OWASP in favor of a more secure world Porto Alegre Chapter OWASP in favor of a more secure world L. GUSTAVO. C. BARBATO, Ph.D. lgbarbato@owasp.org Chapter Leader, OWASP Porto Alegre / Brazil Member, Global Chapter Committee Porto Alegre Chapter Meeting 03/31/2011 UNISINOS –São Leopoldo

Introduction

OWASP (Open Web Application Security Project) OWASP is an international organization and the OWASP Foundation supports OWASP efforts around the world OWASP is an open community dedicated to enabling organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security http://www.owasp.org/index.php/About_OWASP

Knowledge base 2001 2003 2005 2007 2009 2011 http://www.owasp.org

History OWASP was started on September 9, 2001 By Mark Curphey and Dennis Groves Since late 2003, Jeff Williams has served as the volunteer Chair of OWASP The OWASP Foundation, a 501(c)(3) organization (in the USA) was established in 2004 Thounds of individual members, nowadays OWASP Foundation has over 80 Active Local Chapters and only 3 employees http://en.wikipedia.org/wiki/OWASP

Ecosystem Volunteers Knowledge sharing People/Project Leadership Events presentations Administration Sustained by Conferences Individual supporters, annually Banner advertisements Corporate sponsors http://www.owasp.org/images/0/0d/OWASP_ByLaws.pdf

Structure

OWASP Board Jeff Williams - USA jeff.williams@owasp.org Sebastien Deleersnyder - Belgium seba@owasp.org Tom Brennan - USA tomb@owasp.org Eoin Keary - Ireland Eoin.Keary@owasp.org Dave Wichers - USA dave.wichers@owasp.org Matt Tesauro - USA Matt.Tesauro@owasp.org http://www.owasp.org/index.php/Contact

Global Committees http://www.owasp.org/index.php/Global_Committee_Pages

Local Chapters Hundreds of Local Chapters but only around 80 are Active http://www.owasp.org/index.php/Category:Brasil Porto Alegre Curitiba São Paulo Campinas Brasília Goiania Recife Paraíba http://www.owasp.org/index.php/Category:OWASP_Chapter

Organization Supporters http://www.owasp.org/index.php/Membership

Projects

Resources http://www.owasp.org/index.php/Category:OWASP_Project Vulnerability Scanners Static Analysis Tools Fuzzing Automated Security Verification Penetration Testing Tools Code Review Tools Manual Security Verification ESAPI Security Architecture AppSec Libraries ESAPI Reference Implementation Guards and Filters Secure Coding Reporting Tools AppSec Management Flawed Apps Learning Environments Live CD SiteGenerator AppSec Education http://www.owasp.org/index.php/Category:OWASP_Project

OWASP Top Ten 2010 http://www.owasp.org/index.php/Top_10 A1: Injection A2: Cross-Site Scripting (XSS) A3: Broken Authentication and Session Management A4: Insecure Direct Object References A5: Cross Site Request Forgery (CSRF) A6: Security Misconfiguration A7: Failure to Restrict URL Access A8: Insecure Cryptographic Storage A9: Insufficient Transport Layer Protection A10: Unvalidated Redirects and Forwards http://www.owasp.org/index.php/Top_10

ESAPI (Enterprise Security API) Custom Enterprise Web Application OWASP Enterprise Security API Authenticator User AccessController AccessReferenceMap Validator Encoder HTTPUtilities Encryptor EncryptedProperties Randomizer Exception Handling Logger IntrusionDetector SecurityConfiguration Your Existing Enterprise Services or Libraries http://www.owasp.org/index.php/ESAPI

SAMM (Software Assurance Maturity Model) http://www.owasp.org/index.php/Software_Assurance_Maturity_Model

CLASP (Comprehensive, Lightweight, Application Security Process) http://www.owasp.org/index.php/OWASP_CLASP_Project

ASVS (Application Security Verification Standard) http://www.owasp.org/index.php/ASVS

OWASP Testing Guide http://www.owasp.org/index.php/OWASP_Testing_Project

WebScarab http://www.owasp.org/index.php/OWASP_WebScarab

WebGoat http://www.owasp.org/index.php/OWASP_WebGoat_Project

OWASP Live CD http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project

ModSecurity Core Rules Set Project Supports any type of parameters, POST , GET or any other SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES| REQUEST_HEADERS|!REQUEST_HEADERS:Referer \ "(?:\b(?:(?:s(?:elect\b(?:.{1,100}?\b(?:(?:length|count|top)\b.{1,100}?\bfrom|from\b.{1,100}?\bwhere)|.*?\b(?:d(?:ump\b.*\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebtask)|ql_(?:… … … \ “capture,log,deny,t:replaceComments, t:urlDecodeUni, t:htmlEntityDecode, t:lowercase,msg:'SQL Injection Attack. Matched signature <%{TX.0}>',id:'950001',severity:'2'“ Every SQL injection related keyword is checked Common evasiontechniques are mitigated SQL comments are compensated for http://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project

Books http://stores.lulu.com/owasp

Conferences

Global AppSec Europe (June 6, 2011 - June 10, 2011) http://www.owasp.org/index.php/AppSecEU2011

Global AppSec North America (Sept. 20, 2011 - Sept. 23, 2011) http://www.appsecusa.org

Global AppSec Asia (Nov. 3, 2011 - Nov. 5, 2011) http://www.owasp.org/index.php/China_AppSec_2011

Global AppSec Latin America (Oct. 4, 2011 - Oct. 7, 2011) http://www.appseclatam.org

How to participate?

How to participate? http://www.owasp.org/index.php/Porto_Alegre Papers, wiki Mailing lists Projects Proposing new ones, testing existents, feedbacks Translations Presentations Contributing annually (US$ 50) http://www.regonline.com/owasp_membership

Questions ???

References Decks used to create this one: http://www.owasp.org/images/b/b4/OWASP-Intro-2008-pt-br.ppt https://owasptop10.googlecode.com/files/OWASP_Top_10_-_2010%20Presentation.pptx http://owasp-esapi-java.googlecode.com/files/OWASP%20ESAPI.ppt http://www.owasp.org/images/7/71/About_OWASP_ASVS.ppt https://www.owasp.org/images/8/88/OWASP_EU_Summit_2008_WebScarab_treasures.ppt http://www.opensamm.org/downloads/resources/OpenSAMM-1.0.ppt http://www.owasp.org/images/a/ac/CLASPOverviewPresentation20080807NickCoblentz.ppt http://www.owasp.org/images/4/46/AppSecEU09_OWASP_Live_CD-mtesauro.ppt http://www.owasp.org/images/2/21/OWASPAppSec2007Milan_ModSecurityCoreRuleSet.ppt