Denim Group, Ltd. Blog

Webinar Recording Online: Running a Web Security Testing Program with OWASP ZAP and ThreadFix

By Dan Cornell

Simon Bennetts (@psiinon) and I did a webinar last Wednesday talking about how to set up web application testing programs witih the freely-available tools OWASP Zed Attack Proxy (ZAP) and ThreadFix. The webinar was titled "Running a Web Security Testing Program with OWASP ZAP and ThreadFix" You can see the recorded webinar here:

(fullscreen video came out remarkably sharp!)

For more infomation about the tools and techniques we discussed, check out:

• Main OWASP Zed Attack Proxy (ZAP) page
• Main ThreadFix page at Denim Group
• ThreadFix Google Code site
• ThreadFix Google Group
• Mozilla Zest on Github

I wanted to personally thank Simon for taking the time to put on this webinar with us. I'm a huge fan of ZAP and I was really excited to get the opportunity to talk with folks about how ZAP and ThreadFix can be used together.

Contact us to talk about ways you can automate parts of your web application testing program with freely-available tools.

--Dan

dan _at_ denimgroup.com

@danielcornell

Denim Group at SANS AppSec 2013 in Austin

By Dan Cornell

SANS AppSec 2013 will be held from April 22nd through April 27th in Austin, TX. Monday April 22nd, John Dickson will be moderating a panel titled "AppSec 2.0: Strategies for Moving the Needle on Application Security" The panel abstract is:

Thousands of applications, millions of lines of code, numerous development teams spread across the planet. You thought your application security program had it bad! The participants in this panel discussion have been tackling the issue of software security in their large corporate environments for years, helping thousands of software developers improve how they build software and helping identify software vulnerabilities before attackers do. They will discuss how they have built large-scale vulnerability scanning programs, how they interact with their respective business units and how they get executive buypin to further the case of application security. Come join this interactive session with application security industry leaders who will discuss practical approaches to securing software.

Panel participants include:

• John Dickson, CISSP, Principal, Denim Group (Moderator)
• Chris Haggard, Manager of eCommerce/Application Security, FedEx
• John Heimann, Senior Director-Security Programs, Oracle
• Jim Apple, Senior Manager, Applications, Bank of America

Tuesday I will be giving a lunchtime presentation titled "Do You Have a Scanner or a Scanning Program?" and the abstract is:

By this point, most organizations have purchased at least one code or application scanning technology to incorporate into their software security program. Unfortunately, for many organizations the scanner represents the entirety of that so-called “program” and often the scanners are not used correctly or on a consistent basis.

This presentation looks at the components of a comprehensive software security program and the role that automation plays in these programs. It also looks at common pitfalls organizations encounter when trying to deploy scanning technologies as well as ways to address these issues. Finally it walks through metrics organizations can use to keep tabs on their scanning progress so they can identify and address issues such as portfolio and scanner coverage. Demonstrations using freely available tools are provided as well as discussion of how these approaches can be applied for both commercial and free static and dynamic scanning technologies.

We are looking forward to catching up with folks at SANS AppSec in Austin. Contact us if you would like a special discount code for the event.

--Dan

dan _at_ denimgroup.com

@danielcornell

Webinar: Running a Web Security Testing Program with OWASP ZAP and ThreadFix

By Dan Cornell

Simon Bennetts (@psiinon) and I will be doing a webinar Wednesday April 24th, 2013 at 10:30am Central Daylight Time to talk about how organizations can set up a web security testing program using the freely available tools OWASP Zed Attack Proxy (ZAP) and ThreadFix.

You can register online here: Running a Web Security Testing Program with OWASP ZAP and ThreadFix

Abstract:

OWASP's Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. ThreadFix is a software vulnerability management platform that allows organizations to track the results of testing and communicate vulnerabilities to software development teams. Used together, these open source tools allow organizations to build a comprehensive program of web application security testing and vulnerability management. Security analysts can perform automated and manual testing of critical applications, track the results of their testing and report metrics on their program's effectiveness. This webinar walks through the basics of using OWASP ZAP for web application scanning and testing. It then demonstrates storing and managing these results inside of ThreadFix and communicating them to development teams for resolution. Developers and security professionals alike will benefit from seeing how these two tools used in combination can allow any organization to start taking control of the security of their web applications.

Contact us if you woud like to talk more about getting the most out of great tools like OWASP ZAP and ThreadFix.

--Dan

dan _at_ denimgroup.com

@danielcornell

OWASP Dallas: Implementation Patterns for Software Security Programs

By Dan Cornell

I will be in Dallas on May 8th to speak to the OWASP Dallas chapter. The meeting runs from 11:30am through 1:00pm and is located at Richland College, 12800 Abrams Road, Dallas, TX 75243 at Sabine Hall in room SH117.

I will be giving an updated version of my talk titled "Implementation Patterns for Software Security Programs." (See my writeup of BSides Austin 2013 for some more background) The abstract for the presentation is:

Most organizations have finally realized that the software applications they are developing and deploying exposes them to significant risks. Organizations that are serious about this issue have started rolling out software security programs to address these risks in a structured manner. The challenge for these organizations is to determine what measures to put in place and how to implement those measures to best reduce their exposure. Efforts such as BISMM, OpenSAMM and Microsoft's SDL have shown that there are a number of components of software security programs that are reasonably standard, but there are different ways of implementing tools and deploying processes so what was successful for one organization does not guarantee success in others. Matching implementation strategies to the specific capabilities, limitations, strengths and weaknesses of the organizations is critical to a successful program roll-out.

This presentation relates several example case studies for organizations rolling out different portions of their software security programs. Although every organization is different, looking across multiple program implementations allows patterns to emerge and these patterns can provide guidance to other organizations looking to organize plans for their software security programs.

Several aspects of program rollout and the associated program are covered. Firstly, the presentation provides a discussion of selecting the organizational "owner" of the software security program. Although many parts of the organization must be involved, one group must be ultimately responsible for the security state of software developed and deployed. Then the presentation looks into three specific software security activities: static code analysis, dynamic application testing and developer security education. Several implementation patterns for each of these activity rollouts are outlined along with factors organizations can use to decide if a particular approach is well suited to their needs. These patterns help to provide templates that minimize the requirement of an organization to experiment and break new, risky ground by allowing them to benefit from lessons learned from previous efforts.

The presentation is vendor-neutral and based on experiences working with several organizations creating software security programs.

I always enjoy speaking to OWASP groups and I'm thrilled to have the opportunity to come back and talk to the folks in Dallas. Looking forward to seeing everyone there!

Contact us for help building a software security program that works for your organization.

--Dan

dan _at_ denimgroup.com

@danielcornell

BSides Austin Recap: Implementation Patterns for Software Security Programs

By Dan Cornell

BSides Austin 2013 was at the end of last week and one of the things I did while I was there was give a talk about different patterns we've seen as we've helped firms put together their software security programs. Slides are online:

Implementation Patterns For Software Security Programs from Denim Group

The abstract for the talk was:

Every organization’s software security program implementation is different, but patterns exist providing guidance to those looking to plan for their program rollouts. This presentation covers several aspects of this process including the “ownership” of the software security program as well as implementation of static code analysis, dynamic application testing and developer security education.

Contact us for help building a software security program that works for your organization.

--Dan

dan _at_ denimgroup.com

@danielcornell

BSides Austin Recap: Developing Secure Mobile Applications

By Dan Cornell

BSides Austin 2013 was at the end of last week and one of the things I did while I was there was give a short, two hour training session titled "Developing Secure Mobile Applications" This is a (very) cut down version of some of the instructor-led training classes we give on developing secure mobile applications and testing the security of mobile applications. Slides are online:

Developing Secure Mobile Applications from Denim Group

The abstract for the training was:

This course provides an introduction to security for mobile applications. It walks through a basic threat model for a mobile application. This threat model is then used as a framework for making good decisions about designing and building applications as well as for testing the security of existing applications. Examples are provided for both iOS (iPhone and iPad) and Android platforms and sample code is provided to demonstrate mobile security assessment techniques.

Contact us for help building secure mobile applications and testing the security of mobile applications.

--Dan

dan _at_ denimgroup.com

@danielcornell

Denim Group at InnoTech San Antonio 2013: Smart Phones Dumb Apps

By Dan Cornell

Folks headed to InnoTech San Antonio on Wednesday April 17th, 2013 should stop by the Denim Group booth and say howdy. Also, I'll be giving an updated version of my Smart Phones Dumb Apps talk at 1:00pm. The abstract for that talk is:

Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android.  Many of these applications are constructed without fully considering the associated security implications of their deployment.  Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services.  This talk discusses emerging threats associated with deploying  smartphone applications  and provides an overview of the threat modeling process.  The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.

So if your organization is building - or using - mobile applications on platforms like Android and iOS (iPhone/iPad) you probably want to drop by. This is a fun, interactive presentation with a lot of examples that helps demonstrate why mobile security isn't just about MDM and dealing with BYOD. You also need to pay attention to the applications getting deployed on these mobile operating systems if you want to protect both your organization's and your customers' data.

Also if you want a FREE admission to InnoTech San Antonio 2013, head to www.innotechsan.com and use the code SPK13C to register.

 Contact us if you want to meet up at InnoTech San Antonio 2013 and talk about mobile application security.

--Dan

dan _at_ denimgroup.com

@danielcornell

Related articles

Denim Group at BSides Austin 2013: Building Secure Mobile Apps and Software Security Implementation Patterns

Search Software Quality: Understanding Mobile, Web and Cloud Apps and System Architecture

Smart Phones Dumb Apps Scripts Updated

RSA 2013 Video: What's Ailing Enterprise Software Security Management?

By Dan Cornell 

I caught up with Jan Stafford from TechTarget while in San Francisco for RSA 2013 about a week and a half ago. One of the things we talked about were challenges enterprises are facing getting their software security programs firing on all cylinders. You can see the write-up here and the video online here:

Apparently people weren't joking when they told me I needed a haircut before I left for RSA...

The article also has a great point from John Dickson, which is that rolling out software security programs in any large enterprise involves a large internal selling component to get development groups on-board with what security teams need from them. Check it out.

Contact us for help getting your software security program on the right track.

--Dan

dan _at_ denimgroup.com

@danielcornell

Related articles

ThreadFix 1.1 Release Candidate Now Available

Search Software Quality: Data Security in a SaaS World

RSA 2013 Video: What's Ailing Enterprise Software Security Management?

Denim Group at BSides Austin 2013: Building Secure Mobile Apps and Software Security Implementation Patterns

Denim Group at BSides Austin 2013: Building Secure Mobile Apps and Software Security Implementation Patterns

By Dan Cornell

 

I will be up at BSides Austin 2013 in a couple of weeks. Thursday March 21st I will be giving a short training class from 4:00pm through 6:00pm titled "Developing Secure Mobile Applications." The brief abstract is:

This course provides an introduction to security for mobile applications. It walks through a basic threat model for a mobile application. This threat model is then used as a framework for making good decisions about designing and building applications as well as for testing the security of existing applications. Examples are provided for both iOS (iPhone and iPad) and Android platforms and sample code is provided to demonstrate mobile security assessment techniques.

We've only got two hours so I can't teach you everything about building and testing secure mobile apps (assuming I even knew everything about the subject...) but I can help make you smarter. Should be a good time.

Also on Friday March 22nd from 1:00pm to 2:00pm I will be giving a talk titled "Implementation Patterns for Software Security Programs" The abstract for this talk is:

Every organization’s software security program implementation is different, but patterns exist providing guidance to those looking to plan for their program rollouts. This presentation covers several aspects of this process including the “ownership” of the software security program as well as implementation of static code analysis, dynamic application testing and developer security education.

This should be a fun one because we talk through war stories of things we've seen be successful as well as things we've seen go horribly wrong.

Contact us if you want to meet up at BSides Austin 2013. The last time I checked there were still tickets available.

--Dan

dan _at_ denimgroup.com

@danielcornell

OWASP Phoenix: Using ThreadFix to Manage Application Vulnerabilities

By Dan Cornell

I'll be in Phoenix next week on Tuesday February 5th, 2013 speaking to the Phoenix OWASP chapter about ThreadFix.

Title: Using ThreadFix to Manage Application Vulnerabilities

Abstract:

ThreadFix is an open source software vulnerability aggregation and management system that reduces the time it takes to fix software vulnerabilities. It imports the results from dynamic, static and manual testing to provide a centralized view of software security defects across development teams and applications. The system allows organizations to correlate testing results and streamline software remediation efforts by simplifying feeds to software issue trackers. This presentation will walk through the major functionality in ThreadFix and describe several common use cases such as merging the results of multiple open source and commercial scanning tools and services. It will also demonstrate how ThreadFix can be used to track the results of scanning over time and gauge the effectiveness of different scanning techniques and technologies. Finally it will provide examples of how tracking assurance activities across an organization’s application portfolio can help the organization optimize remediation activities to best address risks associated with vulnerable software.

The meeting will be held from 6:30 - 7:30pm at the University of Advancing Technology 2625 W. BASELINE RD. TEMPE, AZ 85283-1056. For more information, check out the main OWASP Phoenix site.

Contact us for help running your software security program on ThreadFix.

--Dan

dan _at_ denimgroup.com

@danielcornell