1. Herbert Thompson, Ph.D., CISSP Chief Security Strategist People Security Software Security

2. A Basic Fault Model Intended Behavior Actual Behavior Traditional Bugs Most Security Bugs

3. Software Security Perfect Storm?

4. Technology is changing… The software communications is changing: The software communications is changing: Web services, AJAX, VOIP, … Web services, AJAX, VOIP, … The complexity of software and software communications is outpacing advances in IT security The complexity of software and software communications is outpacing advances in IT security Network defenses are covering a shrinking portion of the attack surface Network defenses are covering a shrinking portion of the attack surface Instead of good guys vs. bad guys its now about enabling partial trust – at the application layer Instead of good guys vs. bad guys its now about enabling partial trust – at the application layer Extranets, partner access, customer access, identity management, … Extranets, partner access, customer access, identity management, … Instead of internal or external, midternal** attacks offer the greatest risk… Instead of internal or external, midternal** attacks offer the greatest risk… **Midternal attacks: http://blogs.csoonline.com/not_external_or_internal_midternal_attackers_are_today_s_biggest_threat

5. Compliance and Consequences are Changing Wave of regulations, guidelines, standards,… Wave of regulations, guidelines, standards,… SOX, GLBA, HIPAA, PCI DSS, BASEL II, … SOX, GLBA, HIPAA, PCI DSS, BASEL II, … Audits create an “impending event” and change the risk economics Audits create an “impending event” and change the risk economics Hackers may attack you but auditors will show up Hackers may attack you but auditors will show up Consequences of failure have increased Consequences of failure have increased Waves of disclosure legislation Waves of disclosure legislation

6. The Attacker is Changing We are seeing the rise of organized attacker groups We are seeing the rise of organized attacker groups An entire underground economy has been created: An entire underground economy has been created: Meeting place for buyers and sellers Meeting place for buyers and sellers Trading: vulnerabilities, botnets, credit card numbers, PII, … Trading: vulnerabilities, botnets, credit card numbers, PII, … Exchange of “value” in non-sovereign currency Exchange of “value” in non-sovereign currency Exchange of “value” anonymously Exchange of “value” anonymously Ability to outsource technical malevolence Ability to outsource technical malevolence

7. Baking Security In: The Practicalities Implementation Implementation Key characteristics Key characteristics Lightweight – security practices need to improve security yet strike a balance between timeliness, resources, and investment Lightweight – security practices need to improve security yet strike a balance between timeliness, resources, and investment Awareness – individuals that play a role in the SDLC need to understand the importance of security and what the fundamental goals of the business security efforts are Awareness – individuals that play a role in the SDLC need to understand the importance of security and what the fundamental goals of the business security efforts are Buy-in – Upper management needs to support security programs which usually means showing how these activities mitigate business risk Buy-in – Upper management needs to support security programs which usually means showing how these activities mitigate business risk Measurement (consistency) Measurement (consistency) Gates represent minimal criteria that the software must adhere to Gates represent minimal criteria that the software must adhere to Need to establish security metrics structure that gels with existing quality metrics Need to establish security metrics structure that gels with existing quality metrics

8. Requirements Gathering customer security requirements and weaving them into product requirements Activities Activities  Gather market segment projections for product (who are we selling to)  For internal products: What are our existing internal security policies  Gather legislation, standards, regulations, etc. specific to each market segment (Compliance Check)  Translate these standards into positive / testable / measurable security requirements  Gather intelligence on the security features/claims of competing products  Outline negative security requirements Gates Gates Sync-check between customer security needs and product requirements Sync-check between customer security needs and product requirements

9. Design Thinking about abuse and following secure design principles (more on this in a minute) Activities Activities  Establish design baselines for security (cryptography, external packages, languages, etc.)  Baselines are guided by security requirements and corporate standards (compatibility with SSO, integrations with security frameworks, etc.)  Designers to be educated on key security design principles (least privilege, compartmentalization, etc.)  Ensure that all 3rd party/external components selected meet security requirements  Design with update in mind Gates Gates Checklist of security requirements and security design goals vs. implementation Checklist of security requirements and security design goals vs. implementation Gap analysis Gap analysis

10. Development Baking security into development is primarily about security awareness Activities Activities  Training: educate developers on how to think about security, insecurity and abuse  Perform secure code reviews on critical components  Develop a secure coding baseline  Tools: source code scanning, … Gates Gates Unit testing (requirements driven) Unit testing (requirements driven) Code scanning (to assure adherence to coding policy – e.g. No strcpy) Code scanning (to assure adherence to coding policy – e.g. No strcpy)

11. Testing Security testing is about thinking like the bad guy and understanding abuse as well as use Security testing is about thinking like the bad guy and understanding abuse as well as use Activities Activities  Security testing techniques – 19 “attacks” from How to Break Software Security (Addison Wesley 2003)  Develop abuse cases  Fuzz-testing  Awareness training for tester Gates Gates Pass battery of abuse case testing Pass battery of abuse case testing Test against technical and business model threats Test against technical and business model threats Fuzz tests no longer yielding results Fuzz tests no longer yielding results

12. Testing Security testing is about thinking like the bad guy and understanding abuse as well as use Security testing is about thinking like the bad guy and understanding abuse as well as use Activities Activities  Security testing techniques – 19 “attacks”  Develop abuse cases  Fuzz-testing  Awareness training for tester Gates Gates Pass battery of abuse case testing Pass battery of abuse case testing Test against technical and business model threats Test against technical and business model threats Fuzz tests no longer yielding results Fuzz tests no longer yielding results

13. Deployment Ensure that customers and operations can deploy our systems securely, that they are secure by default, and that they gel with likely environments Activities Activities  Develop a secure deployment guide  Document “security assumptions”  Produce/deploy updates in a way that meets customer requirements Cost of deployment Cost of deployment Timeliness Timeliness Secure patching Secure patching Learn from mistakes (feedback into process) Learn from mistakes (feedback into process)

14. Summary Most of today’s software development processes don’t create secure software Most of today’s software development processes don’t create secure software Secure software requires process improvement Secure software requires process improvement Secure software requires executive commitment Secure software requires executive commitment Secure software requires everyone in the SDLC to think about abuse as well as use Secure software requires everyone in the SDLC to think about abuse as well as use

15. Putting it all together: Where to turn next… Valuable resources: Valuable resources: www.searchappsecurity.com – A great repository of application security articles, tips, techniques, news and interviews. www.searchappsecurity.com – A great repository of application security articles, tips, techniques, news and interviews. www.searchappsecurity.com http://blogs.csoonline.com/blog/hugh_thompson - My blog on CSO’s site. Focuses on security risks as well as security in the development. http://blogs.csoonline.com/blog/hugh_thompson - My blog on CSO’s site. Focuses on security risks as well as security in the development. http://blogs.csoonline.com/blog/hugh_thompson www.securityfocus.com/bugtraq -arguably the source for new vulnerabilities discovered in software www.securityfocus.com/bugtraq -arguably the source for new vulnerabilities discovered in software www.securityfocus.com/bugtraq www.appsic.org – consortium dedicated to security metrics and security ROI. Great resource for understanding security ROI www.appsic.org – consortium dedicated to security metrics and security ROI. Great resource for understanding security ROI www.appsic.org msdn.microsoft.com/security/sdl – Microsoft's security process site msdn.microsoft.com/security/sdl – Microsoft's security process site msdn.microsoft.com/security/sdl Some GREAT (bias warning: some are mine ) books on software security: Some GREAT (bias warning: some are mine ) books on software security:

16. Questions? Presented by: Herbert H. Thompson, Ph.D. hugh@hughthompson.com Blog: http://blogs.csoonline.com/blog/hugh_thompson http://blogs.csoonline.com/blog/hugh_thompson Tel: +1 321 795 4531