CERT Secure Coding OWASP Education Nishi Kumar Computer based training IT Architect Specialist, FIS Chair, Software Security Forum at FIS OWASP CBT Project Lead OWASP Global Industry Committee Nishi.Kumar@owasp.org Contributor and Reviewer Keith Turpin

Objectives Understand Cert Secure Coding Cert Secure Coding Standards

Cert Secure Coding goals Reduce vulnerabilities resulting from coding errors Identify common programming errors that lead to software vulnerabilities Establish secure coding standards Educate software developers to advance the state of the practice in secure coding

Cert Secure Coding Standards Establish coding guidelines for commonly used programming languages that can be used to improve the security of software systems under development Based on documented standard language versions as defined by official or de facto standards organizations Secure coding standards are under development for: The CERT C Secure Coding Standard, Version 2.0 The CERT C++ Secure Coding Standard The CERT Oracle Secure Coding Standard for Java

The CERT Oracle Secure Coding Standard for Java Cert Secure Coding Standard for Java 00. Input Validation and Data Sanitization (IDS) 01. Declarations and Initialization (DCL) 02. Expressions (EXP) 03. Numeric Types and Operations (NUM) 04. Object Orientation (OBJ) 05. Methods (MET) 06. Exceptional Behavior (ERR) 07. Visibility and Atomicity (VNA)

The CERT Oracle Secure Coding Standard for Java Cert Secure Coding Standard for Java 08. Locking (LCK) 09. Thread APIs (THI) 10. Thread Pools (TPS) 11. Thread-Safety Miscellaneous (TSM) 12. Input Output (FIO) 14. Platform Security (SEC) 15. Runtime Environment (ENV) 16. Serialization (SER) 49. Miscellaneous (MSC)

IDS01-J. Sanitize untrusted data passed across a trust boundary Noncompliant Code Example public void doPrivilegedAction(String username, char[] password) throws SQLException { Connection connection = getConnection(); if (connection == null) { // handle error } String pwd = hashPassword(password); String sqlString = "SELECT * FROM db_user WHERE username = '" + username + "' AND password = '" + pwd + "'"; Statement stmt = connection.createStatement(); ResultSet rs = stmt.executeQuery(sqlString); if (!rs.next()) { throw new SecurityException("User name or Password incorrect"); } // Authenticated; proceed }

IDS01-J. Sanitize untrusted data passed across a trust boundary Compliant Solution (PreparedStatement) class Login { public void doPrivilegedAction(String username, char[] password) throws SQLException { Connection connection = getConnection(); if (connection == null) { // handle error } String pwd = hashPassword(password); // Ensure that the length of user name is legitimate if ((username.length() >= 8) { // Handle error } String sqlString = "select * from db_user where username=? and password=?"; PreparedStatement stmt = connection.prepareStatement(sqlString); stmt.setString (1, username); stmt.setString (2, pwd); ResultSet rs = stmt.executeQuery(); if (!rs.next()) { throw new SecurityException("User name or Password incorrect"); } // Authenticated; proceed }

References CERT - www.cert.org The CERT® Program is part of the Software Engineering Institute (SEI). CERT's primary objectives include analyzing and communicating the state of internet security through its US-CERT Vulnerability Notes Database and improving software security with its secure coding practices publications. US-CERT Vulnerability Notes Database - http://www.kb.cert.org/vuls/ CERT Secure Coding Practices - http://www.cert.org/secure-coding/   CERT www.cert.org The CERT® Program is part of the Software Engineering Institute (SEI), a federally funded research and development center at Carnegie Mellon University in Pittsburgh, Pennsylvania. Following the Morris worm incident, which brought 10 percent of internet systems to a halt in November 1988, the Defense Advanced Research Projects Agency (DARPA) charged the SEI with setting up a center to coordinate communication among experts during security emergencies and to help prevent future incidents. This center was named the CERT Coordination Center (CERT/CC). One of CERT's primary objectives is to analyze the state of internet security and convey that information to the internet community. The CERT/CC monitors public sources of vulnerability information and regularly receives reports of vulnerabilities. CERT manages the US-CERT Vulnerability Notes Database, which is a list of serious, publically disclosed commercial software vulnerabilities. The Notes Database can be found here: http://www.kb.cert.org/vuls/ As part of our work to influence vendors to improve the basic, as-shipped, security within their products, our analysts evaluate the root causes of vulnerabilities and establish secure coding practices, located here: http://www.cert.org/secure-coding/ CERT also provides some useful tools and training material.