Denim Group, Ltd. Blog

Denim Group at SOURCE Boston 2011: The Real Cost of Software Remediation

By Dan Cornell

I will be giving a presentation titled “The Real Cost of Software Remediation” at SOURCE Boston this year. The abstract is:

The security industry is beginning to release data that focuses on the prevalence of different types of vulnerabilities and incidents. However interesting, such data falls short of providing crucial information to aid organizations with their software remediation efforts. This presentation provides statistical data from 15 different web application remediation projects in order to provide real insight into the costs of remediating application-level vulnerabilities. The data addresses pressing questions, including how much time is spent on different phases of remediation projects (inception, planning and execution), and how much time is required to remediate different classes of vulnerabilities. Based on this data, analysis is also provided so organizations can make decisions about which vulnerabilities should be fixed and which should be left, how to schedule vulnerability remediation into software project schedules, and activities organizations should undertake in order to prevent the most costly vulnerabilities from occurring in the first place.

Contact us for help remediating vulnerabilities in your software.

 

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Security BSides Austin: 2011 Recap

By Dan Cornell

As expected, the Security BSides Austin conference was a blast. There were a lot of great folks in attendance and plenty of great talks to go around. And of course there were Hackers on a Duck Friday night. Take a look at Jack Daniel’s photos from BSides Austin to get a feel for the event.

 

Everyone loves the coffee truck servicing Austin Security BSides

For some reason (mostly thanks to Ben Tomhave’s trickery) I ended up doing a number of talks during the conference.  The slides should now all be up online:

•  Presentation: Smart Phones Dumb Apps (updated)
•  Guerilla Training: Cross-Site Scripting (XSS) Remediation
•  Guerilla Training: Designing Secure Mobile Applications

Also you can find links to the source code from my smartphone app analysis on the Google Code repository attached to the www.smarphonesdumbapps.com site.

 

John Steven lays down the law about Threat Modeling

I really enjoy the BSides conferences. They’re less vendor-driven that some of the big security conferences like RSA and BlackHat. The talks also tend to be a good mix of in-the-weeds technical topics and interesting perspectives on other security industry topics. Hopefully future BSides Austin events will be further integrated with South By Southwest (SxSW). Getting the security message out to developers and social media

Contact us for help designing and building secure mobile applications and remediating software security vulnerabilities.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Security BSides Austin: Designing Secure Mobile Applications Slides Online

By Dan Cornell 

I did a Guerilla Training session at Security BSides Austin on Designing Secure Mobile Applications.  The slides from the session are online here:

This looks at issues similar to those in the Smart Phones Dumb Apps presentation but from the opposite side.  Rather than looking at deconstructing and attacking mobile applications it looks at how to design them from the ground up to avoid security problems.

Contact us for help designing secure mobile applications for your organization.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Security BSides Austin: Cross-Site Scripting (XSS) Remediation Slides Online

By Dan Cornell

I did a Guerilla Training session at Security BSides Austin on Cross-Site Scripting (XSS) Remediation.  The slides from the session are online here:

Also I have some sample exercises for remediating cross-site scripting (XSS) vulnerabilities in Java and ASP.NET.  Email me if you would like me to send them along.

Contact us for help fixing security vulnerabilities in your applications.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Security BSides Austin: Smart Phones Dumb Apps Slides Online

By Dan Cornell

I gave an updated version of my Smart Phones Dumb Apps presentation at Security BSides Austin last weekend.  The updated slides are online here:

The updated slides have an updated threat model and some expanded material about Mobile Browser Content Handlers.

Contact us for help building and securing mobile and smartphone applications.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Mobile Browser Content Handlers: Risks and Countermeasures

By Dan Cornell

I was up in the DC area last week for the Department of Homeland Security (DHS) Software Assurance Forum. While I was there I was also fortunate enough to stop by the OWASP NoVA meeting and I gave a brief fire talk titled “Mobile Browser Content Handling”

Slides are available online here:

Most mobile platforms allow developers to register applications to handle requests that would otherwise be handled by the web browser. This allows developers to provide a richer experience than a browser on its own, but also opens up avenues for attackers. Attackers can try to subvert application behavior by seeding malicious websites with specially-crafted links intended to execute a target application with malicious parameters included in the URL. Developers should understand the situations when their applications might be executed in response to malicious web content and be sure to properly validate incoming data and request appropriate confirmation from users before performing sensitive actions.

The SANS folks have a great blog post about how this works in iOS (iPhone, iPad). Check out the slide deck for more details and I will be following up shortly with a blog post with specifics of how this works in on the Android platform.

Contact us for help building and securing your mobile applications.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

CIO Update Article: Pervasive Computing Isn't Everywhere...Yet

By Dan Cornell

Pam Baker used a quote of mine in her recent CIO Update article “Pervasive Computing Isn’t Everywhere … Yet” (quote is on page 2). The article looks at how people carrying powerful mobile devices with them everywhere and all the time creates a whole new set of possible applications and ways for people to interact with technology. This is certainly exciting, but people and enterprises need to be aware of the potential security risks raised.

Already mobile devices have become a potentially dangerous new endpoint for enterprise security professionals to worry about. Phones store emails, contacts and other sensitive corporate information.  They have access to GPS location, audio recording, cameras and other sensitive personal information.  They connect to carrier networks and both corporate and untrusted wireless networks.

Developers must understand the responsibility they have to their enterprises and to their application users. Access to such enormous amounts of sensitive corporate and personal information makes mobile devices and the applications running on them incredibly attractive to attackers. Applications need to respect users’ privacy and they should be built “rugged” to operate successfully in a hostile environment.

Contact us for help dealing with pervasive computing risks.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Denim Group: Keeping Security Weird at Security BSides Austin

By Dan Cornell

There is a lot available for anyone attending Security BSides in Austin, TX this weekend:

•  Plenty of talks ranging from Ben Tomhave’s “The Unintended Consequences of Beating Users with Carrot Sticks” to Paul Judge’s “Social Networking and Security: Are They Incompatible?”  I’ll be giving an updated version of my “Smart Phones Dumb Apps” presentation Friday morning at 11 am.
•  The first-ever AppSec Guerilla Camp featuring FREE training for software developers interested in learning about security.  Attendees should bring a laptop and be ready to learn.  I’ll be doing two sessions: Friday from 3:30 to 5:30 I’ll be teaching a class on Cross-Site Scripting (XSS) Remediation and Saturday from 2 to 4 I’ll be teaching a class on Designing Secure Mobile Applications.
• Naturally, there will be another “Hackers on a Duck” event Friday night.

The 2010 Security BSides Austin was fantastic and this year’s event should be even better. Contact us if you want to meet up at Security BSides Austin.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous