Securing Your Web Application and Database June 9 – 10, 2016 Presenters: Garth Colasurdo, Nader Khalil, Tuan Bui

What we will cover today: Why App/Database Security? How-to: Development of (Secured) App/Database Planning and Architecture Mobile and Web-based App Security Points How IT Can Help You…

Why App/Database Security?

Because… There are bad people out there that want to exploit your work for personal gains. Since November 2015 @ UNM: 559+ web vulnerabilities (potential exploits exist) 12+ compromised websites (forcibly taken over) 2 personal data incidents (FERPA)

Because… There are bad people out there that want to exploit your work for personal gains. Since November 2015 @ UNM: 559+ web vulnerabilities (potential exploits exist) 12+ compromised websites (forcibly taken over) 2 personal data incidents (FERPA)

How-to: Planning and Architecture

Planning and Architecture Addressing Business Needs New Vs. Existing Vendor Vs. In-house Cloud Vs. On-premise Business Needs Technical Needs User Needs

Planning and Architecture Technology Choices Type of application Type of developing tools Type of hosting Type of data to be collected

Planning and Architecture Key Data Sensitivity Type of data you may collect “directory information” Do not collect information you do not need Sharing information with other Data Classification E Class(encrypted): SSN(or part of it), Tax Information, student medical record C Class(Confidential): GPA, Race, Gender P Class(Public): Name, Address, Telephone listing

Planning and Architecture Roles and Responsibilities Data Owners Senior administrators --> ultimate authority and responsibility for the access, accuracy, classification, and security of the data within their delegations of authority. Data Stewards University officials who have direct operational-level authority and responsibility for the management of one or more types of institutional data Data Custodian Responsible for the operation and management of technology, systems, and servers that collect, store, process, manage, and provide access to University data Data User Authorized individuals -->to perform assigned duties or functions within the University.

Planning and Architecture Policies Acceptable Computer Use, UNM Policy 2500 Computer Security Controls and Access to Sensitive and Protected Information, Credit Card Processing, UNM Policy 7215 Information Security, UNM Policy 2550 Social Security Numbers, UNM Policy 2030 Health Insurance Portability and Accountability Act (HIPPA) Federal Law The Family Educational Rights and Privacy Act (FERPA) Standards Data Classification Data Encryption Information Stewardship and Confidentiality

Planning and Architecture Business Needs Find a solution Security Assessment Design Implement Full Lifecycle Planning Business Needs Find a Solution Security Assessment Design Implement Support

How-to: Mobile or Web-based App Security Points <? php secure_database.always ?> <protect.forms.no_injection.all> xScriptHijack(this.page) { xsite: false; }

Start Here: www.owasp.org https://www.owasp.org/index.php/Cheat_Sheets

Restricting Access Roles Can you use CAS? Customer roles Office roles Can you use CAS? Be very careful about local accounts Not a business you want to be in

Server Configurations Communication layer: SSL all the time Source file access File uploads from users Error messages

Credentials Isolation Transactions Encryption Protecting Data Credentials Isolation Transactions Encryption

Coding Best Practices Frameworks and MVC Injection Protection PDO SQL for PHP, SqlCommand() for .Net, createQuery() for Hibernate Stored procedures in the database White List input validation Escape all user supplied input Session Control Horizontal or vertical escalation of privilges Account for all error conditions Request a security assessment

Updating Patching Monitoring New features Decommissioning Lifecycle Updating Patching Monitoring New features Decommissioning

How IT Can Help You…

What We Do… Notify you of 0-day (newly discovered) technology vulnerabilities; Notify you of your websites’/applications’ (scanned) vulnerabilities; Provide you with professional services to prevent small risks from becoming big incidents.

(Some of) Our Services… Risk Assessment Vulnerability Mitigation Website/Application Development/Hardening

(ask for Miguel from Security) Contact Us… @ help.unm.edu 505.277.5757 (ask for Miguel from Security)

Questions?

References http://cedarvalleywebwerks.com/wp-content/uploads/Website-Security-browns.png http://onechroniqueshow.com/wp-content/uploads/2014/11/cross.png https://lh3.googleusercontent.com/-Ey-QnMLdOgE/VZMZLq5470I/AAAAAAAAQa4/Wjg7IQscadU/w256-h256/asher-neo-tuxg2%2B%25281%2529.png http://all4hisglory.org/images/phone/doctor3.tux.png http://www.crystalxp.net/news/img/306.png http://www.scootys.com/easy_capture/images/tux-batman.png