nullcon Goa 2010http://nullcon.net Tracking the Progress of an SDL Program - Cassio Goldschmidt

Who am I? Cassio Goldschmidt Sr. Manager, Product Security – Symantec Education MBA, USC MS Software Engineering, SCU BSCS, PUCRS CSSLP, (ISC) 2 When I’m not in the office… Volleyball (Indoor, Beach) Coding… for way to long! Gym…

Typical Project Lifecycle

Exercise type: CWE Exercise type: CWE

Number of Reps: Number of Findings Number of Reps: Number of Findings

Exercise Intensity: CVSS Exercise Intensity: CVSS

nullcon Goa 2010http://nullcon.net Common Weakness Enumeration

Common Weakness Enumeration What is it? A common language for describing software security weaknesses Maintained by the MITRE Corporation with support from the National Cyber Security Division (DHS). Hierarchical Each individual CWE represents a single vulnerability type Deeper levels of the tree provide a finer granularity Higher levels provide a broad overview of a vulnerability

Common Weakness Enumeration Portion of CWE structure

What data is available for each CWE? Weakness description Applicable platforms and programming languages Common Consequences Likelihood of Exploit Coding Examples Potential Mitigations Related Attacks Time of Introduction Taxonomy Mapping Link to CWE Page on XSSCWE Page on XSS

How useful is this information? 13 Pie Chart showing the frequency of CWEs found in penetration tests

nullcon Goa 2010http://nullcon.net Common Vulnerability Scoring System

Objective (and “perfect enough”) metric A universal way to convey vulnerability severity Can be used for competitive analysis CVSS score ranges between 0.0 and 10.0 Can be expressed as high, medium, low as well. Composed of 3 vectors Base Represents general vulnerability severity: Intrinsic and immutable Temporal Time-dependent qualities of a vulnerability Environmental Qualities of a vulnerability specific to a particular IT environment Common Vulnerability Scoring System What is it?

Common Vulnerability Scoring System BASE Vector Access Vector Access Complexity Authenti… NetworkHighNone Adjacent Network MediumSingle Instance LocalLowMult. Instances Undefined Confident…IntegrityAvail. None Partial Complete Undefined ExploitabilityImpact Sample Score: 7.5 Sample Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Every CVSS score should be accompanied by the corresponding vector

Common Vulnerability Scoring System (CVSS) The Calculator

nullcon Goa 2010http://nullcon.net Hands on Demo

void CHTMLEngine::SetPost(CBufferedInput& buf,unsigned int length,string& multipart) { m_post=true; if (length <= 0) return; char* pData = new char[length+1]; memset(pData,0,length+1); // Read the POSTed data into a buffer int totalBytesRead = 0; int bytesRead = 0; while ( length-totalBytesRead > 0 ) { bytesRead = buf.Read(pData+totalBytesRead, length-totalBytesRead); if ( bytesRead == -1 ) { DTRACE(1,“ EOF error reading POSTed data."); break; } totalBytesRead += bytesRead; } m_post_data = pData; m_mp_boundary = multipart; delete [] pData; } What if I make length = -1? new char[0] calls malloc(0) which succeeds! Next, attacker-controlled data either overflows heap or crashes Doesn’t quite work – length is unsigned CWE and CVSS use in Practice Code Review

void CHTMLEngine::SetPost(CBufferedInput& buf,unsigned int length,string& multipart) { m_post=true; if (length <= 0) return; char* pData = new char[length+1]; memset(pData,0,length+1); // Read the POSTed data into a buffer int totalBytesRead = 0; int bytesRead = 0; while ( length-totalBytesRead > 0 ) { bytesRead = buf.Read(pData+totalBytesRead, length-totalBytesRead); if ( bytesRead == -1 ) { DTRACE(1,“ EOF error reading POSTed data."); break; } totalBytesRead += bytesRead; } m_post_data = pData; m_mp_boundary = multipart; delete [] pData; } CWE and CVSS use in Practice Code Review Buffer Overflow CWE: CVSS 2: 7.6 CVSS 2 Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C) Buffer Overflow CWE: CVSS 2: 7.6 CVSS 2 Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)

nullcon Goa 2010http://nullcon.net Training and Metrics

Training and Metrics A special activity in the SDL Security training is what food is to a workout Same workout metrics do not apply Quality of your intake affects overall performance Staff needs ongoing training

Training and Metrics Security Learning Process Pre classClass Fixation Exercises Pos Class Survey Keeping Staff Current

Training and Metrics Security Learning Process Pre classClass Fixation Exercises Pos Class Survey Keeping Staff Current Understand who is the audience Previous knowledge about secure coding and secure testing Programming languages in use Supported platforms Type of product Understand who is the audience Previous knowledge about secure coding and secure testing Programming languages in use Supported platforms Type of product

Training and Metrics Security Learning Process Pre classClass Fixation Exercises Pos Class Survey Keeping Staff Current Train everyone involved in the SDL Developers: Secure Coding, Threat Model QA: Security Testing, Tools Managers: Secure Development Lifecycle (also known as Symmunize) Train everyone involved in the SDL Developers: Secure Coding, Threat Model QA: Security Testing, Tools Managers: Secure Development Lifecycle (also known as Symmunize)

Training and Metrics Security Learning Process Pre classClass Fixation Exercises Pos Class Survey Keeping Staff Current Quality Assurance - Capture the flag Use Beta software Approximately 3 hours long Top 3 finders receive prizes and are invited to explain what techniques and tools they used to find the vulnerabilities to the rest of the group Quality Assurance - Capture the flag Use Beta software Approximately 3 hours long Top 3 finders receive prizes and are invited to explain what techniques and tools they used to find the vulnerabilities to the rest of the group

Training and Metrics Security Learning Process Pre classClass Fixation Exercises Pos Class Survey Keeping Staff Current Pos Class Survey Anonymous Metrics Class content Instructor knowledge Exercises Pos Class Survey Anonymous Metrics Class content Instructor knowledge Exercises

Training and Metrics Security awareness is more than training

nullcon Goa 2010http://nullcon.net Conclusions and final thoughts

Why This Approach Makes Sense? Compare Apples to Apples Quantify results in a meaningful way to “C” executives – Past results can be used to explain impact of new findings – Can be simplified to a number from 1-10 or semaphore (green, yellow and red). – Can be used for competitive analysis Harder to game CVSS CWE can be easily mapped to different taxonomies

nullcon Goa 2010http://nullcon.net Thank You!