1. Advanced Security Center Overview Northern Illinois University

2. 2 Who am I?  Nathan McFeters Senior Security Advisor Ernst & Young’s ASC Based out of Chicago, serving as a Security Evangelist for the Midwest region Noted public speaker including: Black Hat Europe (2008), Black Hat Federal (2008), Black Hat Japan (2007) ToorCon 9 (2007) DEFCON 15 (2007) Hack in the Box Malaysia (2007) Speaking at ToorCon Seattle next week Blogger on ZDNet’s Zero Day Security Blog (http://blogs.zdnet.com/security) Security Researcher with numerous vulnerabilities reported to vendors

3. 3 Advanced Security Center Overview Dedicated Team Cost Efficient and Scalable Physical and Logical Controls Collaborative Environment Centralized Management & Operations Standardized Methodologies and Tools Consistent Quality Control Procedures Knowledge Transfer

4. 4 Global Locations Houston New York London Dublin Paris Buenos Aires Singapore

5. 5 Thought Leadership – Publications Network Security Tools HackNotes Linux and Unix Security Portable Reference Defending the Digital Frontier Hacking Exposed: Web Applications - Contributing Author Hacking Exposed: Windows 2000 - Contributing Author Ajax Security Basics, SecurityFocus.com

6. 6 Thought Leadership – Public Speaking Black Hat Europe: 2008 Black Hat Federal: 2008 RSA: 2008 Hack in the Box - Malaysia: 2007 ToorCon 9: 2007 Tecnofin Info Security Forum – Mexico City: 2007 DEFCON 15: 2007 Black Hat Europe: 2007 Black Hat Las Vegas: 2005 Vanguard Security Conference: 2005 & 2006 New York Software Industry Association: 2006

7. 7 Thought Leadership – Security Advisories  Adobe Security Advisory published two days ago – DNS Rebinding Flaw in Adobe Flash’s URLLoader class due to DNS canonicalization handling  Macintosh Apple Security Bulletin 2008 – Format String Vulnerability in iPhoto on Mac OS X Leopard  CVE-2007-4041 – Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 allow remote attackers to execute arbitrary commands  CVE 2007-3670 – Firefox "firefoxurl://" URI Handler Registration Vulnerability  CVE 2007-3294 - Netscape "navigatorurl://" URI Handler Registration Vulnerability  Security Focus bid 24927 – Trillian is Vulnerable to Remote Command and Remote Code Execution through “aim://” URI  Microsoft Security Bulletin MS07-035 – Integer Overflow Condition in “res://” URI Handler  Microsoft Security Bulletin MS06-056 – XSS Exposure in.NET Framework

8. 8 Testing Data Collection  We captured 551 tests with 4200 individual findings  29% of the reports are Infrastructure, and 71% are application  We identified an average of 68.5 instances of issues across all tests  More than 37755 instances of findings  More than 15156 instances (40%) of high risk findings

9. 9 Overall Metrics  88% of our tests have at least one high risk finding  58% of all high risk issues require a low level of effort to exploit  54% of all identified issues require only a low level of effort to remediate

10. 10 Infrastructure Metrics  Only 1% of all issues identified during infrastructure testing could be remediated by implementing a patch  67% of all issues identified during infrastructure testing could be remediated by a configuration change  “Vulnerable service open” and “Weak Database Administrator Password” are the two most common high risk infrastructure vulnerabilities and make up 58% of all high risk infrastructure issues

11. 11 Application Metrics  93% of our application tests have at least one high risk finding  70% of the high risk issues identified during application testing require a low level of effort to exploit  46% of high risk issues identified during application testing require only a low level of effort to remediate  57% of the high risk issues identified during application tests require changes to the application code to be remediated

12. Web Application (In)Security

13. 13 The Problem

14. 14 The Cause Data Application Server/Services Operating System Infrastructure Traditional Security Source: www.owasp.org Root Cause: Developers without security experience 1.Cross Site Scripting (XSS) 2.Injection Flaws 3.Malicious File Execution 4.Insecure Direct Object Reference 5.Cross Site Request Forgery (CSRF) 6.Information Leakage & Improper Error Handling 7.Broken Authentication and Session Management 8.Insecure Cryptographic Storage 9.Insecure Communications 10.Failure to Restrict URL Access 10 Most Critical Web Application Vulnerabilities

15. 15 Web Application Security: The Solution Application Security Testing  Methodology and Tools  Black Box –WebSmack –XS-Sniper  Grey Box –Prohpet –DBHoldup Education  Leverage Test Results  Hands-On Integration of Both into our Client’s Systems Development Lifecycle (SDLC)

16. 16 ASC Application Assessment Tools

17. 17 ASC Application Assessment Tools (cont.)

18. 18 ASC Application Assessment Tools

19. 19 ASC Application Assessment Tools (cont.)