Secure Code Development
|
|
|
- Scarlett Moody
- 10 years ago
- Views:
Transcription
1 ISACA South Florida 7th Annual WOW! Event Copyright Elevate Consult LLC. All Rights Reserved 1
2 Agenda i. Background ii. iii. iv. Building a Business Case for Secure Coding Top-Down Approach to Develop Secure Code Developing a Secure Code Initiative v. Integrating Best Coding Practices into the Software Development Life Cycle (SDLC) vi. Secure Code Awareness and Training for Developers vii. Conduct an Independent Secure Code Audit viii. Auditing Software After a Breach ix. Summary x. References Copyright Elevate Consult LLC. All Rights Reserved 2
3 Background What is software security? Protecting software against malicious attack so that the software continues to function correctly The ability of the software to ensure the Confidentiality, Integrity, and Availability of the sensitive data on the system Copyright Elevate Consult LLC. All Rights Reserved 3
4 Background Measuring software security Dependability Trustworthiness Resilience Conformance Software Assurance Copyright Elevate Consult LLC. All Rights Reserved 4
5 Background Perspective Case Study: Target Data Breach Target said 40 million credit and debit card accounts had been affected by a data breach that happened between November 27 th and December 15 th, The Consumer Bankers Association estimated that the cost of card replacement for its members has reached $172 M. When the final tally is in, Target's breach may eclipse the theft at TJX, which compromised more than 90 million records. - The Associated Press Copyright Elevate Consult LLC. All Rights Reserved 5
6 Building a Business Case for Secure Coding The cost of insecure software Software consumers are demanding software assurance Fixing bugs and flaws is very costly after implementation Compliance with technology security standards Copyright Elevate Consult LLC. All Rights Reserved 6
7 Top-Down Approach to Develop Secure Code Make enterprise security the responsibility of leaders at a governance level Develop a secure code initiative and create a secure coding team (not just developers) Empower IT leadership with a budget and the political capital to succeed Use a benchmark to evaluate the performance of the organization s secure code initiative. For example, Building Security In Maturity Model (BSIMM) Copyright Elevate Consult LLC. All Rights Reserved 7
8 Developing a Secure Code Initiative Select a framework to help the organization formulate and implement a strategy for software security. For example, Open Software Assurance Maturity Model (OpenSAMM) Adopt a secure coding standard Integrate secure coding best practices into the SDLC Implement an awareness and training program for secure code development Integrate collaborative testing tools and techniques to facilitate code reviews (automated processes) Copyright Elevate Consult LLC. All Rights Reserved 8
9 Integrating Best Coding Practices into the SDLC Software Development Models: Waterfall model Spiral model Rapid application development Agile development And others Copyright Elevate Consult LLC. All Rights Reserved 9
10 Integrating Best Coding Practices into the SDLC Agile Development Model: Agile Manifesto (2001): Promotes software development following these principles: Individuals and interactions over processes and tools Working software over comprehensive documentation Customer collaboration over contract negotiation Responding to change over following a plan Copyright Elevate Consult LLC. All Rights Reserved 10
11 Integrating Best Coding Practices into the SDLC Agile Development Model Agile Methods Security Concerns: Agile is about building software quickly Move fast and iterate Respond to feedback Emphasis on velocity and business value Deliver software before it is finished Copyright Elevate Consult LLC. All Rights Reserved 11
12 Integrating Best Coding Practices into the SDLC Agile Scrum Scrum is an agile method for project management It is a TEAM based collaborative approach Iterative and incremental Always focus on delivery Copyright Elevate Consult LLC. All Rights Reserved 12
13 Integrating Best Coding Practices into the SDLC Agile Scrum Sprints are the basic units of development in Scrum Usually from 2 to 4 weeks long The release date of a product determines the number of Sprints Sprint planning sessions assign tasks to developers At the end of each sprint there is a customer (product owner) demo Requirements may change after the demo phase Copyright Elevate Consult LLC. All Rights Reserved 13
14 Integrating Best Coding Practices into the SDLC Agile Scrum Scrum Master Role Facilitate sprint planning, retrospective and sprint demos Assist the product owner with keeping the backlog groomed Ensure cross-team coordination Reach out to the larger company network for impediment removal Etc. Copyright Elevate Consult LLC. All Rights Reserved 14
15 Integrating Best Coding Practices into the SDLC What about software security? Incorporate Security activities into all phases of the SDLC process, from initiation to disposal, regardless of the software development method used. Agile Method: Development life cycle is divided into increments or iterations, in which each of these increments touches on each of the conventional phases of development. Copyright Elevate Consult LLC. All Rights Reserved 15
16 Integrating Best Coding Practices into the SDLC What about software security? Incorporate Security activities into all phases of the SDLC process, from initiation to disposal, regardless of the software development method used. Traditional Methods: Development life cycle is divided into systems analysis and requirements definition, systems design, development, integration and testing, acceptance, installation, deployment, evaluation, and disposal. Copyright Elevate Consult LLC. All Rights Reserved 16
17 Integrating Best Coding Practices into the SDLC Software Requirements Definition Consider security requirements, not just functional requirements Authentication Role Based access controls Separation of duties Automated data integrity checks Copyright Elevate Consult LLC. All Rights Reserved 17
18 Integrating Best Coding Practices into the SDLC System Design Perform software architecture risk analysis Review exception handling for application overrides Evaluate: Functional and security requirements Component interfaces Component communications and dependencies Component responsibilities Copyright Elevate Consult LLC. All Rights Reserved 18
19 Integrating Best Coding Practices into the SDLC System Implementation Perform code reviews before application goes into deployment Pay attention to backdoors in the source code Look out for shortcuts to get the product out the door Don t accept the comment But the user would never do that! Copyright Elevate Consult LLC. All Rights Reserved 19
20 Integrating Best Coding Practices into the SDLC System Deployment Review separation of duties during deployment Examine backup procedures and documentation Test passwords used on the sandbox environment Monitor application behavior for unexpected results Copyright Elevate Consult LLC. All Rights Reserved 20
21 Integrating Best Coding Practices into the SDLC System Maintenance Conduct regular code reviews Evaluate change management controls Review major changes to components of the application Copyright Elevate Consult LLC. All Rights Reserved 21
22 Secure Code Awareness and Training for Developers Awareness + Training = Education Embed training into the SDLC Education should be an ongoing process Measure the effectiveness of this program Outcome of Training = Accountability Copyright Elevate Consult LLC. All Rights Reserved 22
23 Conduct an Independent Secure Code Audit Purpose: Security Flaws and Bugs: Discover flaws in the programming that may be lead to security exploitations. For example: Unsecure and unvalidated input or output - Cross-site scripting, SQL injection Improper Exception Handling - Debugging and error messages Insecure communication protocols- Clear-text and unauthenticated protocols Broken or incomplete authentication controls - User ID manipulation Flawed session management - Session or Cookie hijacking Bounds checking - Buffer or Integer overflows Weak storage encryption - Broken or insecure encryption algorithms Copyright Elevate Consult LLC. All Rights Reserved 23
24 Auditing Software after a Breach Forensic investigative and analytical skills and abilities are needed Technical skills Building a digital audit trail Understand computer fraud techniques Understand information collected from various computer logs Understand the inner workings of web servers, firewalls, attack methodology, security procedures & penetration testing 24
25 Auditing Software after a Breach Forensic investigative and analytical skills and abilities are needed Conduct a review of: Computer Incident Response Plan and its performance after a successful cyber attack Chain-of-custody process Information Security Policies and Procedures Secure Code Awareness and Training for Developers Organizational and legal protocols for incident handling Other elements of the Secure Code Development Program 25
26 Summary Software assurance implies dependability, trustworthiness, resilience, and conformance Consumers are demanding better software security Security is the responsibility of leaders at a governance level Integrate secure coding best practices early Embed software architecture and code risk analysis into the SDLC Develop a secure code awareness and training program for all stakeholders Conduct independent secure code audits Assume the organization will have a security breach, so be prepared Copyright Elevate Consult LLC. All Rights Reserved 26
27 References ISO/IEC 9126 Special Publication Copyright Elevate Consult LLC. All Rights Reserved 27
28 Q & A Copyright Elevate Consult LLC. All Rights Reserved 28
29 THANK YOU! Copyright Elevate Consult LLC. All Rights Reserved 29
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing Introduction ManTech Project Manager Mark Shaw, Senior Executive Director Cyber Security Solutions Division
Auditing After a Cyber Attack JAX IIA Chapter Meeting Cybersecurity and Law Enforcement
Auditing After a Cyber Attack JAX IIA Chapter Meeting Cybersecurity and Law Enforcement Copyright Elevate Consult LLC. All Rights Reserved 1 Presenter Ray Guzman MBA, CISSP, CGEIT, CRISC, CISA Over 25
How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions [email protected] Agenda Current State of Web Application Security Understanding
SecurityMetrics Vision whitepaper
SecurityMetrics Vision whitepaper 1 SecurityMetrics Vision: Network Threat Sensor for Small Businesses Small Businesses at Risk for Data Theft Small businesses are the primary target for card data theft,
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker www.quotium.com 1/14 Summary Abstract 3 PCI DSS Statistics 4 PCI DSS Application Security 5 How Seeker Helps You Achieve PCI DSS
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
How to Build a Trusted Application. John Dickson, CISSP
How to Build a Trusted Application John Dickson, CISSP Overview What is Application Security? Examples of Potential Vulnerabilities Strategies to Build Secure Apps Questions and Answers Denim Group, Ltd.
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
White Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers
White Paper Guide to PCI Application Security Compliance for Merchants and Service Providers Contents Overview... 3 I. The PCI DSS Requirements... 3 II. Compliance and Validation Requirements... 4 III.
WhiteHat Security White Paper. Top 11 PCI DSS 3.0 Changes That Will Affect Your Application Security Program
WhiteHat Security White Paper Top 11 PCI DSS 3.0 Changes That Will Affect Your Application Security Program October 2015 The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information
Complete Web Application Security. Phase1-Building Web Application Security into Your Development Process
Complete Web Application Security Phase1-Building Web Application Security into Your Development Process Table of Contents Introduction 3 Thinking of security as a process 4 The Development Life Cycle
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
A Systems Engineering Approach to Developing Cyber Security Professionals
A Systems Engineering Approach to Developing Cyber Security Professionals D r. J e r r y H i l l Approved for Public Release; Distribution Unlimited. 13-3793 2013 The MITRE Corporation. All rights reserved.
Web Engineering Web Application Security Issues
Security Issues Dec 14 2009 Katharina Siorpaes Copyright 2009 STI - INNSBRUCK www.sti-innsbruck.at It is NOT Network Security It is securing: Custom Code that drives a web application Libraries Backend
Promoting Application Security within Federal Government. AppSec DC November 13, 2009. The OWASP Foundation http://www.owasp.org
Promoting Application Security within Federal Government AppSec DC November 13, 2009 Dr. Sarbari Gupta, CISSP, CISA Founder/President Electrosoft [email protected] 703-437-9451 ext 12 The Foundation
OWASP Top Ten Tools and Tactics
OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
(Instructor-led; 3 Days)
Information Security Manager: Architecture, Planning, and Governance (Instructor-led; 3 Days) Module I. Information Security Governance A. Introduction to Information Security Governance B. Overview of
University of California, Riverside Computing and Communications. IS3 Local Campus Overview Departmental Planning Template
University of California, Riverside Computing and Communications IS3 Local Campus Overview Departmental Planning Template Last Updated April 21 st, 2011 Table of Contents: Introduction Security Plan Administrative
Integrating Security into the Application Development Process. Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis
Integrating Security into the Application Development Process Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis Agenda Seek First to Understand Source Code Security AppSec and SQA Analyzing
Barracuda Web Site Firewall Ensures PCI DSS Compliance
Barracuda Web Site Firewall Ensures PCI DSS Compliance E-commerce sales are estimated to reach $259.1 billion in 2007, up from the $219.9 billion earned in 2006, according to The State of Retailing Online
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
Securing Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
Visa U.S.A Cardholder Information Security Program (CISP) Payment Application Best Practices
This document is to be used to verify that a payment application has been validated against Visa U.S.A. Payment Application Best Practices and to create the Report on Validation. Please note that payment
Turning the Battleship: How to Build Secure Software in Large Organizations. Dan Cornell May 11 th, 2006
Turning the Battleship: How to Build Secure Software in Large Organizations Dan Cornell May 11 th, 2006 Overview Background and key questions Quick review of web application security The web application
Promoting Application Security within Federal Government. AppSec DC November 13, 2009. The OWASP Foundation http://www.owasp.org
Promoting Application Security within Federal Government AppSec DC November 13, 2009 Dr. Sarbari Gupta, CISSP, CISA Founder/President Electrosoft [email protected] 703-437-9451 ext 12 The Foundation
Secure Development LifeCycles (SDLC)
www.pwc.com Feb 2014 Secure Development LifeCycles (SDLC) Bart De Win Bart De Win? 15+ years of Information Security Experience Ph.D. in Computer Science - Application Security Author of >60 scientific
Secure Web Applications. The front line defense
Secure Web Applications The front line defense Agenda Web Application Security Threat Overview Exploiting Web Applications Common Attacks & Preventative techniques Developing Secure Web Applications -Security
What is Web Security? Motivation
[email protected] http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Web Application Security
Chapter 1 Web Application Security In this chapter: OWASP Top 10..........................................................2 General Principles to Live By.............................................. 4
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
When is Agile the Best Project Management Method? Lana Tylka
When is Agile the Best Project Management Method? Lana Tylka Staged Incremental Deliveries Prototypes Plan Develop Design Deploy Test Maintain Sequential Steps Multiple Iterations Waterfall Sprints, Spirals
Application Security: What Does it Take to Build and Test a Trusted App? John Dickson, CISSP Denim Group
Application Security: What Does it Take to Build and Test a Trusted App? John Dickson, CISSP Denim Group Overview What is Application Security? Examples of Potential Vulnerabilities Potential Strategies
MANAGED SECURITY TESTING
MANAGED SECURITY TESTING SERVICE LEVEL COMPARISON External Network Testing (EVS) Scanning Basic Threats Penetration Testing Network Vulnerability Scan Unauthenticated Web App Scanning Validation Of Scan
External Supplier Control Requirements
External Supplier Control Requirements Cyber Security For Suppliers Categorised as High Cyber Risk Cyber Security Requirement Description Why this is important 1. Asset Protection and System Configuration
Integrating Security Testing into Quality Control
Integrating Security Testing into Quality Control Executive Summary At a time when 82% of all application vulnerabilities are found in web applications 1, CIOs are looking for traditional and non-traditional
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
Rational AppScan & Ounce Products
IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis Document Scope This document aims to assist organizations comply with PCI DSS 3 when it comes to Application Security best practices.
Certified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) Course Introduction Course Introduction Module 01 - The Process of Auditing Information Systems Lesson 1: Management of the Audit Function Organization of the
Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006
Introduction to Web Application Security Microsoft CSO Roundtable Houston, TX September 13 th, 2006 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go From
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
From Agile by Design. Full book available for purchase here.
From Agile by Design. Full book available for purchase here. Contents Introduction xiii About the Author xix Chapter 1 Adjusting to a Customer-Centric Landscape 1 It s a Whole New World 1 From Customer-Aware
Security Issues with Integrated Smart Buildings
Security Issues with Integrated Smart Buildings Jim Sinopoli, Managing Principal Smart Buildings, LLC The building automation industry is now at a point where we have legitimate and reasonable concern
Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences
Security Testing and Vulnerability Management Process. e-governance
Security Testing and Vulnerability Management Process for e-governance Draft DEPARTMENT OF ELECTRONICS AND INFORMATION TECHNOLOGY Ministry of Communication and Information Technology, Government of India.
Build (develop) and document Acceptance Transition to production (installation) Operations and maintenance support (postinstallation)
It is a well-known fact in computer security that security problems are very often a direct result of software bugs. That leads security researches to pay lots of attention to software engineering. The
Don t Get Burned! Are you Leaving your Critical Applications Defenseless?
Don t Get Burned! Are you Leaving your Critical Applications Defenseless? Ed Bassett Carolyn Ryll, CISSP Enspherics Division of CIBER Presentation Overview Applications Exposed The evolving application
Software Development Life Cycle at SSPL. An Summary of Methodologies We Offer
Software Development Life Cycle at SSPL An Summary of Methodologies We Offer 10/29/2009 Table of Contents The SSPL Advantage... 2 Commonly Used SDLC Models at SSPL... 2 Waterfall Model... 2 Agile Model...
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you
IBM Innovate 2011. AppScan: Introducin g Security, a first. Bobby Walters Consultant, ATSC [email protected] Application Security & Compliance
IBM Innovate 2011 Bobby Walters Consultant, ATSC [email protected] Application Security & Compliance AppScan: Introducin g Security, a first June 5 9 Orlando, Florida Agenda Defining Application Security
G-Cloud Definition of Services Security Penetration Testing
G-Cloud Definition of Services Security Penetration Testing Commercial in Confidence G-Cloud Services An Overview Inner Security is a leading CREST registered information security services provider. We
Preventive Approach for Web Applications Security Testing OWASP 10/30/2009. The OWASP Foundation http://www.owasp.org
Preventive Approach for Web Applications Security Testing 10/30/2009 Luiz Otávio Duarte Ferrucio de Franco Rosa Walcir M. Cardoso Jr. Renato Archer Information Technology Center Brazilian Ministry of Science
Agile and Secure Can We Be Both? Chicago OWASP. June 20 th, 2007
Agile and Secure Can We Be Both? Chicago OWASP June 20 th, 2007 The Agile Practitioner s Dilemma Agile Forces: Be more responsive to business concerns Increase the frequency of stable releases Decrease
OWASP AND APPLICATION SECURITY
SECURING THE 3DEXPERIENCE PLATFORM OWASP AND APPLICATION SECURITY Milan Bruchter/Shutterstock.com WHITE PAPER EXECUTIVE SUMMARY As part of Dassault Systèmes efforts to counter threats of hacking, particularly
93% of large organisations and 76% of small businesses
innersecurity INFORMATION SECURITY Information Security Services 93% of large organisations and 76% of small businesses suffered security breaches in the last year. * Cyber attackers were the main cause.
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Effective Software Security Management
Effective Software Security Management choosing the right drivers for applying application security Author: Dharmesh M Mehta [email protected] / [email protected] Table of Contents Abstract... 1
The Software. Audit Guide. ASQ Quality Press. Milwaukee, Wisconsin. John W. Helgeson
The Software Audit Guide John W. Helgeson ASQ Quality Press Milwaukee, Wisconsin Contents Preface Acknowledgments xv Xlx Part I Audit Fundamentals 1 Chapter 1 Introduction 3 1.1 Definitions 7 1.2 Process
Application Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
Strategic Information Security. Attacking and Defending Web Services
Security PS Strategic Information Security. Attacking and Defending Web Services Presented By: David W. Green, CISSP [email protected] Introduction About Security PS Application Security Assessments
DFW INTERNATIONAL AIRPORT STANDARD OPERATING PROCEDURE (SOP)
Title: Functional Category: Information Technology Services Issuing Department: Information Technology Services Code Number: xx.xxx.xx Effective Date: xx/xx/2014 1.0 PURPOSE 1.1 To appropriately manage
Web application security: automated scanning versus manual penetration testing.
Web application security White paper January 2008 Web application security: automated scanning versus manual penetration testing. Danny Allan, strategic research analyst, IBM Software Group Page 2 Contents
CSUSB Web Application Security Standard CSUSB, Information Security & Emerging Technologies Office
CSUSB, Information Security & Emerging Technologies Office Last Revised: 03/17/2015 Draft REVISION CONTROL Document Title: Author: File Reference: CSUSB Web Application Security Standard Javier Torner
Six Essential Elements of Web Application Security. Cost Effective Strategies for Defending Your Business
6 Six Essential Elements of Web Application Security Cost Effective Strategies for Defending Your Business An Introduction to Defending Your Business Against Today s Most Common Cyber Attacks When web
Agile and Secure: OWASP AppSec Seattle Oct 2006. The OWASP Foundation http://www.owasp.org/
Agile and Secure: Can We Be Both? OWASP AppSec Seattle Oct 2006 Dan Cornell, OWASP San Antonio Leader Principal, Denim Group Ltd. [email protected] (210) 572-4400 Copyright 2006 - The OWASP Foundation
Threat Modeling. Deepak Manohar
Threat Modeling Deepak Manohar Outline Motivation Past Security Approaches Common problems with past security approaches Adversary s perspective Vs Defender s perspective Why defender s perspective? Threat
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
A Strategic Approach to Web Application Security The importance of a secure software development lifecycle
A Strategic Approach to Web Application Security The importance of a secure software development lifecycle Rachna Goel Technical Lead Enterprise Technology Web application security is clearly the new frontier
Agile and Secure: Can We Be Both?
Agile and Secure: Can We Be Both? OWASP AppSec Seattle Oct 2006 Keith Landrus Director of Technology Denim Group Ltd. [email protected] (210) 572-4400 Copyright 2006 - The OWASP Foundation Permission
Web Application Security
Web Application Security Ng Wee Kai Senior Security Consultant PulseSecure Pte Ltd About PulseSecure IT Security Consulting Company Part of Consortium in IDA (T) 606 Term Tender Cover most of the IT Security
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) [email protected] Open Web Application Security Project http://www.owasp.org
Auditing the Security of an SAP HANA Implementation
Produced by Wellesley Information Services, LLC, publisher of SAPinsider. 2015 Wellesley Information Services. All rights reserved. Auditing the Security of an SAP HANA Implementation Juan Perez-Etchegoyen
Guidelines for Website Security and Security Counter Measures for e-e Governance Project
and Security Counter Measures for e-e Governance Project Mr. Lalthlamuana PIO, DoICT Background (1/8) Nature of Cyber Space Proliferation of Information Technology Rapid Growth in Internet Increasing Online
TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices
Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security
ETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001
001011 1100010110 0010110001 010110001 0110001011000 011000101100 010101010101APPLICATIO 0 010WIRELESS110001 10100MOBILE00010100111010 0010NETW110001100001 10101APPLICATION00010 00100101010WIRELESS110
Table of Contents. Page 2/13
Page 1/13 Table of Contents Introduction...3 Top Reasons Firewalls Are Not Enough...3 Extreme Vulnerabilities...3 TD Ameritrade Security Breach...3 OWASP s Top 10 Web Application Security Vulnerabilities
Adobe ColdFusion. Secure Profile Web Application Penetration Test. July 31, 2014. Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661
Adobe ColdFusion Secure Profile Web Application Penetration Test July 31, 2014 Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661 Chicago Dallas This document contains and constitutes the
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
SECURE APPLICATION DEVELOPMENT CODING POLICY OCIO-6013-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER OCIO-6013-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS
KEN VAN WYK. Fundamentals of Secure Coding and how to break Software MARCH 19-23, 2007 RESIDENZA DI RIPETTA - VIA DI RIPETTA, 231 ROME (ITALY)
TECHNOLOGY TRANSFER PRESENTS KEN VAN WYK Fundamentals of Secure Coding and how to break Software MARCH 19-23, 2007 RESIDENZA DI RIPETTA - VIA DI RIPETTA, 231 ROME (ITALY) [email protected] www.technologytransfer.it
Development. Resilient Software. Secure and. Mark S. Merkow Lakshmikanth Raghavan. CRC Press. Taylor& Francis Croup. Taylor St Francis Group,
Secure and Resilient Software Development Mark S. Merkow Lakshmikanth Raghavan CRC Press Taylor& Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor St Francis Group, an Informs
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL. Ensuring Compliance for PCI DSS 6.5 and 6.6
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL Ensuring Compliance for PCI DSS 6.5 and 6.6 CONTENTS 04 04 06 08 11 12 13 Overview Payment Card Industry Data Security Standard PCI Compliance for Web Applications
Thick Client Application Security
Thick Client Application Security Arindam Mandal ([email protected]) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
Network Test Labs (NTL) Software Testing Services for igaming
Network Test Labs (NTL) Software Testing Services for igaming Led by committed, young and dynamic professionals with extensive expertise and experience of independent testing services, Network Test Labs
National Endowment for the Arts Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2. Exit Conference...
NEA OIG Report No. R-13-03 Table of Contents Results of Evaluation... 1 Areas for Improvement... 2 Area for Improvement 1: The agency should implement ongoing scanning to detect vulnerabilities... 2 Area