Denim Group, Ltd. Blog

New Denim Group Team Members

Shelly H., Technical Project Manager

Shelly joins Denim Group as a Technical Project Manager. Previously, she's worked at a financial institution in project management. When she's not at work, she likes to read and scrapbook.

Chris G., IT Manager

Chris has experience as a systems engineer and a senior communication analyst. With over 20 years of information security experience, Chris helps keep Denim Group going. When Chris was a kid, he wanted to be the sound guy in a rock band.

Ed C., Technical Project Manager

Ed comes to Denim Group with extensive military and project management experience. When he's not running projects at Denim Group, he enjoys gardening, woodworking and photography.

Meredith H., Application Development Consultant

Meredith is joining the application development team at Denim Group. In addition to working on software, she likes to be outdoors camping or cycling.

Robbie, Business Development Manager

Robbie is based in Florida and helps develop business relationships for Denim Group. He has an extensive background in consulting and business development. Outside of work, Robbie enjoys playing golf and hanging out with his family and dog.

 

Denim Group at BlackHat (and BSidesLV!) 2012

By Dan Cornell

So who's headed to BlackHat 2012 in Las Vegas? We'll have a bunch of our folks in town and we have a busy week planned:

• We have a booth at BlackHat so we will be giving out schwag, talking software security and we've got a surprise, super-fun activity everyone is going to want to try out. Definitely worth a visit to the booth!
• We were selected to demonstrate ThreadFix at the BlackHat Arsenal. You can find us at Pod 3 from 10:15am until 11:15am on both Wednesday July 25th and Thursday July 26th. We're really looking forward to the opportunity to show ThreadFix to the wider community to get feedback.
• Josh Sokol and I will be presenting at BSidesLV talking about Symbiotic Security and using ThreadFix for a demonstration of how different classes of security tools can be made to work together. We will be speaking Thursday July 26th at 2pm.
• And last but not least we will be at Kartcon! Hurry up and get your tickets soon because the event is going to sell out. And hopefully we will get to see you at 7:45pm Thursday July 26th at the Fast Lap Nevada race track.

Rest up because it is going to be a long week, and contact us if you want to meet up in Las Vegas next week.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

ThreadFix Thurs…er…Sunday: Beta 18, AppSecEU

By Dan Cornell

Sorry for the late post, but I was in Greece speaking at OWASP AppSecEU and I didn't get this out on time. Lots going on as we speed toward our actual 1.0 release for ThreadFix:

• We pushed out Beta18 last Thursday. This includes a number of improvements to various importers and reports to clean things up a bit. We're really looking for feedback on the importers so please beat them up and if you run into any issues either report a bug in the bug tracker or email me directly - dan _at_ denimgroup.com.
• I gave a talk at OWASP AppSecEU titled "Benchmarking Web Application Scanners for YOUR Organization" that used ThreadFix's scan merge technology in its demonstration. You can see some of Colin Watson's comments on the presentation online and you can see the slides online as well.
• Also if you are headed to BlackHat 2012 please stop by and see us talk about ThreadFix at the BlackHat Arsenal. We're in Pod 3 from 10:15 until 11:15 both Wednesday, July 25th and Thursday, July 26th. In addition, Josh Sokol and I will be talking at BSidesLV 2012 about Symbiotic Security using ThreadFix and its virtual patching capabilities for the demonstration. I believe we will be presenting at 2pm on Thursday July 26th, but check the actual schedule to be sure.

Contact us if you have any questions about how ThreadFix can help you and your organization better manage application-level vulnerabilities --Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

OWASP AppSecEU 2012 Athens Recap: Scanner Benchmarking and Database User Security

By Dan Cornell

I just got back from Athens, Greece where I attended and and presented at the OWASP AppSecEU 2012 conference. I had a great time and I wanted to thank Kostas and his crew for putting on a great conference and extending such impeccable hospitality while I was in town.

I gave two talks while in Greece. Friday I presented some new material in a talk titled "Benchmarking Web Application Scanners for YOUR Organization." This talk looked at some of the currently-available public scanner benchmarks and then walked through the process of creating your own benchmarks using ThreadFix. The abstract for the presentation is:

Web applications pose significant risks for organizations. The selection of an appropriate scanning product or service can be challenging because every organization develops their web applications differently and decisions made by developers can cause wide swings in the value of different scanning technologies. To make a solid, informed decision, organizations need to create development team- and organization-specific benchmarks for the effectiveness of potential scanning technologies. This involves creating a comprehensive model of false positives, false negatives and other factors prior to mandating analysis technologies and making decisions about application risk management. This presentation provides a model for evaluating application analysis technologies, introduces an open source tool for benchmarking and comparing tool effectiveness, and outlines a process for making organization-specific decisions about analysis technology selection.

You can see some of Colin Watson's comments on the talk in his blog post. Also, an interesting thing (for me, at least) was that scanner benchmarking wasn't originally an intended use case for ThreadFix and its scan normalization and merging capabilities. But as it turns out those capabilities can be pretty useful for scanner evaluation. Bonus!

The slides for this talk can be found online here:

Benchmarking Web Application Scanners for YOUR Organization

View more presentations from Denim Group

Thursday I also presented an updated version of my talk "What Permissions Does Your Database User REALLY Need?" The abstract for that talk is:

Attaching web applications to databases as “sa” or “root” might be easy but it is also a horrible idea. This presentation provides a methodology as well as tools to create fine-grained database user permissions based on application-specific requirements. The negative impact of permissive database user account permissions is demonstrated alongside the potential benefits of constrained database user access. Tools for the automated creation of security-role-specific MySQL user permission policies will be demonstrated and these will be used as a model  for making “least privilege” database accounts a standard practice in web application deployment.

Slides for that talk can be found online here:

What Permissions Does Your Database User REALLY Need?

View more presentations from Denim Group

Again - many thanks to Kostas and the OWASP Athens folks for putting together a great conference as well as many enjoyable opportunities to explore their city and culture. I had a wonderful trip and I'm looking forward to heading back as soon as possible.

Contact us to talk about selecting the right scanning technology for your organization and getting your database security locked down.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

ThreadFix Thursday: Beta17, BlackHat Arsenal, BSidesLV and More

By Dan Cornell

Lots of exciting stuff going on in ThreadFix-land:

• ThreadFix was selected to present at BlackHat Arsenal! We are really excited to have this opportunity to show ThreadFix to the security community and hear feedback. If you're going to be at BlackHat later this month drop by our table at the Arsenal - we'll be at Pod 3 from 10:15 through 11:15. If you can't make it by the Arsenal get in touch and we can arrange a private demo.
• Josh Sokol and I will be giving a talk at BSides Las Vegas this year about "Symbiotic Security." We will be using ThreadFix to demonstrate integrating web application scanners with web application firewalls (virtual patching). Scheduling details are still being worked out and we will get those posted here once they are available.
• Beta17 has been pushed out to the Google Code site including updates OWASP ZAP importer to handle newer result files, a major overhaul of the Bugzilla integration, and the long-requested ability to delete scans.
• We didn't do a blog post about it, but Beta16 got pushed out about a week and a half ago, and it included updates to the virtual patch generation for F5 ASM and Deny All.
• We're starting to make some updates to the toolchain we use to build, test and deploy ThreadFix. We'll be getting these moved into the Google Code git repository and the first thing we've pushed is a Fabric script that builds ThreadFix and upgrades a pre-installed server. More to come.

Contact us if you are interested in learning more about ThreadFix.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous