Denim Group, Ltd. Blog

OWASP San Antonio: Next Meeting October 21st, 2009

Sponsored by:

San Antonio OWASP Chapter: October 21, 2009

Topic: Rolling Out an Enterprise Source Code Review Program

Presenter: Dan Cornell, Principal at Denim Group

Date: October 21, 2009 11:30 a.m. – 1:00 p.m.

Location:

San Antonio Technology Center (Web Room)

3463 Magic Drive

San Antonio, TX 78229

View Larger Map

Abstract:

Source code review technology has rapidly advanced over the past several years and offers great promise of helping organizations detect and address software security defects.  However, many organizations stumble as they try to roll out these technologies because they fail to understand the people and process issues that must also be addressed.  This talk will present lessons learned from the creation of several enterprise source code review programs, including: identifying all sources of custom code in an organization including custom extensions to ERP systems and enterprise portals, selecting the first round of applications to scan and successfully interpreting results and driving resolution to identified issues.

Presenter Bio:

Dan Cornell has over ten years of experience architecting and developing web-based software systems. As CTO of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group security research team, investigating the application of secure coding and development techniques to the improvement of web-based software development methodologies.

 

Dan Cornell has performed as the CTO of BrandDefense, as founder and Vice President of Engineering for Atension prior to its acquisition by Rare Medium,  Inc. and as the Vice

President, Global Competency Leader for Rare Medium’s Java and Unix Competency Center. Cornell has also developed simulation applications for the Air Force with Southwest

Research Institute.

Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the chapter leader of the San Antonio chapter of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, Denim Group's open source tool for assessing the security of AJAX-enabled web applications.

Sodas and snacks will be provided.  Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com  or call (210) 572-4400.

Posted via email from denimgroup's posterous

Dan Cornell Presenting at OWASP Houston: Conducting Application Assessments

TOPIC: "Conducting Application Assessments"

SPEAKER(S): Dan Cornell, OWASP, Denim Group

ABSTRACT: This talk will review a number of application assessment techniques and discuss the types of security vulnerabilities they are best suited to identify as well as how the different approaches can be used in combination to produce more thorough and insightful results. Code review will be compared to penetration testing and the capabilities of automated tools will be compared to manual techniques. In addition, the role of threat modeling and architecture analysis will be examined. The goal is to illuminate assessment techniques that go beyond commodity point-and-click approaches to web application or code scanning.

Date: Wednesday, September 9th

Time: 6:00 - 7:30pm

Location: HCC
1010 West Sam Houston Parkway North
Spring Branch Campus Commons
Houston, TX 77043

Directions: Physically it is Beltway 8 and I-10 -- Take the Gesner Exit of I-10 from downtown. It is next door to Murphy's Deli.

Contact me for a parking pass: dan _at_ denimgroup.com / @danielcornell

Posted via web from denimgroup's posterous

Social Networking Security Slide Deck Online

By Dan Cornell

John Dickson gave a presentation on the security implications of social networking to a group of CSOs last week.  The slide deck is now online at SlideShare:

Social Networks and Security: What Your Teenager Likely Won't Tell You

View more documents from Denim Group.

John's main point is that CSOs need to approach social networking as a business issue rather than a security issue if they want to maximize their ability to influence policy and implementation.

--Dan
dan _at_ denimgroup.com
@danielcornell

Slide Decks from Last Week's OWASP Presentations Online

By Dan Cornell

I wanted to thank the OWASP Washington DC and Northern Virginia chapters for their hospitality last week.  John Dickson and I had a great trip through the DC area.

The slide decks from the talks are online on the Denim Group website.  We also started something new and put them up on the Denim Group SlideShare site:

• Vulnerability Management in an Application Security World (OWASP DC)
• Vulnerability Management in an Application Security World (OWASP DC) (SlideShare)

Vulnerability Management In An Application Security World

View more documents from Denim Group.

• Application Assessment Techniques (OWASP Northern Virginia)
• Application Assessment Techniques (OWASP Northern Virginia) (SlideShare)

Application Assessment Techniques

View more documents from Denim Group.

--Dan
dan _at_ denimgroup.com
@danielcornell

Upcoming Virginia OWASP Talk: Conducting Application Assessments

By Dan Cornell

I will be presenting to the Virginia OWASP chapter on Thursday August 6th at 6pm.  The location is 13200 Woodland Park Road in Herndon, VA.  For more info check here.  The presentation abstract is:

This talk will review a number of application assessment techniques and discuss the types of security vulnerabilities they are best suited to identify as well as how the different approaches can be used in combination to produce more thorough and insightful results. Code review will be compared to penetration testing and the capabilities of automated tools will be compared to manual techniques. In addition, the role of threat modeling and architecture analysis will be examined. The goal is to illuminate assessment techniques that go beyond commodity point-and-click approaches to web application or code scanning.

The talk will be followed by a panel discussion, which should be a good one.  As always, OWASP meetings are free and open to all.  Hope to see folks there.

--Dan
dan _at_ denimgroup.com
@danielcornell

Upcoming DC OWASP Talk: Vulnerability Management in an Application Security World

By Dan Cornell

I will be speaking to the DC-area OWASP meeting next week on Wednesday August 5th at 6:30 on the GWU campus.  Check out the OWASP DC site and the Yahoo Events page for more info.

The presentation will outline strategies security teams can use for communicating with development teams to manage and ultimately correct application-level vulnerabilities. Similarities and differences between the security practice of vulnerability management and the development practice of defect management will also be addressed.

As always, OWASP meetings are free to all.  Hope to see folks there.

--Dan
dan _at_ denimgroup.com
@danielcornell

Why Do Vulnerable Applications Take So Long To Fix? - Webinar Follow-Up

By Dan Cornell

I realize I did a crappy job of promoting this webinar via the blog (most promotion was done via Twitter - follow me @danielcornell), but I wanted to get links to the recording and associated resources up online.

I recently did a webinar with Jeremiah Grossman from WhiteHat Security titled "Vulnerable Applications - Why Do They Take So Long To Fix?"  Online resources for the webinar are available here:

• The webinar recording is available: Vulnerable Applications - Why Do They Take So Long To Fix?
• My Denim Group slides are available: Vulnerable Applications - Why Do They Take So Long To Fix? - Denim Group Slides
• Jeremiah Grossman from WhiteHat Security's slides are available: Vulnerable Applications - Why Do They Take So Long To Fix? - WhiteHat Slides

Also, we discussed several other online resources during the webinar:

• Verizon 2009 Data Breach Report
• Verizon 2009 Data Breach Report (press release)
• Web Hacking Incidents Database (original site)
• Web Hacking Incidents Database (new site)

And here is something we neglected to mention during the webinar, but is worth a glance:

• Data Loss Database

We had great attendance, great questions and a lot of great follow-up after the webinar.  Hopefully these resources are useful to folks trying to spur their organizations to take action against application security vulnerabilities.

--Dan
dan _at_ denimgroup.com

OWASP Podcast with Dan Cornell Live

By Dan Cornell

My recent appearance on the OWASP Podcast is now live.  I had a great time recording this - we talk about all sorts of OWASP stuff like Membership and ESAPI as well as application security topics like vulnerability management.

You can subscribe to the iTunes feed for the OWASP Podcast here: http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=300769012.

--Dan
dan _at_ denimgroup.com

Web Application Security Panel at Austin ISSA Next Week

By Dan Cornell

I'll be moderating a panel on web application security at the Austin ISSA meeting next Wednesday May 21st from 11:30 to 1:00.  The panelists will be:

• Phil Agcaolli from Dell
• Gary Buonacorsi from Texas Office of the Attorney General
• Frosty Walker from the Texas Secretary of State

This will be a great opportunity to hear what these folks have been doing in their organizations to address web application security risks.

The meeting will be held at:

Microsoft Technology Center
Stonebridge Plaza, Building One
9606 N. Mopac Expressway, Suite 200
Austin, TX  78759
Phone (512) 795-5300
Map: http://tinyurl.com/dzp537

--Dan
dan _at_ denimgroup.com

Comments on "Mythbusting: Secure Code is Less Expensive to Develop"

By Dan Cornell

WhiteHat Security's Jeremiah Grossman just put up a blog post titled "Mythbusting: Secure Code is Less Expensive to Develop"  In it he looks at the costs required to fix the vulnerabilities in an "average" web application.

This is interesting analysis, but should probably be expanded to address more types of vulnerabilities and to look at how vulnerabilities cluster in applications.

If you get your fundamental coding idioms wrong, you're going to end up with a whole bunch of XSS or SQLi vulnerabilities. Fixing the first one might take a couple of hours (environment set up, tracking down the issue, testing the fix), but fixing vulnerability 1+N is pretty cheap because you just have to go to the next vulnerability and change the code. Rinse and repeat. It isn't fun work, but at least it is predictable to schedule. Project managers love this.

Business logic issues are a lot more variable to fix. It could be as simple as adding a permissions check before allowing data access or it could require you to change the application requirements and then those changes have to flow down through the development process. Project managers like these less because they could take a lot or a little. Uncertainty and variability are not the project manager's friends.

Architectural issues are the most variable and tend to start large and get enormous with regard to the level of effort required for the fix. I worked on one system where a single vulnerability (weakness in the way authentication worked) required a multi-year change control effort. Yikes! Needless to say, project managers (and line of business managers, executives, boards of directors...) like these the least.

I like the idea of economically modeling remediation efforts, and I think the model should be expanded to look at the mix of vulnerabilities found in applications as well as the mix of applications that organizations have.

I gave a talk about Vulnerability Management in an Application Security World at OWASP Minneapolis/St. Paul a while back that is up on Google Video. We talk about some of the economics surrounding fixing identified vulnerabilities in there a bit.

--Dan
dan _at_ denimgroup.com