How To Understand And Understand The Security Of A Web Browser (For Web Users)

Transcription

1 Security vulnerabilities: should they be early detected? - lsampaio@inf.puc-rio.br Alessandro Garcia afgarcia@inf.puc-rio.br OPUS Research Group

2 Agenda 1. Background; 2.Motivation; 3.Research Questions; 4.Hypotheses; 5.Empirical Method and Evaluation; 6.Work Plan; 7.Expected Contributions; 8.Questions? 2

3 Background 3

4 Background What is a good software? 3

5 Background What is a good software? Easy to use (Usability); Fast (Efficiency); Easy to update (Maintainability); 3

6 Background What is a good software? Easy to use (Usability); Fast (Efficiency); Easy to update (Maintainability); Issues of usability, efficiency and others are easy to spot. 3

7 Background What is a good software? Easy to use (Usability); Fast (Efficiency); Easy to update (Maintainability); Issues of usability, efficiency and others are easy to spot. What about Security? 3

8 Background (2) 4

9 Background (2) 86% of all websites had at least one serious* vulnerability, and most of time far more than one to be precise; 4

10 Background (2) 86% of all websites had at least one serious* vulnerability, and most of time far more than one to be precise; Organizations that provide software security training for their developers experience 25% fewer serious vulnerabilities annually than those who do not. 4

11 Background (2) 86% of all websites had at least one serious* vulnerability, and most of time far more than one to be precise; Organizations that provide software security training for their developers experience 25% fewer serious vulnerabilities annually than those who do not. Cross-Site Scripting identified in 53%; 4

12 Background (3) Open Web Application Security Project (OWASP); OWASP Top , 2004, 2007, 2010, 2013; Spread the word! 5

13 Background (4)

14 Background (4) OWASP Top

15 Background (4) OWASP Top (SQL/Command) Injection; 02 Broken Authentication and Session Management; 03 Cross-Site Scripting (XSS); 04 Insecure Direct Object References; 05 Security Misconfiguration; 06 Sensitive Data Exposure; 07 Missing Function Level Access Control; 08 Cross-Site Request Forgery (CSRF); 09 Using Known Vulnerable Components; 10 Unvalidated Redirects and Forwards;

16 Background >> SQL Injection 7

17 Background >> SQL Injection It affects all programming languages; 7

18 Background >> SQL Injection It affects all programming languages; 7

19 Background >> SQL Injection It affects all programming languages; What if: ' or '1'='1 or ';DROP table User;--' 7

20 Background >> SQL Injection It affects all programming languages; What if: ' or '1'='1 or ';DROP table User;--' Remove delete from deldeleteete ; 7

21 Background >> SQL Injection It affects all programming languages; What if: ' or '1'='1 or ';DROP table User;--' Remove delete from deldeleteete ; The same solution works in all programming languages; 7

22 Motivation Everything is going online; Applications are going global; Reputation is really important; The later you find a problem, the more expensive it will be to fix it. 8

23 Motivation (2) 9

24 Motivation (3) 10

25 Research Questions 11

26 Research Questions RQ1 - Who should check for security vulnerabilities? 11

27 Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? 11

28 Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? RQ3 - Where should be the best place to check for security vulnerabilities? 11

29 Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? RQ3 - Where should be the best place to check for security vulnerabilities? RQ4 - Why do they appear? 11

30 Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? RQ3 - Where should be the best place to check for security vulnerabilities? RQ4 - Why do they appear? 11

31 Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? RQ3 - Where should be the best place to check for security vulnerabilities? RQ4 - Why do they appear? RQ5 - Which of these security vulnerabilities are the most interesting for early detection? 11

32 Hypotheses 12

33 Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; 12

34 Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; H2 - Architects/Developers don t know about security vulnerabilities; 12

35 Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; H2 - Architects/Developers don t know about security vulnerabilities; H3 - It doesn t exist good tools to help developers find and fix security vulnerabilities; 12

36 Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; H2 - Architects/Developers don t know about security vulnerabilities; H3 - It doesn t exist good tools to help developers find and fix security vulnerabilities; H4 - Most security vulnerabilities are introduced by inexperienced developers; 12

37 Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; H2 - Architects/Developers don t know about security vulnerabilities; H3 - It doesn t exist good tools to help developers find and fix security vulnerabilities; H4 - Most security vulnerabilities are introduced by inexperienced developers; H5 - The deadlines are to blame. 12

38 Empirical Method and Exploratory Study; Evaluation Analyze existing code with the tools available; Mining on bug reports and forums about the topic; 13

39 Work Plan Download and use the most used tools that finds security vulnerabilities; Try to identify which are the vulnerabilities most interesting for early detection; 14

40 Expected Contributions Recommend specific guidelines for development processes to follow; Recommend specific features for tools that finds security vulnerability should have; 15

41 Questions? 16

42 Thank you! - lsampaio@inf.puc-rio.br Alessandro Garcia afgarcia@inf.puc-rio.br OPUS Research Group