online and enter important data such as personal information, medical conditions, allergies, etc. This saves a great deal of time when arriving at the park, because guests can now simply pick up their pre-made personalized RFID wristbands which display their location in the park in real-time as well as critical personal information, which is particularly important for non-verbal guests.

“We selected Denim Group because they’re experts in secure, large-scale web applications that integrate with other systems,” said Gordon Hartman, the philanthropist behind the park named after his daughter Morgan. “Their background in application security added a great deal of value because while it’s important to collect data on special-needs kids to make their stay at the park safe, we also need to ensure that this sensitive data is completely protected.”

The online registration and reservation system also allows park management to control attendance levels and set different parameters for different days, depending on staffing. Because the park is designed for special-needs guests, it is critical that certain staff-to-guest ratios are maintained. A number of other exhibits are being planned for Morgan’s Wonderland, and Denim Group designed an online donation portal making it easy for those who wish to contribute. The park is free for special-needs guests and children under 3, and $5 for accompanying family members.

“We donated part of the work we did for Morgan’s Wonderland because this is such an amazing facility that provides an invaluable experience for so many children that have never had access to anything like this before,” said Sheridan Chambers, principal of Denim Group. “We’re looking forward to developing additional components for Morgan’s Wonderland in the future such as building personal preferences into interactive exhibits. For example, if your name is John and you like green, that could be coded into your wristband so when you passed through the Sensory Village, screens might flash ‘Welcome John!’ as exhibits turned green around you. Your imagination is the limit here.”

About Denim Group

Denim Group develops secure software, helps organizations assess and mitigate risk with existing software, and provides training on best practices in software security. Denim Group has worked with a range of Fortune 500 companies and public sector organizations, bringing a focused software development approach to the world of software security. Denim Group is a strong contributor to the larger application security community, and has been involved with the Open Web Application Security Project (OWASP) since shortly after its inception. Additionally, Denim Group was ranked 1,751 in Inc. Magazine's 5000 Fastest-Growing Private Companies in America in 2009. For more information about Denim Group, visit www.denimgroup.com.

Reader Contact Information:

Denim Group, 3463 Magic Drive, Suite 315; San Antonio, TX 78229, Tel: 210-572-4400,

Fax: 210-572-4401, www.denimgroup.com, john@denimgroup.com.

# # #

May 11, 2010 | Permalink | Comments (0) | TrackBack (0)

May 05, 2010

John Dickson and Dan Cornell Discuss "Building a Cyber Security Company"

John Dickson and I were recently featured on the KLUP radio show “On the Air with San Antonio's Business Makers” Apparently a radio show is kind of like a podcast, but it actually gets broadcast on a specific date and at a specific time. So perhaps more like a webinar, but without video.

In any case you can listen to the show online here. (Protip: Skip ahead to about 8:50 for the start of the main content)

We discussed a number of topics:

· How Denim Group was started and what the name means

· Why attackers target software

· The importance of training developers in building secure software

· Why application-level vulnerabilities are challenging to fix

· How students can prepare themselves for a career in information security

We had a lot of fun being on the show and really appreciated the invitation from our hosts – John Thurman and Nancy Kudla.

Contact us for more information on creating secure software and addressing the risk associated with the applications in your portfolio.

--Dan

dan _at_ denimgroup.com

May 05, 2010 | Permalink | Comments (0) | TrackBack (0)

OWASP San Antonio May Meeting: The OpenSAMM Project

The May meeting of OWASP San Antonio will be held May 19^th, 2010. I will be presenting on the OpenSAMM project. More information below. (Note to Pravir: I shamelessly borrowed your abstract for this talk)

San Antonio OWASP Chapter: Wed May 19th, 2010

Topic: The Open Software Assurance Maturity Model

Presenter: Dan Cornell, Principal, Denim Group

Date: Wednesday May 19th, 2010 11:30am – 1:00pm

Location:

San Antonio Technology Center (Web Room)

3463 Magic Drive

San Antonio, TX 78229

View Larger Map

Abstract:

The Open Software Assurance Maturity Model (SAMM) (http://www.opensamm.org/) is a flexible and prescriptive framework for building security into a software development organization. Covering more than typical SDLC-based models for security, SAMM enables organizations to self-assess their security assurance program and then use recommended roadmaps to improve in a way that's aligned to the specific risks facing the organization. Beyond that, SAMM enables creation of scorecards for an organization's effectiveness at secure software development throughout the typical governance, development, and deployment business functions. Scorecards also enable management within an organization to demonstrate quantitative improvements through iterations of building a security assurance program.

This workshop will introduce the SAMM framework and walk through useful activities such as assessing an assurance program, mapping an existing organization to a recommended roadmap, and iteratively building an assurance program. Time allowing, additional case studies will also be discussed. OpenSAMM is an open a free project and has recently been donated to the Open Web Application Security Project (OWASP) Foundation. For more information on OpenSAMM, visit http://www.opensamm.org/.

Presenter Bio:

Dan Cornell has over ten years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. He is also the primary author of sprajax, Denim Group’s open source tool for assessing the security of AJAX-enabled web applications

Sodas and snacks will be provided. Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com or call (210) 572-4400.

--Dan

dan _at_ denimgroup.com