1. CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Web Security

2. CIT 380: Securing Computer SystemsSlide #2 Insecure Storage Storing sensitive data without encrypting it, or using a weak encryption algorithm, or using a strong encryption system improperly. Problems –Not encrypting sensitive data. –Using home grown cryptography. –Insecure use of weak algorithms. –Storing keys in code or unprotected files.

3. CIT 380: Securing Computer SystemsSlide #3 Storage Recommendations Hash algorithms –MD5 and SHA1 look insecure. –Use SHA256. Encrypting data –Use AES with 128-bit keys. Key generation –Generate random keys. –Use secure random source.

4. CIT 380: Securing Computer SystemsSlide #4 Mitigating Insecure Storage 1.Use well studied public algorithms. 2.Use truly random keys. 3.Store keys in protected files. 4.Review code to ensure that all sensitive data is being encrypted. 5.Check database to ensure that all sensitive data is being encrypted.

5. CIT 380: Securing Computer SystemsSlide #5 Insecure Communication Applications fail to encrypt sensitive data in transit from client to server and vice-versa. Need to protect –User authentication and session data. –Sensitive data (CC numbers, SSNs) Key Idea –Use SSL for all authentication connections.

6. CIT 380: Securing Computer SystemsSlide #6 Mitigating Insecure Communication 1.Use SSL for all authenticated sessions. 2.Use SSL for all sensitive data. 3.Verify that SSL is used with automated vulnerability scanning tools.

7. CIT 380: Securing Computer SystemsSlide #7 Proxies and Vulnerability Scanners Achilles OWASP Web Scarab Paros Proxy SPI Dynamics WebInspect Web Browser Web Server Edit Web Data URL Cookies Form Data Web Proxy

8. CIT 380: Securing Computer SystemsSlide #8 Achilles Proxy Screenshot