//ALPHA.1 OWASP Knoxville Application Security Then and Now. Make a Difference Now 2015 June 11 Phil Agcaoili

A Career Path…printf(“hello, world\n”);

Why OWASP is VERY Important! source: Checkmarx

OWASP 10 – Then and Now Not Substantially Different *Challenging for automation tools OWASP Top 10 – EditionOWASP Top 10 – 2013 Edition A1 Unvalidated InputA1 Injection A2 Broken Access ControlA2 Broken Authentication and Session Management A3 Broken Authentication and Session ManagementA3 Cross-Site Scripting (XSS) A4 Cross Site ScriptingA4 Insecure Direct Object References A5 Buffer OverflowA5 Security Misconfiguration A6 Injection FlawsA6 Sensitive Data Exposure A7 Improper Error HandlingA7 Missing Function Level Access Control A8 Insecure StorageA8 Cross-Site Request Forgery (CSRF) A9 Application Denial of ServiceA9 Using Components with Known Vulnerabilities A10 Insecure Configuration Management A10 Unvalidated Redirects and Forwards

The Intent of OWASP The Top 10 is about managing risk – Not just avoiding vulnerabilities Take a big picture approach to application security. – OWASP Top 10 doesn't mean it's the most important problem facing your organization

Keep it simple…It’s not as difficult as you think it is.

START SMALL BUILD THE MOMENTUM OF SUCCESS

HOPE FOR SERENDIPITY The occurrence and development of events by chance in a happy or beneficial way

ACHIEVE BUY-IN FROM MANAGEMENT AND EMPLOYEES Provide opportunities for teams and clear advantages for company.

TAKE APPLICATION SECURITY ONE STEP AT A TIME Allow the organization to grow into the process rather than dropping it on the teams all at once

EDUCATE YOUR DEVELOPERS AND GET THEM WRITING SECURE CODE

RECRUIT THE SMART PEOPLE IN THE DEV TEAMS TO ACT AS CHAMPIONS Senior developers with a need to learn something new or Junior developers with the motivation to move ahead within the organization.

GET THE RIGHT PARTNERS TO HELP YOU

NETWORK SECURITY CANNOT PREVENT APPLICATION BREACHES ON ITS OWN STATIC ANALYSIS SHOULD BE PERFORMED AT EARLIER DEVELOPMENT STAGES Web application Firewalls (WAF) and/or RASP should be used as temporary band aids for non-remediated vulnerabilities

CAUTION WITH AUTOMATION Tools make educated guesses that require validation by trained humans. Peer code reviews with trained peers is still the best option.

Phil Agcaoili Distinguished Fellow and Fellows Chairman, Ponemon Institute Board of Advisors, PCI Security Standards Council (SSC) Contributor, NIST Cybersecurity Framework version 1 Co-Founder & Board Member, Southern CISO Security Council Founding Member, Cloud Security Alliance (CSA) Inventor & Co-Author, CSA Cloud Controls Matrix, GRC Stack, Security, Trust and Assurance Registry (STAR), and CSA Open Certification Framework (OCF) – AICPA