{"id":342,"date":"2009-11-13T15:05:37","date_gmt":"2009-11-13T20:05:37","guid":{"rendered":"http:\/\/www.webadminblog.com\/?p=342"},"modified":"2010-02-01T19:03:55","modified_gmt":"2010-02-02T00:03:55","slug":"the-owasp-security-spending-benchmarks-project","status":"publish","type":"post","link":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/","title":{"rendered":"The OWASP Security Spending Benchmarks Project"},"content":{"rendered":"<p>This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project.\u00a0 My notes are below:<\/p>\n<p>It does cost more to produce a secure product than an insecure product.<\/p>\n<p>Most people will still shop somewhere, go to a hospital, or enroll in a university after they have had a data breach.<\/p>\n<p>Why do we spend on security?\u00a0 How much should we be spending?<\/p>\n<ul>\n<li>Security imposes extra costs on organizations<\/li>\n<li>The &#8220;security tax&#8221; is relatively well knnown for network and IT security &#8211; 5 to 10% (years of Gartner, Forrester, and other studies)<\/li>\n<li>No comparable data for development or web apps<\/li>\n<li>Regualtions and contracts usually require &#8220;reasonable measures&#8221;.\u00a0 What does that mean?<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>OWASP Security Spending Benchmarks Project<\/strong><\/span><\/p>\n<ul>\n<li>20 partner organizations, many contributors<\/li>\n<li>Open process and participation<\/li>\n<li>Raw data available to community<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Reasons For Investing in Security<\/strong><\/span><\/p>\n<ul>\n<li>Contractual and Regulatory Compliance<\/li>\n<li>Incident Prevention, Risk Mitigation<\/li>\n<li>Cost of Entry<\/li>\n<li>Competitive Advantage<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Technical and Procedural Principles<\/strong><\/span><\/p>\n<ul>\n<li>Managed and Documented Systems<\/li>\n<li>Business-need access<\/li>\n<li>Minimization of sensitive data use<\/li>\n<li>Security in Design and Development<\/li>\n<li>Auditing and Monitoring<\/li>\n<li>Defense in Depth<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Specific Activities and Projects<\/strong><\/span><\/p>\n<ul>\n<li>Security Policy and Training<\/li>\n<li>DLP-Type Systems<\/li>\n<li>Internal Configurations Management<\/li>\n<li>Credential Management<\/li>\n<li>Security in Development<\/li>\n<li>Locking down internal permissions<\/li>\n<li>Secure Data Exchange<\/li>\n<li>Network Security<\/li>\n<li>Application Security Programs<\/li>\n<\/ul>\n<p><!--more--><\/p>\n<p><span style=\"text-decoration: underline;\"><strong>The 10000&#8242; View For Most Organizations<\/strong><\/span><\/p>\n<ul>\n<li>Legal and Regulatory Compliance: Because we have to<\/li>\n<li>Incident Prevention, Risk Mitigation and Cost of Entry: Because this is what everyone else does<\/li>\n<li>Competitive Advantage: Really?<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Regs are Not App Sec Friently&#8230;<\/strong><\/span><\/p>\n<ul>\n<li>Regulations, contracts, and RFPs are usually based on the notion of &#8220;reasonable effort&#8221; &#8211; state regulations, HIPAA, FTC, SEC, Red Flags Rule<\/li>\n<li>When regulations do get technical, they focus on old school security fetishes like firewalls, SSL, encryption, biometric passes and server rooms<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>A Few Examples<\/strong><\/span><\/p>\n<ul>\n<li>PCI Prioritized Approach<\/li>\n<li>Massachusetts 201 CMR 17.00<\/li>\n<li>The encryption exemption in state data breach notification laws<\/li>\n<li>HIPAA Notification Form<\/li>\n<li>Recent SEC Action<\/li>\n<li>Most of the contracts\/RFPs\/Vendor security whitepapers I have seen&#8230;<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>A Real World Example of Where Your PII Lives&#8230;<\/strong><\/span><\/p>\n<ul>\n<li>Small company with a few dozen employees sells widgets over the Internet<\/li>\n<li>Pay an outsourced team to develop a Joomla\/Drupal\/whatever site to build a widget-lovers community where users can connect.\u00a0 All sorts of PII involved in the app<\/li>\n<li>They deploy their site on a shared hosting\/VPS model and basically only interact with the App from a web admin interface<\/li>\n<li>They know a bit about the technical details of their app but not much.\u00a0 Actually, no actual web developers were really involved in the building or deployment of the app<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Here is What Company A Did&#8230;<\/strong><\/span><\/p>\n<ul>\n<li>Asked their developer team in India to develop code securely.\u00a0 Referenced OWASP Top 10 or similar list.<\/li>\n<li>Told their dev team that services and DB users needed to run with minimum privilege.\u00a0 Dev team balked.\u00a0 Company A agreed to pay a bit extra.<\/li>\n<li>&#8230;<\/li>\n<li>&#8230;<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Here&#8217;s What Company B Did&#8230;<\/strong><\/span><\/p>\n<ul>\n<li>Installed anti-virus on all employee machines<\/li>\n<li>Bought a firewall for the corporate network<\/li>\n<li>Maybe even got two-factor tokens for network access<\/li>\n<li>Made sure everything is going over SSL everywhere,.<\/li>\n<li>Put a biometric reader in the data center<\/li>\n<li>Encrypt all laptops<\/li>\n<\/ul>\n<p>Company B is more likely to be in compliance with state laws and other regulations.<\/p>\n<p>Company B is also more likely to suffer a data breach.<\/p>\n<p>So the only thing left to finance your application security program is the &#8220;reasonable spend&#8221; argument&#8230;<\/p>\n<p>As a community we need to get some consensus on what constitutes a reasonable spend&#8230;<\/p>\n<p><span style=\"text-decoration: underline;\"><strong>About the OWASP Security Spending Benchmarks Project<\/strong><\/span><\/p>\n<ul>\n<li>First survey focused on general web application spending.<\/li>\n<li>Second survey focused on cloud computing.<\/li>\n<li>Responses currently being gathered for third survey<\/li>\n<li>Approximately 50 companies profiled in each case<\/li>\n<li>We do not collect IP addresses<\/li>\n<li>Most of the partners are security vendors<\/li>\n<li>Relatively small respondent base<\/li>\n<li>Meant to stimulate a discussion on security spending benchmarks<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Percentage of Development Headcount Spent on Security<\/strong><\/span><\/p>\n<ul>\n<li>41% had less than 2%<\/li>\n<li>20% had 5-10%<\/li>\n<li>18% didn&#8217;t know<\/li>\n<li>10% had 2-5%<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Percentage IT Budget on Web Application Security<\/strong><\/span><\/p>\n<ul>\n<li>33% don&#8217;t know<\/li>\n<li>24% had 5-10%<\/li>\n<li>12% had 1-5%<\/li>\n<li>12% had 10-20%<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Organizational Responsibility for Security Reviews<\/strong><\/span><\/p>\n<ul>\n<li>67% in IT Security<\/li>\n<\/ul>\n<p>47% of companies surveyed provide developers with security training via internal resources.<\/p>\n<ul>\n<li>Organizations that have suffered a public data breach spend more on security in the development process than those that have not.<\/li>\n<li>Web application security spending is expected to either stay flat or increase in nearly two thirds of companies<\/li>\n<li>Half of respondents consider security experience important when hiring developers<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Cloud Summary<\/strong><\/span><\/p>\n<ul>\n<li>SaaaS is in much greater use than IaaS or PaaS.<\/li>\n<li>Security spending does not change significantly as a result of cloud computing.<\/li>\n<li>Organizations are not doing their homework when it comes to cloud security.<\/li>\n<li>The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.<\/li>\n<li>Compliance and standards requirements related to cloud computing are not well understood.<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Future of Project<\/strong><\/span><\/p>\n<ul>\n<li>Currently collecting responses for the third survey<\/li>\n<li>Partners assist in promoting survey, analyzing results, and providing strategic input<\/li>\n<li>Current status of project can always be found on OWASP website<\/li>\n<li>New partners are always welcome<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project.\u00a0 My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[343,307],"tags":[370,12,133,622,369],"class_list":["post-342","post","type-post","status-publish","format-standard","hentry","category-metrics-security","category-owasp-appsec-dc-2009","tag-benchmarks","tag-owasp","tag-project","tag-security","tag-spending"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pfI0c-5w","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/comments?post=342"}],"version-history":[{"count":3,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/342\/revisions"}],"predecessor-version":[{"id":376,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/342\/revisions\/376"}],"wp:attachment":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/media?parent=342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/categories?post=342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/tags?post=342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}