BUILDING A SECURE STANDARD LIBRARY Information Assurance Project I MN Tajuddin hj. Tappe Supervisor Mdm. Rasimah Che Mohd Yusoff ASP.NET TECHNOLOGY DEVELOPMENT FOR

INTRODUCTION Resource: OWASP Top 10 – 2013, The Ten Most Critical Web Application Security Risks

DEMO: SQL INJECTION

SECURE STANDARD LIBRARY Library - is a pre-compiled code file (with extension.dll) that contains code and data that can be used by more than one program or application. By using a DLL file, a program can be modularized into separate components. Additionally, updates are easier to apply to each module without affecting other parts of the program (Microsoft, 2007). Standard - means providing requirements, specifications, guidelines or characteristics that can be used consistently to ensure that processes and services are fit ( is used because the proposed library will provide built-in functionalities as a standard for the purpose of the implementation to secure coding practices. Secure - With the standard that will be implemented within the library, it also will take concern about validating data and input so that the process will be implemented in a secure manner.

WHY NEED TO EMPHASIZE ON SECURE CODING PRACTICES AND STANDARDIZATION? 1. Web application security is fundamentally different than host or network security, and requires a different approach. 2. Custom code creates custom vulnerabilities. 3. Developers are not exactly the same with Security Experts. 4. Web Application Firewalls (WAF) are effective against known threats, but sometime they are less capable of discovering new issues or handling questionable use cases.

PROJECT AIM To identify the most common functionalities that always being used by most developers in an application project development Develop a class library that will have a standard which will provide the identified common functionalities Provided with secure coding practices, especially to encounter the most highest identified attack such as SQL injection, Cross-site scripting (XSS), etc. which mostly will be based on OWASP top ten most critical web application security risks

RESEARCH QUESTIONS The research questions are as below: a) How an application can be exploited from their vulnerability which caused by the developer themself. b) What are the common functionalities that usually required by most developer in their development environment.

RESEARCH OBJECTIVES The objectives of this study are as below: a) To identify the secure coding practices requirements within ASP.NET technologies development. b) To identify suitable standards for common functionalities in development environment. c) To develop a secure standard library for ASP.NET technology development with secure coding practices. d) To test the developed library with any ASP.NET technology development.

RESEARCH SCOPE a) The library will be available to be used by ASP.NET developer and environment, specifically by using C# or VB programming language. It also requires.NET Framework installed on the machine or server. b) The library will be applicable for a new ASP.NET project development and there are lots of code modifications required for existing application which are already developed. c) Most of secure coding practices are based on OWASP Secure Coding Practices Document, but it will not cover all of the implementations in the checklist.

LITERATURE REVIEW One of security practices in interactive application development is “Never trust user input” (Park, 2011). To guard against application-level for such attacks, input validation method is commonly implemented especially in web applications (Shar, Tan, & Briand, 2013). 1. SQL Injection 2. Cross-site Scripting (XSS) 3. Unhandled Error Exposure 4. Unencrypted Sensitive Information

RESEARCH METHODOLOGY: OPERATIONAL FRAMEWORK

Phase 1 - Initiating Phase 2 - Modelling Phase 3 - Designing Phase 4 - Developing Phase 5 - Testing Phase 6 - Implementing Phase 7 - Finalizing

EVALUATION 1. UML Documentation 2. Test cases for testing report 3. Report for the usage of the library 4. Final report thesis

EXPECTED OUTCOME: SAMPLE OF IMPLEMENTATION

COMMON PRACTICE…

USING PROPOSED LIBRARY…

CONCLUSION Developers cannot prevent security flaws in their code unless they know the types of flaws that can occur. But organization still could not rely hundred percent to developer for ensuring their program is secure all the time since developer is responsible to focus on development of functional requirements. Developers want to do the right thing, but they need to know what the right thing is. It could be the responsible for organization to help developers to specify within their policy or procedure, about what tools / techniques / libraries for developer can use in order to implement secure environment within their application project development. With the implementation of this study, it might allow other future researchers to continue upgrading and keep implementing new practices and techniques about this kind of study with other possible technologies available such as PHP, Java, ColdFusion, etc. This could be a good platform worldwide in our continuous efforts to reduce possible attack vectors within web application.

END OF SLIDE. THANK YOU.