Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

9/3/2019
04:45 AM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

7 Steps to Web App Security

Emerging technologies are introducing entirely new ways to reach, act, and interact with people. That makes app security more important than ever.
1 of 8

Image Source: tashatuvango

Image Source: tashatuvango

1 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
9/5/2019 | 6:37:13 PM
Look deeper into the Rabbit hole

 I do agree with the points you brought up to the public, we should follow these steps and do it rigoursly, but that this aspect only just scratches the surface (basically the explanations are general). I would say we should do the following:
  • Once we develop the SecDevOps teams, we should put them in specific groups (red, blue, green)
    • The red-team is responsible for identifying the possible openings in the application (create a bounty program - you had mentioned it, but internally - and then have your blue team to see if they can circumvent the security controls the red-team put in place, then the green team should look to validate if the red or blue teams identified a real vulnerability. Have the green team look up the vulnerability to see if it exists, if not, have the green team to create tools to punish the application for one final assault or Q/A session to ensure the application does not fall to external threats or buffer overflows
    • Linux - the teams should look deeper into using tools from MIT (SeLinux is one example) and determine if the tool is actually working to identify and thwart attacks (go to the "/var/log/audit/audit.log" (make sure "setenforce 1" and SeLinux is installed and working properly)
    • Windows - run "get-appxprovisionedpackage -online | out-gridview -passthru | remove-appxprovisionedpackage -online" to ensure Bing applications, games and other tools are not installed, if so, remove them or utilize Uninstaller from IoBit" (group policies are good but there are HIDS like "Comodo" that are invaluable when it comes to cyber protection at the endpoint
    • Look into performance and application optimization tools like CA or Extrahop to identify if the application is running at its optimal level, the tools will also help the user identify if there are holes in the development chain (utilize Agile Scrum methodologies but incorporate CMMI security procedures from Carnige Mellon, NIST and CoBIT
    • Mitre At&ck is another framework we should look into when it comes to "Priviledge escalation" - https://attack.mitre.org/tactics/TA0004/, this is an area that needs attention because it delves into the methods actors use to attack a subject (again this is just one of many)

Top 6 Cybersecurity Frameworks

We also need to look heavily into applications that monitor themselves; for example, AWS stated they were going to look into developing an application where it would determine if the configuration of the S3 or EBS (Elastic Block Stores) were configured wrong or with public access. This is the next level we need to start looking into (i.e. Machine Learning). We need to be conscious of bad data in and bad data out scenario, this needs to come from the vendor and the individuals who are working day today.

I do think the adoption of a language that is not on the top of the CVE list will help as well, there are some such as the "Open Vulnerability & Assessment Language", I particularly like Python for Linux and Powershell for Windows, especially when you are looking at specific vulnerable areas that exist inside DLL files and in the registry, (I have found that JSON seems to work much faster when using JSON right in the code itself).

"============================================="

Powershell
Write-Host " "
Write-Host "LSA Registry Entries"
Write-Host "--------------------"
Write-Host " "

$lsa = '{"registry":[
	{"Entry":"auditbaseobjects", "Value":"1", "Type":"Dword"},
	{"Entry":"auditbasedirectories", "Value":"1", "Type":"Dword"},
	{"Entry":"LmCompatibilityLevel", "Value":"4", "Type":"Dword"},
	{"Entry":"restrictanonymous", "Value":"1", "Type":"Dword"},
	{"Entry":"restrictanonymoussam", "Value":"1", "Type":"Dword"},
	{"Entry":"LimitBlankPasswordUse", "Value":"1", "Type":"Dword"},
    {"Entry":"SecureBoot", "Value":"1", "Type":"Dword"}
]}'

$path = "HKLM:\System\CurrentControlSet\Control\Lsa"
$regobj = ConvertFrom-Json -InputObject $lsa
$regobjects = $regobj.registry

foreach ( $i in $regobjects ) {
    $val = Get-ItemPropertyValue -Path $path -Name $i.Entry `
-ErrorAction SilentlyContinue if ( (Test-Path $path) -and ($i.Value -eq $val ) ) { Write-Host $i.Entry "registry value - ok" } else { #New-Item -path $path -Name $i.Entry -Value $i.Value -Type Dword $chg = Set-ItemProperty -Path $path -Name $i.Entry -Value $i.Value `
-Type $i.Type -Force $names = Get-ItemPropertyValue -Path $path -Name $i.Entry Write-Host $i.Entry "modified registry entry: " $names } }

 "============================================"

Just something to think about.

T
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5347
PUBLISHED: 2020-04-04
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses.
CVE-2020-5348
PUBLISHED: 2020-04-04
Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in system management mode.
CVE-2020-8142
PUBLISHED: 2020-04-03
A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was how...
CVE-2020-8143
PUBLISHED: 2020-04-03
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/...
CVE-2020-8147
PUBLISHED: 2020-04-03
Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.