Promoting Application Security within Federal Government. AppSec DC November 13, The OWASP Foundation
|
|
|
- Bryce Scott
- 9 years ago
- Views:
Transcription
1 Promoting Application Security within Federal Government AppSec DC November 13, 2009 Dr. Sarbari Gupta, CISSP, CISA Founder/President Electrosoft ext 12 The Foundation
2 Application Security is NOT A JOKE! Courtesy of 2
3 Problem Statement Federal government takes information system security and assurance very seriously Focus areas for Federal security efforts include: Platform Security Network Security Perimeter Security Personnel Security Physical Security Acquisition Security, and so on HOWEVER, APPLICATION SECURITY HAS RECEIVED MEAGER ATTENTION!! 3
4 Agenda Application Security Best Practices Federal IT Security Landscape Mapping AppSec Best Practices to FISMA Observations Wrap-Up 4
5 Application Security Best Practices Application Security Training for Developers/Managers Documented Secure Coding Standards Formalized SDLC Processes Application Threat Modeling Documented Security Design/Architecture Automated Security Testing Manual Code Review Vulnerability and Penetration Analyses Continuous Monitoring for New Vulnerabilities Top Ten Vulnerabilities SANS Top 25 Coding Vulnerabilities NVD, Other lists 5
6 Agenda Application Security Best Practices Federal IT Security Landscape Mapping AppSec Best Practices to FISMA Observations Wrap-Up 6
7 Information Security Federal Landscape Federal Practices in Information Security is driven by REGULATORY COMPLIANCE Compliance with What? Title III of E-Government Act of 2002 Federal Information Security Management Act (FISMA) Privacy Act of 1974 OMB Circular A-130, Appendix III Homeland Security Presidential Directives HSPD-7, HSPD-12, etc. OMB Memos FISMA Reporting Privacy Data Encryption FDCC, etc. 7
8 FISMA Documentation NIST Standards and Guidelines FIPS 199 Standards for Security Categorization of Federal Information and Information Systems SP Rev 1 DRAFT Guide for Security Authorization of Federal Information Systems: A Security Lifecycle Approach SP Rev 3 Recommended Security Controls for Federal Information Systems and Organizations SP A - Guide for Assessing the Security Controls in Federal Information Systems 8
9 NIST Special Pub Revision 3 ID FAMILY CLASS AC Access Control Technical AT Awareness and Training Operational AU Audit and Accountability Technical CA Security Assessment and Authorization Management CM Configuration Management Operational CP Contingency Planning Operational IA Identification and Authentication Technical IR Incident Response Operational MA Maintenance Operational MP Media Protection Operational PE Physical and Environmental Protection Operational PL Planning Management PS Personnel Security Operational RA Risk Assessment Management SA System and Services Acquisition Management SC System and Communications Protection Technical SI System and Information Integrity Operational PM Program Management Management Title: Recommended Security Controls for Federal Information Systems and Organizations Published: August 2009 Approach: Risk Management Framework Categorize Information System Select Security Controls Implement Security Controls Assess Security Controls Authorize Information System Monitor Security Controls 18 families of Security Controls 9
10 Agenda Application Security Best Practices Federal IT Security Landscape Mapping AppSec Best Practices to FISMA Observations Wrap-Up 10
11 AppSec Best Practices Map to FISMA Controls Application Security Best Practices Application Security Training for Developers/Managers Documented Secure Coding Standards Formalized SDLC Processes Application Threat Modeling Documented Security Architecture Automated Testing Source Code Review Vulnerability and Penetration Analyses NIST Rev3 Controls AT-3: Security Training SA-8: Security Engineering Principles SI-3: Malicious Code Protection SA-3: Life Cycle Support SA-8: Security Engineering Principles SA-13: Trustworthiness RA-3: Risk Assessment SA-5: Information System Documentation SA-11: Developer Security Testing CA-2: Security Assessments RA-5: Vulnerability Scanning SA-5: Information System Documentation CA-2: Security Assessments RA-5: Vulnerability Scanning Continuous Monitoring CA-7: Continuous Monitoring 11
12 Top Ten Vulnerabilities (2007) Map to FISMA Controls Top Ten Vulnerabilities A1 - Cross Site Scripting (XSS) A2 - Injection Flaws A3 - Malicious File Execution A4 - Insecure Direct Object Reference A5 - Cross Site Request Forgery (CSRF) A6 - Information Leakage & Improper Error Handling A7 - Broken Authentication and Session Mgmt A8 - Insecure Cryptographic Storage A9 - Insecure Communications A10 - Failure to Restrict URL Access NIST Rev3 Controls SI-10: Information Input Validation SI-10: Information Input Validation Not specified AC-3: Access Enforcement Not specified SI-11: Error Handling SC-23: Session Authenticity SC-13: Use of Cryptography SC-9: Transmission Confidentiality AC-3: Access Enforcement 12
13 SANS Top 25 (1 of 3) - Insecure Interaction Between Components Map to FISMA Controls Top 25 Coding Vulnerabilities CWE-20: Improper Input Validation CWE-116: Improper Encoding or Escaping of Output CWE-89: SQL Injection CWE-79: Cross-site Scripting CWE-78: OS Command Injection CWE-319: Clear-text Transmission of Sensitive Information CWE-352: Cross-Site Request Forgery (CSRF) CWE-362: Race Condition CWE-209: Error Message Information Leak NIST Rev3 Controls SI-10: Information Input Validation Not specified SI-10: Information Input Validation SI-10: Information Input Validation SI-10: Information Input Validation SC-9: Transmission Confidentiality Not specified Not specified SI-11: Error Handling 13
14 SANS Top 25 (2 of 3) Porous Defenses Map to FISMA Controls Top 25 Coding Vulnerabilities CWE-285: Improper Access Control (Authorization) CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-259: Hard-Coded Password CWE-732: Insecure Permission Assignment for Critical Resource CWE-330: Use of Insufficiently Random Values CWE-250: Execution with Unnecessary Privileges CWE-602: Client-Side Enforcement of Server- Side Security NIST Rev3 Controls AC-3: Access Enforcement SC-13: Use of Cryptography IA-5: Authenticator Management AC-3: Access Enforcement Not specified AC-6: Least Privilege Not specified 14
15 SANS Top 25 (3 of 3) - Risky Resource Management Map to FISMA Controls Top 25 Coding Vulnerabilities NIST Rev3 Controls CWE-119: Memory Buffer Overrun SA-8: Security Engineering Principles 1 CWE-642: External Control of Critical State Data SA-8: Security Engineering Principles 1 CWE-73: External Control of File Name or Path SA-8: Security Engineering Principles 1 CWE-426: Un-trusted Search Path SA-8: Security Engineering Principles 1 CWE-94: Code Injection SA-8: Security Engineering Principles 1 CWE-494: Download of Code Without Integrity Check SI-7: Software and Information Integrity CWE-404: Improper Resource Shutdown or Release SA-8: Security Engineering Principles 1 CWE-665: Improper Initialization SA-8: Security Engineering Principles 1 CWE-682: Incorrect Calculation SA-8: Security Engineering Principles 1 1 Weak Mapping 15
16 Application Security Verification Std 2009 Map to FISMA Controls ASVS Security Requirement Areas NIST Rev 3 Controls Cover age V1 - Security Architecture Documentation RA-3 1 of 6 V2 - Authentication Verification AC-2, AC-3, AC-5, AC-7, AC-11, AC-14, AU-2, IA-2, IA- 5, IA-6, IA-8, SC-24, SI-3 12 of 15 V3 - Session Management Verification AC-11, SC-10, SC-23, SI-3 9 of 13 V4 - Access Control Verification AC-2, AC-3, AC-6, SI-3, AU-2 10 of 15 V5 - Input Validation Verification SA-8, SI-3, SI-10, AU-2 7 of 9 V6 - Output Encoding/Escaping Verification SI-3, SI-10 5 of 10 V7 - Cryptography Verification IA-5, SC-12, SC-13, SI-3, AU-2 6 of 10 V8 - Error Handling and Logging Verification SI-3, SI-11, AU-3, AU-9 7 of 12 V9 - Data Protection Verification 0 of 6 V10 - Communication Security Verification AC-4, AC-6, IA-3, IA-5, SC-8, SC-9, SC-24, AU-2 7 of 9 V11 - HTTP Security Verification SC-23 1 of 7 V12 - Security Configuration Verification CM-5, SI-6, SI-7, AU-2 3 of 4 V13 - Malicious Code Search Verification SI-3, SI-7 2 of 2 V14 - Internal Security Verification SC-4, SC-28 2 of 3 16
17 Agenda Application Security Best Practices Federal IT Security Landscape Mapping AppSec Best Practices to FISMA Observations Wrap-Up 17
18 Observations NIST SP Rev 2 had little or no support for Application Security practices HOWEVER, NIST SP Rev 3 has built a solid level of support for Application Security Application Security requirements are sprinkled Difficult to assemble to form complete picture SP Rev 3 could be further refined for AppSec Specific recommendations for change to existing controls Specific recommendations for new requirements 18
19 SP Rev 1 Recommended Refinements (I) AT-3: Security Training Require training for software developers/integrators CA-2: Security Assessment Require Red Team exercises targeted at Software Applications CA-7: Continuous Monitoring Require Red Team exercises at HIGH baseline CM-4: Security Impact Analysis Explicitly require security impact analysis for software changes 19
20 SP Rev 1 Recommended Refinements (II) IA-5: Authenticator Management Require check for unencrypted authenticators in code/scripts at MODERATE and HIGH PL-2: System Security Plan Require Enhancements (CONOPS, Architecture) at HIGH SC-23: Session Authenticity Require enhancements for session ID management at MODERATE/HIGH SI-3: Malicious Code Protection Promote guidance on secure coding and monitoring practices to control description section 20
21 SP Rev 1 Recommended Refinements (III) SA-5: Information System Documentation Reword to apply to custom developed software systems; currently slanted for vendor/manufacturer developed systems Move enhancement related to code reviews to CA-3 or RA-5 SA-8: Security Engineering Principles Move guidance on security training for developers/integrators to AT-3 SA-11: Developer Security Testing Require enhancements for independent code analysis and vulnerability analysis at HIGH 21
22 Sp Rev 3 Extensions/Additions Sensitive Resource Identification (Data, URLs, Config Files, etc.) SC-28: Protection of Information at Rest Expand scope to require explicit identification of sensitive information Conditioning of Output Content/Data SI-12: Information Output Handling and Retention Expand scope to include checking outputs for valid syntax/semantics Server-Side Implementation of Security Services Add new control requiring Common, Non-circumventable Implementation of server-side security checks 22
23 Agenda Application Security Best Practices Federal IT Security Landscape Mapping AppSec Best Practices to FISMA Observations Wrap-Up 23
24 Wrap-Up and Final Thoughts Time to focus on Application/Software Security NIST SP Rev3 provides excellent boost to AppSec within FISMA Refinements/Extensions could further strengthen AppSec practice under FISMA Updates to SP A could strengthen AppSec Testing OMB mandate could provide added impetus to AppSec Let s not wait for a catastrophic AppSec breach A memo in time could save nine! QUESTIONS?? 24
25 Application Security Federal References DISA Application Security and Development STIG July 2008 Application Security and Development Checklist Version 2 Release June 2009 NIST SP Rev 3 Recommended Security Controls for Federal Information Systems and Organizations SP Rev 2 Security Considerations in the System Development Life Cycle Oct 2008 SP (draft) - Technical Guide to Information Security Testing Nov 2007 Security Content Automation Protocol (SCAP) 25
Promoting Application Security within Federal Government. AppSec DC November 13, 2009. The OWASP Foundation http://www.owasp.org
Promoting Application Security within Federal Government AppSec DC November 13, 2009 Dr. Sarbari Gupta, CISSP, CISA Founder/President Electrosoft [email protected] 703-437-9451 ext 12 The Foundation
Get Confidence in Mission Security with IV&V Information Assurance
Get Confidence in Mission Security with IV&V Information Assurance September 10, 2014 Threat Landscape Regulatory Framework Life-cycles IV&V Rigor and Independence Threat Landscape Continuously evolving
NIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems. Samuel R. Ashmore Margarita Castillo Barry Gavrich
NIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems Samuel R. Ashmore Margarita Castillo Barry Gavrich CS589 Information & Risk Management New Mexico Tech Spring 2007
Looking at the SANS 20 Critical Security Controls
Looking at the SANS 20 Critical Security Controls Mapping the SANS 20 to NIST 800-53 to ISO 27002 by Brad C. Johnson The SANS 20 Overview SANS has created the 20 Critical Security Controls as a way of
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
CTR System Report - 2008 FISMA
CTR System Report - 2008 FISMA February 27, 2009 TABLE of CONTENTS BACKGROUND AND OBJECTIVES... 5 BACKGROUND... 5 OBJECTIVES... 6 Classes and Families of Security Controls... 6 Control Classes... 7 Control
IT Security Management Risk Analysis and Controls
IT Security Management Risk Analysis and Controls Steven Gordon Document No: Revision 770 3 December 2013 1 Introduction This document summarises several steps of an IT security risk analysis and subsequent
Security Controls Assessment for Federal Information Systems
Security Controls Assessment for Federal Information Systems Census Software Process Improvement Program September 11, 2008 Kevin Stine Computer Security Division National Institute of Standards and Technology
Security Compliance In a Post-ACA World
1 Security Compliance In a Post-ACA World Security Compliance in a Post-ACA World Discussion of building a security compliance framework as part of an ACA Health Insurance Exchange implementation. Further
Security Language for IT Acquisition Efforts CIO-IT Security-09-48
Security Language for IT Acquisition Efforts CIO-IT Security-09-48 Office of the Senior Agency Information Security Officer VERSION HISTORY/CHANGE RECORD Change Number Person Posting Change Change Reason
DISA's Application Security and Development STIG: How OWASP Can Help You. AppSec DC November 12, 2009. The OWASP Foundation http://www.owasp.
DISA's Application Security and Development STIG: How Can Help You AppSec DC November 12, 2009 Jason Li Senior Application Security Engineer [email protected] The Foundation http://www.owasp.org
Security and Privacy Controls for Federal Information Systems and Organizations
NIST Special Publication 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems JOINT TASK FORCE TRANSFORMATION INITIATIVE This document contains excerpts from NIST Special Publication
Requirements For Computer Security
Requirements For Computer Security FTA/IRS Safeguards Symposium & FTA/IRS Computer Security Conference April 2, 2008 St. Louis 1 Agenda Security Framework Safeguards IT Security Review Process Preparing
COORDINATION DRAFT. FISCAM to NIST Special Publication 800-53 Revision 4. Title / Description (Critical Element)
FISCAM FISCAM 3.1 Security (SM) Critical Element SM-1: Establish a SM-1.1.1 The security management program is adequately An agency/entitywide security management program has been developed, An agency/entitywide
System Security Certification and Accreditation (C&A) Framework
System Security Certification and Accreditation (C&A) Framework Dave Dickinson, IOAT ISSO Chris Tillison, RPMS ISSO Indian Health Service 5300 Homestead Road, NE Albuquerque, NM 87110 (505) 248-4500 fax:
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT: U.S. Election Assistance Commission Compliance with the Requirements of the Federal Information Security Management Act Fiscal
CMS POLICY FOR THE INFORMATION SECURITY PROGRAM
Chief Information Officer Office of Information Services Centers for Medicare & Medicaid Services CMS POLICY FOR THE INFORMATION SECURITY PROGRAM FINAL Version 4.0 August 31, 2010 Document Number: CMS-CIO-POL-SEC02-04.0
HHS Information System Security Controls Catalog V 1.0
Information System Security s Catalog V 1.0 Table of Contents DOCUMENT HISTORY... 3 1. Purpose... 4 2. Security s Scope... 4 3. Security s Compliance... 4 4. Security s Catalog Ownership... 4 5. Security
5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE
5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE 5 FAH-11 H-510 GENERAL (Office of Origin: IRM/IA) 5 FAH-11 H-511 INTRODUCTION 5 FAH-11 H-511.1 Purpose a. This subchapter implements the policy
CONTINUOUS MONITORING
CONTINUOUS MONITORING Monitoring Strategy Part 2 of 3 ABSTRACT This white paper is Part 2 in a three-part series of white papers on the sometimes daunting subject of continuous monitoring (CM) and how
Altius IT Policy Collection Compliance and Standards Matrix
Governance IT Governance Policy Mergers and Acquisitions Policy Terms and Definitions Policy 164.308 12.4 12.5 EDM01 EDM02 EDM03 Information Security Privacy Policy Securing Information Systems Policy
Development. Resilient Software. Secure and. Mark S. Merkow Lakshmikanth Raghavan. CRC Press. Taylor& Francis Croup. Taylor St Francis Group,
Secure and Resilient Software Development Mark S. Merkow Lakshmikanth Raghavan CRC Press Taylor& Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor St Francis Group, an Informs
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
Complying with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 An Assessment of Cyber-Ark's Solutions
Complying with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 An Assessment of Cyber-Ark's Solutions z September 2011 Table of Contents EXECUTIVE SUMMARY... 3 CYBER-ARK
Security Control Standard
Department of the Interior Security Control Standard Risk Assessment January 2012 Version: 1.2 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior, Chief Information
Security Self-Assessment Tool
Security Self-Assessment Tool State Agencies Receiving FPLS Information, 7/15/2015 Contents Overview... 2 Access Control (AC)... 3 Awareness and Training (AT)... 8 Audit and Accountability (AU)... 10 Security
Health Insurance Portability and Accountability Act Enterprise Compliance Auditing & Reporting ECAR for HIPAA Technical Product Overview Whitepaper
Regulatory Compliance Solutions for Microsoft Windows IT Security Controls Supporting DHS HIPAA Final Security Rules Health Insurance Portability and Accountability Act Enterprise Compliance Auditing &
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker www.quotium.com 1/14 Summary Abstract 3 PCI DSS Statistics 4 PCI DSS Application Security 5 How Seeker Helps You Achieve PCI DSS
DFW INTERNATIONAL AIRPORT STANDARD OPERATING PROCEDURE (SOP)
Title: Functional Category: Information Technology Services Issuing Department: Information Technology Services Code Number: xx.xxx.xx Effective Date: xx/xx/2014 1.0 PURPOSE 1.1 To appropriately manage
ASIA/PAC AERONAUTICAL TELECOMMUNICATION NETWORK SECURITY GUIDANCE DOCUMENT
INTERNATIONAL CIVIL AVIATION ORGANIZATION ASIA AND PACIFIC OFFICE ASIA/PAC AERONAUTICAL TELECOMMUNICATION NETWORK SECURITY GUIDANCE DOCUMENT DRAFT Second Edition June 2010 3.4H - 1 TABLE OF CONTENTS 1.
Government of Canada Managed Security Services (GCMSS) Appendix D: Security Control Catalogue ITSG-33 - Annex 3 DRAFT 3.1
Government of Canada Managed Security Services (GCMSS) Appendix D: Security Control Catalogue ITSG-33 - Annex 3 DRAFT 3.1 Date: June 15, 2012 Information Technology Security Guidance Guide to Managing
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
FISMA: Securing National Infrastructure
FISMA: Securing National Infrastructure Using a Holistic Approach to Lower Total Cost of Ownership (TCO) of FISMA Compliance by 50% or More an eiqnetworks White Paper by John Linkous Security and Compliance
OWASP and OWASP Top 10 (2007 Update) OWASP. The OWASP Foundation. Dave Wichers. The OWASP Foundation. OWASP Conferences Chair dave.wichers@owasp.
and Top 10 (2007 Update) Dave Wichers The Foundation Conferences Chair [email protected] COO, Aspect Security [email protected] Copyright 2007 - The Foundation This work is available
VIRGINIA DEPARTMENT OF MOTOR VEHICLES IT SECURITY POLICY. Version 2.
VIRGINIA DEPARTMENT OF MOTOR VEHICLES IT SECURITY POLICY Version 2., 2012 Revision History Version Date Purpose of Revision 2.0 Base Document 2.1 07/23/2012 Draft 1 Given to ISO for Review 2.2 08/15/2012
DIVISION OF INFORMATION SECURITY (DIS)
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Information Systems Acquisitions, Development, and Maintenance v1.0 October 15, 2013 Revision History Update this table every time a new
Cloud Security for Federal Agencies
Experience the commitment ISSUE BRIEF Rev. April 2014 Cloud Security for Federal Agencies This paper helps federal agency executives evaluate security and privacy features when choosing a cloud service
Columbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirements
2012 FISMA Executive Summary Report
2012 FISMA Executive Summary Report March 29, 2013 UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20549 OI'!'ICEOI' lnstfl! C1'0R GENERAt MEMORANDUM March 29,2013 To: Jeff Heslop, Chief
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
Compliance Overview: FISMA / NIST SP800 53
Compliance Overview: FISMA / NIST SP800 53 FISMA / NIST SP800 53: Compliance Overview With Huntsman SIEM The US Federal Information Security Management Act (FISMA) is now a key element of the US Government
What is Web Security? Motivation
[email protected] http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Spigit, Inc. Web Application Vulnerability Assessment/Penetration Test. Prepared By: Accuvant LABS
Web Application Vulnerability Assessment/enetration Test repared By: Accuvant LABS November 20, 2012 Web Application Vulnerability Assessment/enetration Test Introduction Defending the enterprise against
<Insert Picture Here> How to protect sensitive data, challenges & risks
How to protect sensitive data, challenges & risks Lars Klumpes CISSP Security Strategy Consultant EMEA Disclaimer The following is intended to outline our general product direction.
Evaluation Report. Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review. April 30, 2014 Report Number 14-12
Evaluation Report Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review April 30, 2014 Report Number 14-12 U.S. Small Business Administration Office of Inspector General
Security Control Standards Catalog
Security Control Standards Catalog Version 1.2 Texas Department of Information Resources April 3, 2015 Contents About the Security Control Standards Catalog... 1 Document Life Cycle... 1 Revision History...
Securing Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
Improving Web Application Security by Eliminating CWEs Weijie Chen, China INFSY 6891 Software Assurance Professor Dr. Maurice Dawson 15 December 2015
Improving Web Application Security by Eliminating CWEs Weijie Chen, China INFSY 6891 Software Assurance Professor Dr. Maurice Dawson 15 December 2015 1 P a g e ABSTRACT This study examined improving web
CMS SYSTEM SECURITY PLAN (SSP) PROCEDURE
Chief Information Officer Office of Information Services Centers for Medicare & Medicaid Services CMS SYSTEM SECURITY PLAN (SSP) PROCEDURE August 31, 2010 Version 1.1 - FINAL Summary of Changes in SSP
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Security Control Standard
Department of the Interior Security Control Standard Security Assessment and Authorization January 2012 Version: 1.2 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior,
Security Content Automation Protocol for Governance, Risk, Compliance, and Audit
UNCLASSIFIED Security Content Automation Protocol for Governance, Risk, Compliance, and Audit presented by: Tim Grance The National Institute of Standards and Technology UNCLASSIFIED Agenda NIST s IT Security
Enterprise Application Security Program
Enterprise Application Security Program GE s approach to solving the root cause and establishing a Center of Excellence Darren Challey GE Application Security Leader Agenda Why is AppSec important? Why
ETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001
001011 1100010110 0010110001 010110001 0110001011000 011000101100 010101010101APPLICATIO 0 010WIRELESS110001 10100MOBILE00010100111010 0010NETW110001100001 10101APPLICATION00010 00100101010WIRELESS110
FISMA / NIST 800-53 REVISION 3 COMPLIANCE
Mandated by the Federal Information Security Management Act (FISMA) of 2002, the National Institute of Standards and Technology (NIST) created special publication 800-53 to provide guidelines on security
INFORMATION TECHNOLOGY SECURITY POLICY 60-702. Table of Contents
Department of Commerce National Oceanic & Atmospheric Administration National Weather Service NATIONAL WEATHER SERVICE INSTRUCTION 60-702 December 21, 2009 Information Technology INFORMATION TECHNOLOGY
White Paper. Understanding NIST 800 37 FISMA Requirements
White Paper Understanding NIST 800 37 FISMA Requirements Contents Overview... 3 I. The Role of NIST in FISMA Compliance... 3 II. NIST Risk Management Framework for FISMA... 4 III. Application Security
EVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
Complying with the Federal Information Security Management Act. Parallels with Sarbanes-Oxley Compliance
WHITE paper Complying with the Federal Information Security Management Act How Tripwire Change Auditing Solutions Help page 2 page 3 page 3 page 3 page 4 page 4 page 5 page 5 page 6 page 6 page 7 Introduction
Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Information Technology Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program Report.
Sample CDC Certification and Accreditation Checklist For an Application That Is Considered a Moderate Threat
Sample CDC Certification and Accreditation Checklist For an Application That Is Considered a Moderate Threat Centers for Disease and Prevention National Center for Chronic Disease Prevention and Health
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector V.2 Final Draft May 1, 2014 [email protected] This revision incorporates comments from the public. Page Use case 1 Comments
How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
Audit Report. The Social Security Administration s Compliance with the Federal Information Security Management Act of 2002 for Fiscal Year 2013
Audit Report The Social Security Administration s Compliance with the Federal Information Security Management Act of 2002 for Fiscal Year 2013 A-14-13-13086 November 2013 MEMORANDUM Date: November 26,
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
SECURE APPLICATION DEVELOPMENT CODING POLICY OCIO-6013-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER OCIO-6013-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Secure Code Development
ISACA South Florida 7th Annual WOW! Event Copyright Elevate Consult LLC. All Rights Reserved 1 Agenda i. Background ii. iii. iv. Building a Business Case for Secure Coding Top-Down Approach to Develop
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
Attack Vector Detail Report Atlassian
Attack Vector Detail Report Atlassian Report As Of Tuesday, March 24, 2015 Prepared By Report Description Notes [email protected] The Attack Vector Details report provides details of vulnerability
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) [email protected] Open Web Application Security Project http://www.owasp.org
Sitefinity Security and Best Practices
Sitefinity Security and Best Practices Table of Contents Overview The Ten Most Critical Web Application Security Risks Injection Cross-Site-Scripting (XSS) Broken Authentication and Session Management
FITSP-Auditor Candidate Exam Guide
FITSP-Auditor Candidate Exam An Overview of the FITSP-A Certification 2010 Edition Copyright 2009-2010 FITSI 1 FITSP-Auditor Candidate Exam This page is left intentionally blank Copyright 2009-2010 FITSI
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
Spillage and Cloud Computing
Spillage and Cloud Computing Presented to the Information Security and Privacy Advisory Board (ISPAB) A Review in Collaboration with the Federal Chief Information Council (FCIOC) Information Security and
TECHNICAL AUDITS FOR CERTIFYING EUROPEAN CITIZEN COLLECTION SYSTEMS
TECHNICAL AUDITS FOR CERTIFYING EUROPEAN CITIZEN COLLECTION SYSTEMS Technical audits in accordance with Regulation 211/2011 of the European Union and according to Executional Regulation 1179/2011 of the
Security Control Standard
Department of the Interior Security Control Standard Maintenance January 2012 Version: 1.2 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior, Chief Information Officer
Federal Desktop Core Configuration (FDCC)
Federal Desktop Core Configuration (FDCC) Presented by: Saji Ranasinghe Date: October, 2007 FDCC Federal Desktop Core Configuration (FDCC) Standardized Configuration with Hardened Security Settings to
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL. Ensuring Compliance for PCI DSS 6.5 and 6.6
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL Ensuring Compliance for PCI DSS 6.5 and 6.6 CONTENTS 04 04 06 08 11 12 13 Overview Payment Card Industry Data Security Standard PCI Compliance for Web Applications
Deriving Software Security Measures from Information Security Standards of Practice
Deriving Software Measures from Standards of Practice Julia Allen Christopher Alberts Robert Stoddard February 2012 2012 Carnegie Mellon University Copyright 2012 Carnegie Mellon University. This material
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
The Cloud in Regulatory Affairs - Validation, Risk Management and Chances -
45 min Webinar: November 14th, 2014 The Cloud in Regulatory Affairs - Validation, Risk Management and Chances - www.cunesoft.com Rainer Schwarz Cunesoft Holger Spalt ivigilance 2014 Cunesoft GmbH PART
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter [email protected]
Nuclear Regulatory Commission Computer Security Office Computer Security Standard
Nuclear Regulatory Commission Computer Security Office Computer Security Standard Office Instruction: Office Instruction Title: CSO-STD-1108 Web Application Standard Revision Number: 1.0 Effective Date:
Columbia University Web Application Security Standards and Practices. Objective and Scope
Columbia University Web Application Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Application Security Standards and Practices document establishes a baseline
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL INDEPENDENT EVALUATION OF THE NATIONAL CREDIT UNION ADMINISTRATION S COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions [email protected] Agenda Current State of Web Application Security Understanding
WHITE PAPER. FortiWeb Web Application Firewall Ensuring Compliance for PCI DSS 6.5 and 6.6
WHITE PAPER FortiWeb Web Application Firewall Ensuring Compliance for PCI DSS 6.5 and 6.6 Ensuring compliance for PCI DSS 6.5 and 6.6 Page 2 Overview Web applications and the elements surrounding them