Copyright Gupta Consulting, LLC. www.bgupta.com AppSec Testing Beyond Pen Test Bhushan Gupta Gupta Consulting, LLC. www.bgupta.com 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com
Pen Testing – Some Observations An art of finding known vulnerabilities and exploiting them Well suited for networks and operating systems Tools have limited effectiveness Way later in the SDLC Gary McGraw “If you fail a penetration test you know you have a very bad problem indeed. If you pass a penetration test you do not know that you don’t have a very bad problem” 4/11/2019 Copyright Gupta Consulting, LLC. www.bgupta.com
Security 1. Categorize/ Determine Data Sensitivity 6. Monitor/ 2. Select Baseline Controls 3. Implement Security Controls 4. Assess Security Controls 6. Monitor/ Track Internal External Changes 5. Determine Risk to Organization Security 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com
Data Security Principles Confidentiality – Maintaining data privacy (Access Control) Integrity – Authorized Modification of data and system environment Availability – Usable during desired hours of service Not all data is worth protecting! Protect data while stationary and in motion! 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com
Copyright Gupta Consulting, LLC. www.bgupta.com NIST (National Institute of Standards and Technology) 800-53 - Access Control Identification And Authentication (IA-Family) Least Privilege (AC-6) Separation Of Duties (AC-5) Session Lock (AC-11) Session Termination (AC-12) Unsuccessful Logon Attempts (AC-7) Access Enforcement (AC-3) Account Management (AC-2) System Use Notification (AC-8) – especially for Govt. applications 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com
STRIDE Approach to Vulnerability Category Description Spoofing Gaining Access to the system using false identity Tampering Unauthorized modification of data Repudiation Ability to successfully deny an activity already taken place Information Disclosure Unwanted exposure of private data Denial of Service Making system unavailable for use Elevation of Privilege Assuming identity of a privileged user from limited privileges 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com
STRIDE MAP – Epic Sign UP Story ID/ Vulnerability Spoofing Tampering Repudiation Information Disclosure Denial of Service Elevation of Privileges STRIDE Score 1. Browse to Web Site No YES 1 2. Create user Profile Yes No (data stationary) Yes – social engineering 2 3. Create Login Id & Password 6. Login Yes (MitM) 5 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com
Quantifying and Comparing Risk – DREAD Method DREAD Index = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com
Quantifying and Comparing Risk Category Value = 0 Value = 5 Value = 10 Damage Impact (data) None Few users only Entire system Reproducibility Very hard Few steps required Use of web browser Exploitability Advanced knowledge Use of kits Just a web bowser Actual Users Impacted Some but not all All users Discoverability (application) Easy – apparent Public Domain/Web browser Guessing Very hard (need special efforts) 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com
Copyright Gupta Consulting, LLC. www.bgupta.com References OWASP Security Testing – Best Practices Testing Guide - V4 https://www.owasp.org/index.php/OWASP_Testing_Project Attack Surface Analysis Quantifying the Attack Surface of a Web Application (2010) by Thomas Heumann , Jörg Keller , Sven Türpe 10/3/2018 Copyright Gupta Consulting, LLC. www.bgupta.com