Enterprise Application Security – GE’s Approach to Solving Root Cause
The first presentation of the day that I went to was by GE's Darren Challey and was about GE's application security program and how he took a holistic approach to securing the enterprise. My notes on this presentation are below:
Why is AppSec so hard?
- AppSec changes rapidly (look at difference between 2004, 2007, and 2010 Top 10)
- Changing landscape
- Increase skill and talen t pool of technically proficient individuals willing to break the law
- Growing volume of financially valuable data online
- Development of criminal markets (black markets) to facilitate conversion to money
- "Attackers now have effective skills, something to steal, and a place to sell it"
- Application Security is a complete one-sided game
- Need to become an enabler (not a barrier)
- Must inject application security earlier through Guidance, Education, and Tools
- Must understand the development and deployment process and integrate rather than mandate
- NIST study on cost to repair defects when found at different stages of software development (http://www.nist.gov/director/prog-ofc/report02-3.pdf)
- Solving the problem of the enterprise (Culture Change)
- Success factors
- Form a mission and strategy
- Develop policy (but not corporate "mandate")
- Gain executive buy-in (cost / benefit / risk)
- Understand the magnitude of problem (metrics)
- Asset inventory and vulnerability management
- Develop standards (what should I do and when?)
- Establish a formal program (strong leadership)
- Focus on education and training materials
- Develop in-house expertise, services and "COE"
- Continuous improvement, measurement, KPI
- Communicate!
- Drive a culture change (shared need, WIIFM)
- Communicate expectations with vendors
- Implement incentives (and penalties)
- Digitize after the process is solid (tools)
- AppSec program mission & structure
- AppSec program strategy
- Policy (guidance) -> Standards (Guidance) -> Training (Education) -> Metrics (tools) -> Security tools (tools) -> Inventory & tracking (tools) -> Monitor & Improve
Guidance
- "GE Application Security Working Group" (Talking to the businesses is critical! Meet every 2 weeks.)
- Secure Coding Guidelines
- Vulnerability Remediation Guide
- Secure Deployment
- Quick Reference Card
- Contractual Language
- Desk Calendars
- Metrics: AppSec calendars helped increase visitors to key Guidance materials (track hits to website docs when certain activities take place)
Education
- CBT1: Intro to AppSec at GE (60 min for any IT person) - why AppSec is important and what happens when you don't do it
- CBT2: GE Best Practices for Secure Coding (90 min)
- CBT3: Attack Profiles & Countermeasures (120 min for security people)
- Developer Awareness Assessment:
- 100's of internally-developed questions
- Randomized questions, timed completion
- Vendors track their own resutls
- Allows tailoring of training/awareness programs
Tools
- - COE AppSec assessment services
- Vendor framework & Metrics
- Compliance handbook
- Common objects repository
- GE Enterprise Application Security
- Scanning and Monitoring tools
- Automation is the way to go (but the tools are not quite there yet)
Metrics
- Measure Vendor AppSec Performance (Avg % Critical/High Vulnerabilities per Assessment vs % Assessments with Zero Critical/High Vulnerabilities)
- Is it making a difference (map avg of critical/high vulnerabilities per assessment)
Forming a Center of Excellence
- Combines the best available people, processes and tools
- Formal training & defined roles (Comprehensive training program for all auditors to ensure skills are kept current and that auditors can provide more than one type of service)
- COE Team structure (tools, research, operations, stakeholder management, queue management, application security auditors
- Application Assessment Types (black/grey box vs white box)
- Application assessment process (map of the workflow with "swim lanes" of who does each step)
- Measure number of vulnerabilities and severities
- Measure customer satisfaction (overall, ease of engagement, responsiveness)
Enterprise Security API – OWASP AppSec NYC 2008
This presentation was by Jeff Williams, OWASP Chair, on the Enterprise Security API.
Vulnerabilities and Security Controls
- Missing - 35%
- Broken - 30%
- Ignored - 20%
- Misused - 15%
Goal is to enable developers. Need to give them hands-on training, a secure coding guideline, and an Enterprise Security API.
The problem with Security Libraries: overpowerful, incomplete, not integrated, broken, can't update, custom.
Enterprise Security API (ESAPI) includes authentication, user, AccessController, AccessReferenceMap, Validator, ENcoder, HTTPUtilities, Encryptor, EncryptedProperties, Randomizer, Exception Handling, Logger, IntrusionDetection, and SecurityConfiguration. Built on top of your existing enterprise services or libraries.
Some Examples
- Input Validation - validation engine and decoding engine that will take input and provide safe output for web pages
- Output Encoding - need to use the right encoding for the right place you are putting the encoding
- Authentication - creates a user object and functions to login() or logout(). Provides additional functionality for encrypted cookies, changing SESSIONID, remember me cookies, etc.
- Access Control - provides functionality to check if a user is authorized for URLs, functions, data, services, or files.
- Direct Object Reference Protection - use an access reference map that does an indirect translation between an object and it's reference. Use getDirectReference() and getIndirectReference() functions.
- Error, Logging, and Detection - Configurable thresholds. Responses are log intrusion, logout user, and disable account. User object is available anywhere in the application so the logger links the messages logged to a user. Exceptions sent to an intrusion detector which has thresholds set.
OWASP ESAPI Covers Majority of OWASP Top Ten
- A1. XSS - Validator, Encoder
- A2. Injection Flaws - Encoder
- A3. Malicious File Execution - HTTPUtilities (Safe Upload)
- A4. Insecure Direct Object Reference - AccessReferenceMap, AccessController
- A5. CSRF - User (CSRF TOken)
- A6. Leakage and Improper Error Handling - EnterpriseSecurityException, HTTPUtils
- A7. Broken Authenticationa nd Sessions - Authenticator, User, HTTPUtils
- A8. Insecure Cryptographic Storage - Encryptor
- A9. Insecure Communications - HTTPUtilities (Secure Cookie, Channel)
- A10. Failure to Restrict URL Access - AccessController
MITRE found that all application security tool vendors' claims put together cover only 45% of the known vulnerability types (695). They found very little overlap between tools, so to get 45% you need them all (assuming their claims are true). This means that at least 55% is not covered by tools.
Latest version released in September 2008 (1.3.1) and are holding a summit later this year to determine if they got everything right. In active development. Java, .NET, PHP, classic ASP. Rich client extensions. Web service extensions. Framework (Struts) integration.
Written under the BSD license so it should be very easy for you to use it in your applciations.
Project Home Page: http://www.owasp.org/index.php/ESAPI
Expert advisory/design/implementation team that has collectively reviewed over 100 million lines of code. ~600 JUnit test cases. FindBugs, PMD, Ounce, and Fortify clean. Code review by several Java security experts. Penetration test of sample applications. Full Javadoc for all functions.
Presentation will be posted on homepage. Includes a list of banned API's that ESAPI replaces. Has example of enterprise cost savings. All of ESAPI is only 5000 lines of code. Building a ESAPI swingset which has a demo of insecure (what can go wrong) and secure (using ESAPI) programming and good tutorial on how to use. Login module shows last successful login, last failed login, number of failed logins, enforces a strong password policy.