Application Security Testing How to find software vulnerabilities before you ship or procure code
|
|
|
- Meredith Clementine Elliott
- 10 years ago
- Views:
Transcription
1 Application Security Testing How to find software vulnerabilities before you ship or procure code Anita D Amico, Ph.D. Hassan Radwan 1
2 Overview Why Care About Application Security? Quality vs Security Application Security Techniques Manual Code Reviews Static Application Security Testing Dynamic Application Security Testing How to Incorporate Application Security into Your Organization 2
3 About Code Dx, Inc. DHS goal: Secure the software supply chain DHS funded Secure Decisions to develop innovative technologies to improve and expand security testing of software applications. Led to new open source and commercial solutions; formation of new company Code Dx, Inc. Co-organizer for OWASP Long Island chapter Based in Northport & Clifton Park, NY See for more cybersecurity innovations. 3
4 Developers of freely available community resources Code-Pulse.com CWEvis.org in 5
5 Why Care About Application Security? 6
6 Data Breaches Impact 350 million accounts impacted Annual global cost of cybercrime is > $400 b Net Losses: Estimating the Global Cost of Cybercrime, Center for Strategic and International Studies, June
7 Web App Attacks: A favorite method of organized crime This year, organized crime became the most frequently seen threat actor for Web App Attacks. Verizon Data Breach Report 2015 Web Applications are used to perpetrate 31% of breaches into Financial Services 8 8
8 Software flaws are at root of most cyber incidents 90% of security incidents result from exploits against defects in software Build Security In Website, DHS Bug Bounties Google pays white hat hackers up to $20k to find vulnerabilities in its Web browser, before attackers do Microsoft offers as much as $150k 9
9 YOU RE NOT AS SECURE AS YOU MAY THINK! 11
10 Quality vs Security 12
11 Example Quality and Security Issues Example Quality Issues Confusing code Performance issues Concurrency issues Example Security Issues SQL Injection Cross-site scripting (XSS) Cross-site request forgery (CSRF) Memory leaks Null pointer Redundant & dead code Buffer overflows Using hard coded passwords Sensitive data exposure 13
12 Quality is Security Quality and security are closely intertwined 2011 Firefox study found that 82% of vulnerable source files were also faulty files Software Engineering Institute in 2014 study concluded that: Over half of security vulnerabilities are also quality defects There is a direct correlation between the number of quality defects in a system and the number of security vulnerabilities 14
13 QUALITY SECURITY QUALITY CODE LEADS TO MORE SECURE CODE 15
14 Application Security Testing Techniques 16
15 Application Security Testing Techniques Manual code reviews Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) 17
16 Code Reviews Established practice for improved code quality Beneficial to both quality and security Useful to detect fundamental structural flaws Certain security issues can only be detected via manual reviews 18
17 Static Application Security Testing (SAST) Automated Statically scans source or binary files Detect potential vulnerabilities Potential vulnerabilities need manual verification Many SAST tools available, open source & commercial Dependency checking for known vulnerabilities 19
18 SAST Workflow 1. Input selection, source and/or binary files 2. SAST tools scan input files 3. SAST tools present list of potential vulnerabilities 4. Manual potential vulnerability triage 5. Remediation of confirmed vulnerabilities 20
19 Typical SAST result listing with filtering workflow 21
20 Typical detailed view with source listing and remediation guidance 22
21 Dynamic Application Security Testing (DAST) Application penetration testing Manual and/or Automated Dynamically scan application at runtime Attempt to penetrate an application by detecting and exploiting vulnerabilities Typically performed in the run up to releases Many DAST tools available, open source & commercial OWASP ZAP 23
22 DAST Workflow 1. Application staging 2. DAST tools manually/automatically tuned to identify the attack surface 3. DAST tools perform active probing for vulnerabilities 4. Identified vulnerabilities reported 5. Remediation of vulnerabilities 24
23 Typical DAST scanning screen 25
24 Typical detailed view with remediation guidance 26
25 How to Incorporate Application Security into Your Organization 27
26 Before you Test: SDLC Application security cannot be a final after-thought Incorporate security into all aspects of the SDLC Learn from the processes that are out there OpenSAMM, BSIMM, Microsoft Security DLC Source: Microsoft Security Development Lifecycle SAST + Code Reviews 28
27 Test Early, Fix Early 29
28 Before you Test: Educate Stakeholders and development teams need to see value in application security: Pay now or pay more later Integrate application security tools into the developers IDEs Many resources available to offer guidance 30
29 Best practice: Use multiple static analysis tools and combine results Different tools identify different problems D A C B One tool on average detects 14% weaknesses Kris Britton and Chuck Willis, Sticking to the Facts: Scientific Study of Static Analysis Tools, Sept 2011: Non-overlap: Hits reported by one tool and no others (84%) Overlap: Hits reported by more than one tool (16%) 2 tools 3 tools 4 tools All 5 tools Paul E. Black, Evaluating Static Analysis Tools, 8 July 2009: 31
30 Use software vulnerability management system to combine/normalize multiple results <BugInstance type="np_null_on_some_path" priority="1" abbrev="np" category="correctness"> <Class classname="com.securedecisions.tva.model.linksettransform.linksetaggregator"> <SourceLine classname="com.securedecisions.tva.model.linksettransform.linksetaggregator" start="58" end="670" sourcefile="linksetaggregator.java" sourcepath="com/securedecisions/tva/model/linksettransform/linksetaggregator.java"/> FindBugs Output </Class> <Method classname="com.securedecisions.tva.model.linksettransform.linksetaggregator" name="createfromexploit" signature="(lcom/securedecisions/tva/model/xml/ag/linkdocument$link;lcom/securedecisions/tva/model/xml/pdag/protectiondomaindocument$protectiondomain;z)lcom/securedecisions/tva/m odel/xml/pdag/exploitdocument$exploit;" isstatic="false"> <SourceLine classname="com.securedecisions.tva.model.linksettransform.linksetaggregator" start="540" end="563" startbytecode="0" endbytecode="479" sourcefile="linksetaggregator.java" sourcepath="com/securedecisions/tva/model/linksettransform/linksetaggregator.java"/> </Method> <LocalVariable name="machine" register="5" pc="124" role="local_variable_value_of"/> <SourceLine classname="com.securedecisions.tva.model.linksettransform.linksetaggregator" Tool A Tool B start="550" end="550" Tool startbytecode="125" C endbytecode="125" Tool D sourcefile="linksetaggregator.java" sourcepath="com/securedecisions/tva/model/linksettransform/linksetaggregator.java" role="source_line_deref"/> <SourceLine classname="com.securedecisions.tva.model.linksettransform.linksetaggregator" start="549" end="549" startbytecode="85" endbytecode="85" sourcefile="linksetaggregator.java" sourcepath="com/securedecisions/tva/model/linksettransform/linksetaggregator.java" role="source_line_known_null"/> </BugInstance> ndlerequest" namespace="org.owasp.webgoat.lessons.crosssitescripting" enclosingclass="crosssitescripting"/> <Vulnerability> <ClassInfo> <ClassID>FE4EADF C36-863E-5A01C4A0E1A4</ClassID> <Kingdom>Encapsulation</Kingdom> <Type>System Information Leak</Type> <AnalyzerName>semantic</AnalyzerName> <DefaultSeverity>3.0</DefaultSeverity> </ClassInfo> <InstanceInfo> <InstanceID>0010C1C949B6B E9BA51866F0D</InstanceID> <InstanceSeverity>3.0</InstanceSeverity> <Confidence>5.0</Confidence> working with different tool vendors Fortify isoutput a confusing and challenging and time-consuming process: the engines work differently, which is good since they catch different types of problems </InstanceInfo> <AnalysisInfo> <Unified> <Context> <Function name="handlerequest" namespace="org.owasp.webgoat.lessons.crosssitescripting" enclosingclass="crosssitescripting"/> <FunctionDeclarationSourceLocation path="java/org/owasp/webgoat/lessons/crosssitescripting/crosssitescripting.java" line="234" lineend="296" colstart="2" colend="0"/> </Context> <ReplacementDefinitions> Jim Bird, Building Real Software 32
31 Best practice: Tune DAST pen testing tools to maximize code coverage 1 st scan 2 nd scan Tuning DAST tools improves amount of code covered when penetration testing applications Code coverage illustration prepared using OWASP Code Pulse Code-Pulse.com 3 rd scan 33
32 Recommendations Adopt all three techniques in limited doses initially Manual Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) Use a vulnerability management system to combine and normalize results of different techniques Examples: Code Dx, Thread Fix, Risk I/O Don t get overwhelmed, focus on a subset of the initial findings Example: Filter weaknesses to focus only on OWASP Top Ten ( ) Integrate the tooling into your SDLC 34
33 Anita D Amico Hassan Radwan 35
Code Dx: Visual analytics for triage of source code vulnerabilities
CYBER SECURITY DIVISION 2013 PRINCIPAL INVESTIGATORS Code Dx: Visual analytics for triage of source code vulnerabilities Secure Decisions, a division of Applied Visions, Inc. Anita D Amico Ken Prole September
Integrating Application Security into the Mobile Software Development Lifecycle. WhiteHat Security Paper
Integrating Application Security into the Mobile Software Development Lifecycle WhiteHat Security Paper Keeping pace with the growth of mobile According to the November 2015 edition of the Ericsson Mobility
Mean Time to Fix (MTTF) IT Risk s Dirty Little Secret Joe Krull, CPP, CISSP, IAM, CISA, A.Inst.ISP, CRISC, CIPP
Mean Time to Fix (MTTF) IT Risk s Dirty Little Secret Joe Krull, CPP, CISSP, IAM, CISA, A.Inst.ISP, CRISC, CIPP Presentation Overview Basic Application Security (AppSec) Fundamentals Risks Associated With
How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
Protect Your Organization With the Certification That Maps to a Master s-level Education in Software Assurance
Protect Your Organization With the Certification That Maps to a Master s-level Education in Software Assurance Sponsored by the U.S. Department of Homeland Security (DHS), the Software Engineering Institute
A Strategic Approach to Web Application Security The importance of a secure software development lifecycle
A Strategic Approach to Web Application Security The importance of a secure software development lifecycle Rachna Goel Technical Lead Enterprise Technology Web application security is clearly the new frontier
WHITEPAPER. Nessus Exploit Integration
Nessus Exploit Integration v2 Tenable Network Security has committed to providing context around vulnerabilities, and correlating them to other sources, such as available exploits. We currently pull information
Streamlining Application Vulnerability Management: Communication Between Development and Security Teams
Streamlining Application Vulnerability Management: Communication Between Development and Security Teams October 13, 2012 OWASP Boston Application Security Conference Agenda Introduction / Background Vulnerabilities
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
Six Essential Elements of Web Application Security. Cost Effective Strategies for Defending Your Business
6 Six Essential Elements of Web Application Security Cost Effective Strategies for Defending Your Business An Introduction to Defending Your Business Against Today s Most Common Cyber Attacks When web
Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP
Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand different types of application assessments and how they differ Be
Development. Resilient Software. Secure and. Mark S. Merkow Lakshmikanth Raghavan. CRC Press. Taylor& Francis Croup. Taylor St Francis Group,
Secure and Resilient Software Development Mark S. Merkow Lakshmikanth Raghavan CRC Press Taylor& Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor St Francis Group, an Informs
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information
Enterprise Application Security Program
Enterprise Application Security Program GE s approach to solving the root cause and establishing a Center of Excellence Darren Challey GE Application Security Leader Agenda Why is AppSec important? Why
Web application security: automated scanning versus manual penetration testing.
Web application security White paper January 2008 Web application security: automated scanning versus manual penetration testing. Danny Allan, strategic research analyst, IBM Software Group Page 2 Contents
WebGoat for testing your Application Security tools
WebGoat for testing your Application Security tools NAISG-DFW February 28 th, 2012 Michael A Ortega, CISSP CEH CISM GCFA Sr Application Security Professional IBM Security Systems 312.523.1538 [email protected]
ensuring security the way how we do it
ensuring security the way how we do it HUSTEF, 2015.11.18 Attila Tóth 1 Nokia Solutions and Networks 2014 Disclaimer The ideas, processes, tools are presented from a practitioner s point of view working
HP ESP Partner Enablement Fortify Proof of Concept Boot Camp Training
HP ESP Partner Enablement Fortify Proof of Concept Boot Camp Training HP and HP Enterprise Security Products are committed to your success as an HP Partner. In the Fortify Proof of Concept Boot Camp Training,
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions [email protected] Agenda Current State of Web Application Security Understanding
Software Development: The Next Security Frontier
James E. Molini, CISSP, CSSLP Microsoft Member, (ISC)² Advisory Board of the Americas [email protected] http://www.codeguard.org/blog Software Development: The Next Security Frontier De-perimiterization
The Web AppSec How-to: The Defenders Toolbox
The Web AppSec How-to: The Defenders Toolbox Web application security has made headline news in the past few years. Incidents such as the targeting of specific sites as a channel to distribute malware
SAFECode Security Development Lifecycle (SDL)
SAFECode Security Development Lifecycle (SDL) Michael Howard Microsoft Matthew Coles EMC 15th Semi-annual Software Assurance Forum, September 12-16, 2011 Agenda Introduction to SAFECode Security Training
MANAGED SECURITY TESTING
MANAGED SECURITY TESTING SERVICE LEVEL COMPARISON External Network Testing (EVS) Scanning Basic Threats Penetration Testing Network Vulnerability Scan Unauthenticated Web App Scanning Validation Of Scan
Learning objectives for today s session
Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand what a black box and white box assessment is and how they differ Identify
Development Testing for Agile Environments
Development Testing for Agile Environments November 2011 The Pressure Is On More than ever before, companies are being asked to do things faster. They need to get products to market faster to remain competitive
IBM Rational AppScan: Application security and risk management
IBM Software Security November 2011 IBM Rational AppScan: Application security and risk management Identify, prioritize, track and remediate critical security vulnerabilities and compliance demands 2 IBM
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker www.quotium.com 1/14 Summary Abstract 3 PCI DSS Statistics 4 PCI DSS Application Security 5 How Seeker Helps You Achieve PCI DSS
white SECURITY TESTING WHITE PAPER
white SECURITY TESTING WHITE PAPER Contents: Introduction...3 The Need for Security Testing...4 Security Scorecards...5 Test Approach... 11 Framework... 16 Project Initiation Process... 17 Conclusion...
White Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers
White Paper Guide to PCI Application Security Compliance for Merchants and Service Providers Contents Overview... 3 I. The PCI DSS Requirements... 3 II. Compliance and Validation Requirements... 4 III.
How To Ensure That Your Computer System Is Safe
Establishing a Continuous Process for PCI DSS Compliance Visa, MasterCard, American Express, and other payment card companies currently require all U.S. merchants accepting credit card payments to comply
Web application testing
CL-WTS Web application testing Classroom 2 days Testing plays a very important role in ensuring security and robustness of web applications. Various approaches from high level auditing through penetration
A Strategic Approach to Web Application Security
WhiteHat Security White Paper A Strategic Approach to Web Application Security Extending security across the entire software development lifecycle Jerry Hoff Vice President, Static Code Analysis Division
HP Fortify application security
HP Fortify application security Erik Costlow Enterprise Security The problem Cyber attackers are targeting applications Networks Hardware Applications Intellectual Property Security Measures Switch/Router
From the Bottom to the Top: The Evolution of Application Monitoring
From the Bottom to the Top: The Evolution of Application Monitoring Narayan Makaram, CISSP Director, Security Solutions HP/Enterprise Security Business Unit Session ID: SP01-202 Session 2012 Classification:
How To Check Code Coverage In A Black Box Test
Code Pulse: Real-Time Code Coverage for Penetration Testing Activities Hassan Radwan, Kenneth Prole Secure Decisions Division Applied Visions, Inc. Northport, NY, USA {Hassan.Radwan, Ken.Prole} @securedecisions.com
Secure Code Development
ISACA South Florida 7th Annual WOW! Event Copyright Elevate Consult LLC. All Rights Reserved 1 Agenda i. Background ii. iii. iv. Building a Business Case for Secure Coding Top-Down Approach to Develop
HP Application Security Center
HP Application Security Center Web application security across the application lifecycle Solution brief HP Application Security Center helps security professionals, quality assurance (QA) specialists and
D. Best Practices D.1. Assurance The 5 th A
Best Practices I&C School Prof. P. Janson September 2014 D. Best Practices D.1. Assurance The 5 th A 1 of 20 IT systems are insecure for two main reasons: People are fallible and systems are complex and
Integrating Tools Into the SDLC
Integrating Tools Into the SDLC FIRST Conference 2007 The problem Too many organizations have either: Failed to try software security tools at all Tried tools, but became overwhelmed Tools relegated to
Secure in 2010? Broken in 2011!
Secure in 2010? Broken in 2011! Matias Madou Principal Security Researcher Abstract In 2010, a security research firm stumbled on a couple of vulnerabilities in Apache OFBiz, a widely used open source
BUILDING AN OFFENSIVE SECURITY PROGRAM BUILDING AN OFFENSIVE SECURITY PROGRAM
BUILDING AN OFFENSIVE SECURITY PROGRAM Common Gaps in Security Programs Outsourcing highly skilled security resources can be cost prohibitive. Annual assessments don t provide the coverage necessary. Software
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis Document Scope This document aims to assist organizations comply with PCI DSS 3 when it comes to Application Security best practices.
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
OWASP Top Ten Tools and Tactics
OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),
Network Security Audit. Vulnerability Assessment (VA)
Network Security Audit Vulnerability Assessment (VA) Introduction Vulnerability Assessment is the systematic examination of an information system (IS) or product to determine the adequacy of security measures.
TOOL EVALUATION REPORT: FORTIFY
TOOL EVALUATION REPORT: FORTIFY Derek D Souza, Yoon Phil Kim, Tim Kral, Tejas Ranade, Somesh Sasalatti ABOUT THE TOOL Background The tool that we have evaluated is the Fortify Source Code Analyzer (Fortify
Is your software secure?
Is your software secure? HP Fortify Application Security VII konferencja Secure 2013 Warsaw - October 9, 2013 Gunner Winkenwerder Sales Manager Fortify CEE, Russia & CIS HP Enterprise Security +49 (172)
HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA [email protected] +49 1520 1898430 Enterprise Security
HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA [email protected] +49 1520 1898430 Enterprise Security The problem Cyber attackers are targeting applications
White Paper. Automating Your Code Review: Moving to a SaaS Model for Application Security
White Paper Automating Your Code Review: Moving to a SaaS Model for Application Security Contents Overview... 3 Executive Summary... 3 Code Review and Security Analysis Methods... 5 Source Code Review
DFW INTERNATIONAL AIRPORT STANDARD OPERATING PROCEDURE (SOP)
Title: Functional Category: Information Technology Services Issuing Department: Information Technology Services Code Number: xx.xxx.xx Effective Date: xx/xx/2014 1.0 PURPOSE 1.1 To appropriately manage
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
HP Fortify Software Security Center
HP Fortify Software Security Center Proactively Eliminate Risk in Software Trust Your Software 92% of exploitable vulnerabilities are in software National Institute for Standards and Technology (NIST)
Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006
Introduction to Web Application Security Microsoft CSO Roundtable Houston, TX September 13 th, 2006 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go From
Secure in 2010? Broken in 2011! Matias Madou, PhD Principal Security Researcher
Secure in 2010? Broken in 2011! Matias Madou, PhD Principal Security Researcher Matias Madou Principal Security Researcher, Fortify an HP Company Static Analysis Rules Insider Threat Research Runtime products:
DEVELOPING SECURE SOFTWARE
DEVELOPING SECURE SOFTWARE A FOUNDATION FOR CLOUD AND IOT SECURITY Eric Baize @ericbaize Senior Director, Product Security Office EMC Corporation Chairman of SAFECode CSA EMEA Congress November 2015 1
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
The AppSec How-To: Achieving Security in DevOps
The AppSec How-To: Achieving Security in DevOps How do you integrate security within a Continuous Deployment (CD) environment - where every 5 minutes a feature, an enhancement, or a bug fix needs to be
Microsoft Security Development Lifecycle for IT. Rob Labbé Application Consulting and Engineering Services [email protected]
Microsoft Security Development Lifecycle for IT Rob Labbé Application Consulting and Engineering Services [email protected] The Reasons for Secure Software There are many threats to data and systems
Software security specification and verification
Software security specification and verification Erik Poll Security of Systems (SoS) group Radboud University Nijmegen Software (in)security specification and verification/detection Erik Poll Security
Bringing Security Testing to Development. How to Enable Developers to Act as Security Experts
Bringing Security Testing to Development How to Enable Developers to Act as Security Experts Background: SAP SE SAP SE Business Software Vendor Over 68000 employees Worldwide development Myself Security
Survey on Application Security Programs and Practices
Survey on Application Security Programs and Practices A SANS Analyst Survey Written by Jim Bird and Frank Kim Advisor: Barbara Filkins February 2014 Sponsored by Hewlett-Packard, Qualys and Veracode 2014
Threat Modeling/ Security Testing. Tarun Banga, Adobe 1. Agenda
Threat Modeling/ Security Testing Presented by: Tarun Banga Sr. Manager Quality Engineering, Adobe Quality Leader (India) Adobe Systems India Pvt. Ltd. Agenda Security Principles Why Security Testing Security
1000 Projects later. Security Code Scans at SAP
1000 Projects later Security Code Scans at SAP About Us Ruediger Bachmann is a Development Architect at SAP AG working, as member of the central code analyses team, in the areas application security and
Software & Supply Chain Assurance: Mitigating Risks Attributable to Exploitable ICT / Software Products and Processes
Software & Supply Chain Assurance: Mitigating Risks Attributable to Exploitable ICT / Software Products and Processes Joe Jarzombek, PMP, CSSLP Director for Software & Supply Chain Assurance Stakeholder
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you
How To Protect Your Data From Attack
Integrating Vulnerability Scanning into the SDLC Eric Johnson JavaOne Conference 10/26/2015 1 Eric Johnson (@emjohn20) Senior Security Consultant Certified SANS Instructor Certifications CISSP, GWAPT,
IMPROVING VULNERABILITY MANAGEMENT EFFECTIVENESS WITH APPLICATION SECURITY MONITORING
IMPROVING VULNERABILITY MANAGEMENT EFFECTIVENESS WITH APPLICATION SECURITY How runtime application security monitoring helps enterprises make smarter decisions on remediation 2 ABSTRACT Enterprises today
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework [email protected] keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
Juniper Networks Secure
White Paper Juniper Networks Secure Development Lifecycle Six Practices for Improving Product Security Copyright 2013, Juniper Networks, Inc. 1 Table of Contents Executive Summary...3 Introduction...3
Real-time hybrid analysis:
Real-time hybrid : Find more, fix faster Technology white paper Brian Chess, Ph.D., Distinguished Technologist, HP Founder and Chief Scientist, HP Fortify Summary Real-time hybrid marks a substantial evolution
Starting your Software Security Assurance Program. May 21, 2015 ITARC, Stockholm, Sweden
Starting your Software Security Assurance Program May 21, 2015 ITARC, Stockholm, Sweden Presenter Max Poliashenko Chief Enterprise Architect Wolters Kluwer, Tax & Accounting Max leads the Enterprise Architecture
Development Processes (Lecture outline)
Development*Process*for*Secure* So2ware Development Processes (Lecture outline) Emphasis on building secure software as opposed to building security software Major methodologies Microsoft's Security Development
Attack Vector Detail Report Atlassian
Attack Vector Detail Report Atlassian Report As Of Tuesday, March 24, 2015 Prepared By Report Description Notes [email protected] The Attack Vector Details report provides details of vulnerability
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
Securing Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter [email protected]
Security Testing of Java web applications Using Static Bytecode Analysis of Deployed Applications
Security Testing of Java web applications Using Static Bytecode Analysis of Deployed Applications Streamline your web application Security testing with IBM Security AppScan Source 9.0.1 Leyla Aravopoulos