OWASP

To ensure that strong simple security controls are available to every developer in every environment ESAPI Mission

Where Do Vulnerabilities Come From?

Controls Every Application Needs Access Control Authenti- cation and Identity App Firewall Access Reference Map Output Escaping Input Validation Logging Exception Handling Secure Config Intrusion Detection HTTP Utilities Encryption and Signing

Security Controls Are Hard

Escaping Gone Wild Percent Encoding %3c %3C HTML Entity Encoding &#60 &#060 &#0060 &#00060 &# &# < < < < < &# ; &#x3c &#x03c &#x003c &#x0003c &#x00003c &#x000003c < < < < < < &#X3c &#X03c &#X003c &#X0003c &#X00003c &#X000003c < < < < < < &#x3C &#x03C &#x003C &#x0003C &#x00003C &#x000003C < < < < < < &#X3C &#X03C &#X003C &#X0003C &#X00003C &#X000003C < < < < < < &lt &lT &Lt &LT < &lT; &Lt; &LT; JavaScript Escape \< \x3c \X3c \u003c \U003c \x3C \X3C \u003C \U003C CSS Escape \3c \03c \003c \0003c \00003c \3C \03C \003C \0003C \00003C Overlong UTF-8 %c0%bc %e0%80%bc %f0%80%80%bc %f8%80%80%80%bc %fc%80%80%80%80%bc US-ASCII ¼ UTF-7 +ADw- Punycode <- < <

Cheaper, Better, Faster

Independence

Positive Security attacks threatsexploits vulnerabilities risks controls accountability pentest scanning assurance patterns verification architecture policy impact flaws metrics visibility completeness

ESAPI Scorecard Authentication  Identity  Access Control  ** **  Input Validation  Output Escaping  Canonicalization  Encryption  Random Numbers  Exceptions  Logging  IntrusionDetection  Security Config  App Firewall  Scorecard

Assurance

Deceptively Tricky Problems for Developers 1.Input Validation and Output Encoding 2.Authentication and Identity 3.URL Access Control 4.Business Function Access Control 5.Data Layer Access Control 6.Presentation Layer Access Control 7.Errors, Logging, and Intrusion Detection 8.Encryption, Hashing, and Randomness Lots more…

Stopping Injection 13 Quick and Dirty Ad Hoc Escaping Generic Validation

Stopping Injection 14 Enterprise Automatic Escaping Managed Specific Validation Managed Generic Validation

Questions

Stopping Injection 17 Quick and Dirty Ad Hoc Escaping Generic Validation

Stopping Injection 18 Strong Application Mandatory Escaping Specific Validation Generic Validation (+can)

ESAPI Web App Firewall (WAF) attacker user ESAPI WAF Critical Application? PCI requirement? 3 rd party application? Legacy application? Incident response? Virtual patches Authentication rules URL access control Egress filtering Attack surface reduction Real-time security

AuthN and AuthZ 20 Quick and Dirty User in Session Simple Authentication Model Ad Hoc Authorization

AuthN and AuthZ 21 Strong Application Identity Everywhere Automatic CG Authorization Alternate Authentication Automatic FG Authorization

AuthN and AuthZ 22 Enterprise AuthZ Policy Management AuthZ Entitlement Mgmt Identity Management

Applications Enjoy Attacks YouTube Live Search Blogger

Accountability and Detection 24 Quick and Dirty Ad Hoc Security Logging Security Exceptions (2 msgs) Ad Hoc Authorization

Accountability and Detection 25 Strong Application Intrusion Detection Automatic Security Logging

Accountability and Detection 26 Enterprise Log Policy Management Dynamic Incident Response Centralized Logging

ESAPI Swingset