This presentation was by Jeff Williams, OWASP Chair, on the Enterprise Security API.

Vulnerabilities and Security Controls

  • Missing – 35%
  • Broken – 30%
  • Ignored – 20%
  • Misused – 15%

Goal is to enable developers.  Need to give them hands-on training, a secure coding guideline, and an Enterprise Security API.

The problem with Security Libraries: overpowerful, incomplete, not integrated, broken, can’t update, custom.

Enterprise Security API (ESAPI) includes authentication, user, AccessController, AccessReferenceMap, Validator, ENcoder, HTTPUtilities, Encryptor, EncryptedProperties, Randomizer, Exception Handling, Logger, IntrusionDetection, and SecurityConfiguration.  Built on top of your existing enterprise services or libraries.

Some Examples

  1. Input Validation – validation engine and decoding engine that will take input and provide safe output for web pages
  2. Output Encoding – need to use the right encoding for the right place you are putting the encoding
  3. Authentication – creates a user object and functions to login() or logout().  Provides additional functionality for encrypted cookies, changing SESSIONID, remember me cookies, etc.
  4. Access Control – provides functionality to check if a user is authorized for URLs, functions, data, services, or files.
  5. Direct Object Reference Protection – use an access reference map that does an indirect translation between an object and it’s reference.  Use getDirectReference() and getIndirectReference() functions.
  6. Error, Logging, and Detection – Configurable thresholds.  Responses are log intrusion, logout user, and disable account.  User object is available anywhere in the application so the logger links the messages logged to a user.  Exceptions sent to an intrusion detector which has thresholds set.

OWASP ESAPI Covers Majority of OWASP Top Ten

  • A1. XSS – Validator, Encoder
  • A2. Injection Flaws – Encoder
  • A3. Malicious File Execution – HTTPUtilities (Safe Upload)
  • A4. Insecure Direct Object Reference – AccessReferenceMap, AccessController
  • A5. CSRF – User (CSRF TOken)
  • A6. Leakage and Improper Error Handling – EnterpriseSecurityException, HTTPUtils
  • A7. Broken Authenticationa nd Sessions – Authenticator, User, HTTPUtils
  • A8. Insecure Cryptographic Storage – Encryptor
  • A9. Insecure Communications – HTTPUtilities (Secure Cookie, Channel)
  • A10. Failure to Restrict URL Access – AccessController

MITRE found that all application security tool vendors’ claims put together cover only 45% of the known vulnerability types (695).  They found very little overlap between tools, so to get 45% you need them all (assuming their claims are true).  This means that at least 55% is not covered by tools.

Latest version released in September 2008 (1.3.1) and are holding a summit later this year to determine if they got everything right.  In active development.  Java, .NET, PHP, classic ASP.  Rich client extensions.  Web service extensions.  Framework (Struts) integration.

Written under the BSD license so it should be very easy for you to use it in your applciations.

Project Home Page:

Expert advisory/design/implementation team that has collectively reviewed over 100 million lines of code.  ~600 JUnit test cases.  FindBugs, PMD, Ounce, and Fortify clean.  Code review by several Java security experts.  Penetration test of sample applications.  Full Javadoc for all functions.

Presentation will be posted on homepage.  Includes a list of banned API’s that ESAPI replaces.  Has example of enterprise cost savings.  All of ESAPI is only 5000 lines of code.  Building a ESAPI swingset which has a demo of insecure (what can go wrong) and secure (using ESAPI) programming and good tutorial on how to use.  Login module shows last successful login, last failed login, number of failed logins, enforces a strong password policy.