Security vulnerabilities: should they be early detected? - lsampaio@inf.puc-rio.br Alessandro Garcia afgarcia@inf.puc-rio.br OPUS Research Group
Agenda 1. Background; 2.Motivation; 3.Research Questions; 4.Hypotheses; 5.Empirical Method and Evaluation; 6.Work Plan; 7.Expected Contributions; 8.Questions? 2
Background 3
Background What is a good software? 3
Background What is a good software? Easy to use (Usability); Fast (Efficiency); Easy to update (Maintainability); 3
Background What is a good software? Easy to use (Usability); Fast (Efficiency); Easy to update (Maintainability); Issues of usability, efficiency and others are easy to spot. 3
Background What is a good software? Easy to use (Usability); Fast (Efficiency); Easy to update (Maintainability); Issues of usability, efficiency and others are easy to spot. What about Security? 3
Background (2) https://www.whitehatsec.com/assets/wpstatsreport_052013.pdf 4
Background (2) 86% of all websites had at least one serious* vulnerability, and most of time far more than one -- 56 to be precise; https://www.whitehatsec.com/assets/wpstatsreport_052013.pdf 4
Background (2) 86% of all websites had at least one serious* vulnerability, and most of time far more than one -- 56 to be precise; Organizations that provide software security training for their developers experience 25% fewer serious vulnerabilities annually than those who do not. https://www.whitehatsec.com/assets/wpstatsreport_052013.pdf 4
Background (2) 86% of all websites had at least one serious* vulnerability, and most of time far more than one -- 56 to be precise; Organizations that provide software security training for their developers experience 25% fewer serious vulnerabilities annually than those who do not. Cross-Site Scripting identified in 53%; https://www.whitehatsec.com/assets/wpstatsreport_052013.pdf 4
Background (3) Open Web Application Security Project (OWASP); OWASP Top 10 2003, 2004, 2007, 2010, 2013; Spread the word! 5
Background (4) 2009 6
Background (4) OWASP Top 10 2013 2009 6
Background (4) OWASP Top 10 2013 01 (SQL/Command) Injection; 02 Broken Authentication and Session Management; 03 Cross-Site Scripting (XSS); 04 Insecure Direct Object References; 05 Security Misconfiguration; 06 Sensitive Data Exposure; 07 Missing Function Level Access Control; 08 Cross-Site Request Forgery (CSRF); 09 Using Known Vulnerable Components; 10 Unvalidated Redirects and Forwards; 2009 6
Background >> SQL Injection 7
Background >> SQL Injection It affects all programming languages; 7
Background >> SQL Injection It affects all programming languages; 7
Background >> SQL Injection It affects all programming languages; What if: ' or '1'='1 or ';DROP table User;--' 7
Background >> SQL Injection It affects all programming languages; What if: ' or '1'='1 or ';DROP table User;--' Remove delete from deldeleteete ; 7
Background >> SQL Injection It affects all programming languages; What if: ' or '1'='1 or ';DROP table User;--' Remove delete from deldeleteete ; The same solution works in all programming languages; 7
Motivation Everything is going online; Applications are going global; Reputation is really important; The later you find a problem, the more expensive it will be to fix it. 8
Motivation (2) http://h20427.www2.hp.com/resources/pdfs/tw/zh/2013/0307hp_2012_cyber_risk_report.pdf 9
Motivation (3) http://h20427.www2.hp.com/resources/pdfs/tw/zh/2013/0307hp_2012_cyber_risk_report.pdf 10
Research Questions 11
Research Questions RQ1 - Who should check for security vulnerabilities? 11
Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? 11
Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? RQ3 - Where should be the best place to check for security vulnerabilities? 11
Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? RQ3 - Where should be the best place to check for security vulnerabilities? RQ4 - Why do they appear? 11
Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? RQ3 - Where should be the best place to check for security vulnerabilities? RQ4 - Why do they appear? 11
Research Questions RQ1 - Who should check for security vulnerabilities? RQ2 - When should be the best moment to check for security vulnerabilities? RQ3 - Where should be the best place to check for security vulnerabilities? RQ4 - Why do they appear? RQ5 - Which of these security vulnerabilities are the most interesting for early detection? 11
Hypotheses 12
Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; 12
Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; H2 - Architects/Developers don t know about security vulnerabilities; 12
Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; H2 - Architects/Developers don t know about security vulnerabilities; H3 - It doesn t exist good tools to help developers find and fix security vulnerabilities; 12
Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; H2 - Architects/Developers don t know about security vulnerabilities; H3 - It doesn t exist good tools to help developers find and fix security vulnerabilities; H4 - Most security vulnerabilities are introduced by inexperienced developers; 12
Hypotheses H1 - Architects/Developers don t care about security vulnerabilities; H2 - Architects/Developers don t know about security vulnerabilities; H3 - It doesn t exist good tools to help developers find and fix security vulnerabilities; H4 - Most security vulnerabilities are introduced by inexperienced developers; H5 - The deadlines are to blame. 12
Empirical Method and Exploratory Study; Evaluation Analyze existing code with the tools available; Mining on bug reports and forums about the topic; 13
Work Plan Download and use the most used tools that finds security vulnerabilities; Try to identify which are the vulnerabilities most interesting for early detection; 14
Expected Contributions Recommend specific guidelines for development processes to follow; Recommend specific features for tools that finds security vulnerability should have; 15
Questions? 16
Thank you! - lsampaio@inf.puc-rio.br Alessandro Garcia afgarcia@inf.puc-rio.br OPUS Research Group