Application security testing an integrated approach
1 like1,074 views
This document discusses application security testing and provides recommendations for a comprehensive testing plan. It begins by outlining common application security vulnerabilities like injection flaws, cross-site scripting, and sensitive data exposure. It then recommends using tools like vulnerability scanning, threat modeling, code analysis, and penetration testing to test for vulnerabilities. The document concludes by describing how to test for issues in specific areas like authentication, authorization, data validation, and payment processing.
Ad
More Related Content
What's hot (20)
Similar to Application security testing an integrated approach (20)
Ad
More from Idexcel Technologies (14)
Ad
Recently uploaded (20)
Application security testing an integrated approach
- 1. idexcel Application Security Testing White Paper An Integrated Approach
- 2. Introduction Application security is the use of hardware, software and procedural methods in order to protect applications from inter- nal or external threats. As more and more applications are becoming accessible over networks, they are being exposed to a wide variety of threats as well. Even the most sophisticated application security systems are prone to breaches, and demand stringent automated and manual test strategies at each stage of the software development life cycle (SDLC). In this paper, we will gain basic understanding of the di๏ฌerent kinds of the application security vulnerabilities, and methodi- cal planning to mitigate the associated risks. Markets are being ๏ฌooded with applications each day in several domains. As these applications are getting increasingly complex and visually appealing, they are also becoming the main source of data and security breaches. A recent survey of security breaches at Fortune 500 companies showed that breaches in information security could result in annual ๏ฌnancial losses of up to $24 billion. With that said, 90% of large corporations have found one or more breaches in their computer security and even worse, 70% of those detected breaches were considered severe, many resulting in proprietary information theft and ๏ฌnancial fraud. The hackers can use several di๏ฌerent paths through any application to harm the business. If companies secure host and network-level entry points, focus of attacks usually shifts to the public interfaces. One of the biggest challenges faced by architects, programmers, security consultants and testers is to analyze the vulnera- bilities of the application once deployed into production. As there are lots of dependencies, it is di๏ฌcult to understand everything that will happen during application execution. It is quite di๏ฌcult to say that any application is absolutely safe without doing aggressive testing, at the right time, with the right tools and information. To combat these challenges, application ๏ฌrewall is one of the most basic software countermeasures as it limits the handling of data by speci๏ฌed installed programs or execution of ๏ฌles. Router is a common form of hardware countermea- sure and it prevents the IP address of any speci๏ฌc computer from becoming directly visible on the internet. Conventional ๏ฌrewalls, anti-virus programs, encryption/decryption programs, biometric authentication systems and spyware detection and removal programs are other countermeasures. However, when the security measures are built into the application, there are lesser chances that the unauthorized code will get access, modify, steal or delete the sensitive information. For this built-in security approach, we ๏ฌrst need to have an in-depth understanding of the vulnerabilities of the application, and analyze how these vulnerabilities a๏ฌect the application and system performance. idexcel 2 Page An Integrated Approach Attack Attack Vectors Threat Agents Security Weaknesses Security Controls Technical Impacts Business Impacts Attack Attack Weakness Control Control Control Asset Asset Function Impact Impact Impact Weakness Weakness Weakness Each path represents a risk, which may or may not be serious. Courtesy- OWASP
- 3. Application Security Vulnerabilities Vulnerability is a weakness in the system which can be exploited by the malicious users. Increase in bugs in the software, viruses and lack of security testing can increase the vulnerability of any application. In recent years, attacking application vulnerabilities has been the top priority of several criminal organizations. Several vulnerabilities are discovered on a regular basis, and even the government sites have been often compro- mised by the attackers to infect thousands of browsers that access those websites. Any app development orga- nization that fails to sanitize user input by ๏ฌltering out unneeded but potentially malicious character sequenc- es, does not check the size of user input or does not initialize and clear variables properly, can become vulnerable to remote compromise. Errors in applications occur due to insu๏ฌcient practices or processes, incomplete supporting technology or inadequate skill. The most common issues are the failure to de๏ฌne detailed and clear security require- ments, failure to perform security testing and lack of threat modelling activities. Developers are usually not trained in the secured coding, and only a few organiza- tions have application security and security testing teams to support development projects. Attacker can inject certain exploits such as SQL injection attacks, bu๏ฌer over๏ฌows, cross-site request forgery, cross-site scripting, or click-jacking of the code in order to gain control over the vulnerable machines. Let us take a closer look at these vulnerabilities, and their e๏ฌect on the application security. As per OWASP, the top 10 application security vulnerabilities are as follows: 3 Page implementation of application. Injection ๏ฌaws such as LDAP, SQL and OS injections occur when ambigu- ous data is sent to the interpreter, as part of the query or command. The interpreter can be tricked by the hostile data of the attackers, and either can access data without relevant authorization or execute unin- tended commands. Cross Site Scripting, also known as CSS or XSS, and is a vulnerability mainly found in web applications that allow the attacker to inject JAVASCRIPT and HTML code into the web page and inject malicious scripts into the victimโs web browser. Hackers can steal vital information stored in cookies. The application sends untrusted data to the web browser without proper validation. By executing the scripts in the victimโs browser, attackers can hijack user sessions, redirect user to the malicious sites or deface web sites. Broken Authentication and Session Management Application functions related to the management of session and authentication are usually not correctly implemented, and allow hackers to compromise keys, passwords, token, or to exploit other ๏ฌaws. Sensitive data exposure - If applications do not protect sensitive data such as authentication creden- tials, credit card numbers, bank details, or tax IDs, attackers may modify or steal the weakly protected data and commit identity theft, credit card fraud or other crimes. Passwords are sometimes stored in cookies, and if stored without encryption, hackers can get the username and password information. Insecure Direct Object References - When the devel- oper exposes a reference to an internal implementa- tion object such as database key, directory or a ๏ฌle, it is called adirect object reference. As there is no check for access or any other protection, hackers can access unauthorized data by manipulating these references. An Integrated Approach idexcel Injection is a common application layer attack tech- nique used by hackers to steal data from companies. Hacker can get vital information from the server data- base by taking advantage of the loop holes in the
- 4. 4 Page An Integrated Approach idexcel Missing function level access control - Before any functionality is made visible in the user interface, the function level access rights veri๏ฌcation is done. How- ever, same access control checks need to be performed on the server when each function is accessed. The request needs to be veri๏ฌed, else, hackers can forge a request to access functionality without proper authorization. Using components with unknown vulnerabilities Frameworks, libraries and other software modules usually run with full privileges. Hackers can exploit any vulnerable component and attack can cause server takeover or serious data loss and theft. Cross-Site Request Forgery (CSRF) - In this attack, the victimโs browser is forced to send the forged HTTP request, along with session cookie and other auto- matically included authentication information. Attacker forces the browser of the victim to generate requests, and vulnerable application thinks that these requests are legitimate. Un-validated redirects and forwards - Users are often redirected to other websites and pages by Web applications, and use untrusted data to determine the target page. If proper validation is not done, attacker may redirect the victims to any malware or phishing sites. Security miscon๏ฌguration - Good security has secured con๏ฌguration for application, application server, frameworks, database server, web server and platform. Secure settings must be de๏ฌned, imple- mented and maintained, and Software must be kept up to date. To deal with these vulnerabilities, and assess systems or software for the presence of securi- ty weaknesses, application security testing must be done by specialized testers using specialized tools. Web Hacking Incident Database (WHID) Based on ~1300 hacking or data breach reports published in the news since 2000,updated manually.Some reports cover multiple compromised servers (up to 90โ000 at once),but each such campaign Attack method Top 10 methods of websites compromise Denial of Service Cross Site Request Forgery (CSRF) Credential/Session Prediction Banking Trojan Unintentional Information Disclosure Stolen Credentials Predictable Resource location Brute Force Cross Site Scripting (XSS) Source:Web Hacking Incidents Database (WHID),Feb 2013,n-895 Full data (CSV):WHID attack methods count,WHID attack methods percents. WebAppSec_org Table at Google: Web- Hacking- Incident-Database. Project page : SOL Injection Denial of Service SQL Injection Cross Site Scripting (XSS) Brute Force Predictable Resource Location Stolen Credentials Unintentional Information Disclosure Credential/Session Prediction Cross Site Request Forgery Banking Trojan (CSRF) Percetage 25% 24% 8.9% 4.8% 3.8% 2.8% 2.1% 1.9% 3.7% 3%
- 5. 5 Page An Integrated Approach idexcel Application Security Testing Tools 67% - Lack of Availability of right testing tools 53% - having to maintain multiple versions of hardware, middleware and systems under test 37% - Inability to establish test environments in a timely manner 45% - Lack of clarity on efficient usage of available configuration 44% - Lack of availability of right hardware 36% - Lack of availability of right operating system The World Quality Report 2013-14 indicates several testing challenges faced by organizations: In order to address these challenges and mitigate the risks posed due to vulnerabilities listed in the previous section, organizations need to design a comprehensive application security testing plan that can provide com- pliance and security. To design this plan, organizations need to answer the following: Do we have a ๏ฌrm grasp on the most signi๏ฌcant vulnerabilities and risks, and are we addressing these issues frequently? If our applications are attacked, can we detect them, prevent them, and deal with them? How do we know that our existing application securi- ty infrastructure is e๏ฌective, and delivering return on investment? Are employees following the organizationโs security procedures and policies, and are these enough to mitigate the risks involved? Vulnerability Assessment - Process that identi๏ฌes and classi๏ฌes security holes or vulnerabilities in the application, and can help forecast the e๏ฌectiveness of the proposed countermeasures, and evaluate the e๏ฌectiveness of these measures once they are put into use. Vulnerability scanning can be done with the help of vulnerability scanner which is a program that performs the diagnostic phase of the vulnerability assessment. Once these questions have been analyzed and answered, the following tools can be used to put the plan to practice. Some of the commonly used application security testing tools are:
- 6. 6 Page An Integrated Approach idexcel Threat Modelling - Application security can be improved by using a process called Threat Modelling. It is an application risk assessment tool that helps system designers to understand security threats that their application might face. It helps designers to develop mitigation strategies for the vulnerabilities, and focus their attention where it is required most. Threat model should be created as early as possible in the SDLC. This process involves de๏ฌning enterprise assets, identifying the functionality of each asset with respect to these assets, outlining security pro๏ฌle for each application, understanding and prior- itizing threats, and documenting the actions requires for each case. Threat can be any actual or potential adverse event that is capable of compromising the asset. The event can be malicious such as denial of service (DoS) attack, or any unplanned event. Code Analysis - Integrating security measures into the Software Development Life Cycle (SDLC) is crucial to application security. One of the measures is the static and dynamic source code analysis to test for technical and logical vulnerabilities, and to know if the application can withstand malicious attacks. Static analysis is reviewing the application source code without executing the application, and analyze what the code does during each program execution. However, some issues become apparent only during system integration, component-level integration or deployment. Hence, dynamic analysis needs to be conducted once static analysis is done. It reveals behaviour of the application when executed, and its interaction with operating system and other process- es. Static analysis ๏ฌnds errors early in the SDLC, and dynamic analysis tests the code in a real-life attack scenario. Penetration Testing - Penetration Testing is a process to identify security vulnerabilities in the application by evaluating the network or system with various malicious techniques. This testing helps protect the identi๏ฌed vulnerabilities, and secure data from malicious users. There is white box and black box penetration testing. In black box testing, the tester does not have any information about the system under test, whereas in whitebox penetration testing, the tester has all the information such as IP address, code, and infrastructure diagrams prior to starting the tests. Runtime Analysis - Runtime analysis tool closely monitors the behaviour of the application for debug- ging and validation. It uses source code insertion to instrument the source code, and provides dynamic analysis of the running application on native or embedded target platform. Code coverage performs code coverage analysis, performance pro๏ฌling provides performance load monitoring, memory pro๏ฌling provides performance load monitoring and runtime tracing draws the real-time UML sequence diagram of the application. Runtime analysis involves assessing the application for security issues from the end usersโ perspective. For this analysis, the tester does not have access to source code, and has the same kind of knowledge as an external attacker. Runtime analysis helps quickly detect memory corruptions and critical security vulnerabilities. Binary Analysis - Applications these days are usually a mash-up of code from several sources. Binary code analysis scans compiled or byte code so that the orga- nization can test more accurately and comprehen- sively. As computers execute binaries, not source code, binary analysis provides ground truth about application behaviour.
- 7. 7 Page An Integrated Approach idexcel Authentication - Test for user enumeration, authenti- cation bypass, brute force protection, autocomplete on password inputs or forms, logout functionality presence, cache management, default logins, user-accessible authentication history, out-of-chan- nel noti๏ฌcation of account lockouts and successful password changes, and consistent authentication across applications with shared authentication schema. Also test password quality rules, remember me functionality, password reset and recovery, pass- word change process, CAPTCHA, and multi factor authentication. Authorization - Test for path traversal, missing autho- rization, bypassing authorization schema, vertical access control problems and horizontal access control problems. Denial of Service - Test for anti-automation, account lockout, SQL wildcard DoS, and HTTP protocol DoS. Business Logic - Test for feature misuse, lack of non-repudiation, integrity of data, trust relationships and segregation of duties. Risky functionality (File Uploads) - Test that accept- able ๏ฌle types are whitelisted, ๏ฌle contents match the de๏ฌned ๏ฌle type, ๏ฌle uploads have anti-virus scanning in place, unsafe ๏ฌlenames are sanitised, uploaded ๏ฌles are not directly accessible within the web root, and uploaded ๏ฌles are not served on the same hostname or port. Also test that the ๏ฌle size limits, upload frequency and total ๏ฌle counts are de๏ฌned and are enforced. Files and other media must be integrated with the authorisation and authentication schemas. Risk Functionality - Card Payment - Test for known vulnerabilities and con๏ฌguration issues on the appli- cation and server. Also test for guessable or default passwords, injection vulnerabilities, non-production data in live environment, insecure cryptographic storage, bu๏ฌer over๏ฌows, improper error handling, insu๏ฌcient transport layer protection, Cross-Site Request Forgery (CSRF) and authentication and authorization. Data Validation - Test for re๏ฌected cross site script- ing, stored cross site scripting, cross site ๏ฌashing and DOM based cross site scripting. Also test for SQL, HTML, ORM, LDAP, XXE, XML, XPath, SSI, Code, XQuery, command, expression language, and IMAP/SMTP injection. Test for format string, incubat- ed vulnerabilities, HTTP Verb Tampering, HTTP Smug- gling or Splitting, Open redirection, remote ๏ฌle inclu- sion, local ๏ฌle inclusion, Null/invalid session cookie, mass assignment, auto-binding, HTTP parameter pollution and NoSQL injection. Also compare client-side and server-side validation rules. Obfuscation - Is used to make the program much harder to understand and protect it from attacks. Information Gathering - Explore the application, crawl/spider for the hidden or missed content, check for caches, check for ๏ฌles that expose content, perform ๏ฌngerprinting, and identify user roles, tech- nologies used, client-side code, application entry points, multiple versions or channels, all host names and ports, third-party hosted content and co-hosted and related applications. Con๏ฌguration Management - Check for commonly used application and administrative URLs, old and unreferenced ๏ฌles, Cross Site Tracing and HTTP meth- ods supported. Test ๏ฌle extension handling. Test for policies, non-production data in live environment and security HTTP headers. Also check for sensitive data in client-side code.
- 8. An Integrated Approach 8 Page idexcel Secure Transmission - Check SSL version, key length, algorithms, session tokens and credentials. Check for digital certi๏ฌcate validity and if HTTP Strict Transport Security is used. Session Management - Check session tokens for cookie ๏ฌags, session cookie scope, and duration, session termination after maximum lifetime and termination after relative timeout, session termina- tion after logout, and establish how session manage- ment is handled in the application. Test for consistent session management across applications with shared session management, session puzzling and CSRF and clickjacking. Test session cookies for randomness, and con๏ฌrm that new session tokens are issued on login, logout and role change. Test to see if users can have multiple simultaneous sessions. Cryptography - Check for weak or wrong algorithm usage, randomness functions, proper use of salting, and check if data which should be encrypted, is not. Additionally, establishing audit trail for data, and ensuring that the back end is secure, and validating all potential client-side routes into the application, are also some of the important measures to ensure application security. In order to cover all these aspects of application security testing and to have a comprehensive test plan and implementation in place, an organization can follow the steps below: 1. The process of preparing and planning for the application security testing begins with an under- standing the business requirements, the objectives of security compliance of the organization and secu- rity goals. The test planning must consider all these security aspects. 2. Analyze and understand the requirements of the application which is being tested. 3. Collect all the setup information used for the development of software and network including technology, operating system, hardware etc. 4. List out all the application vulnerabilities and secu- rity risks, and based on this list, prepare a threat pro๏ฌle and a test plan to address the issues. 5. Prepare a traceability matrix for each identi๏ฌed vulnerability, thread and security risk for the applica- tion. 6. Security testing cannot be done manually, and hence, identify tools to execute the test cases faster, in a more reliable manner. 7. Prepare security test cases, execute test cases, and retest the ๏ฌxes. 8. Execute regression testing. 9. Prepare a detailed Security Testing report contain- ing threats and vulnerabilities, detailed risks, and open issues. 10. Internally developed and third-party applications must be thoroughly tested to ๏ฌnd security ๏ฌaws. In case of third party software, the company should ensure that the vendors have conducted comprehen- sive security testing of all the aspects of the applica- tion. For in-house developed applications, compa- nies need to conduct these tests or engage an outside ๏ฌrm that specializes in application testing.
- 9. 9 Page An Integrated Approach Integrated Approach In order to make these tools and testing more e๏ฌective and useful, it is a good practice to include security in each phase of the SDLC so that security bugs can be prevented, rather than ๏ฌxed. This is the era of proactive testing, and ๏ฌxing bugs in the deployment phase can be a very cost-prohibitive and an ine๏ฌective practice. Integrating testing in each phase of software develop- ment can ensure that the security has been adequately covered, and controls are e๏ฌective throughout the development process. Integrated security testing systems covering the widest possible range of assets represent the promise of a future where companies are not left wondering where the most threatening risks lie. Only integrated, multi-tiered security testing across networks, idexcel endpoints, applications and end users can provide a centralized and comprehensive approach to risk manage- ment. Independent, comprehensive application testing software solutions o๏ฌer the most e๏ฌective way to expose critical application vulnerabilities, mitigating the risk and ensuing timely action. There are also dynamic application security testing (DAST) solutions available capable of e๏ฌectively testing modern applications using newer technologies such as AJAX, Rest, GWT and JSON. These services are available as SaaS and deliver comprehensive application coverage and sophisticated attack methodologies, and eliminate false positive and false negative ๏ฌndings. โข Deployment / Operational Security โข Patch Management โข Incident Management โข Threat Model Update โข Measurements โข Security Requirements Engineering โข Compliance Goals โข Industry / Organizational Standards โข Technical Requirements โข Threat Modeling Lessons โข Measurements โข Threat Modeling โข Architecture & Design Patterns โข Security Test Planning โข Architecture & Design Review โข Measurements โข Attack Patterns โข Automated Testing โข Regression Testing โข Stress Testing โข Third Party Assessment โข Threat Model Updates โข Measurements โข Code Review โข Security Patterns โข Flaw & Bug Mitigation โข Unit Testing โข Threat Model Updates โข Measurements METRICS TOOLS TRAINING POLICY SECURITY AND THE SOFTWARE DEVELOPMENT LIFECYCLE Courtesy - FoundStone
- 10. Launch Secure Application 10 Page idexcel Conclusion Techniques and tools for testing are changing, becoming more sophisticated, and e๏ฌcient with each passing year and organizations that do not take proactive application security testing measures are increasingly being seen as laggards as they fail to comply with the critical IT best practices. There is no actual right and wrong tool, and probably all techniques must be used to ensure that all the areas are exhaustively tested. A balanced approach includes several techniques involving manual reviews and technical testing to cover testing in all the phases of SDLC. Test early and test often. Use the right tools. Before you buy, take a good look at all the free tools available, and if they donโt su๏ฌce, you can look for paid tools. Some tools also give a certi๏ฌcate if no vulnerabilities are found. Keep in mind that new security threats are emerging all the times, and it requires extra e๏ฌort to stay updated, and be proactive in order to keep your apps and system secure.
- 11. Launch Secure Application idexcel About the Author Harsha B N works as a Test Architect in the Mobility division of Idexcel. He has twelve years of experience in develop- ment and testing mobile applications. Prior to joining Idexcel Harsha worked with Nokia for eight years in various capacities as Program Manager, Chief Test Engineer, Project Manager working on OTA infrastructure development, Mobile Payments services, S60 SDK. About Idexcel Idexcel is an innovative provider of IT Products & Services focused on emerging technologies. We help world leading companies build e๏ฌciencies and stronger businesses. With more than 15 years into existence Idexcelโs main focus is client satisfaction and technology innovation. Our industry expertise and a global, collaborative workforce forms the backbone of our services. We o๏ฌer high degree of skills in Enterprise Applications, Cloud Services, Data-warehousing, Big Data, Analytic, QA & Testing Services, IT consulting and Sta๏ฌng. Idexcel product line includes: NDS, ERP, and Cync - A revolutionary credit monitoring application for the manufacturing and financial management. For more information log on to www.idexcel.com. Global Head quarters 459 Herndon Parkway Suite 11 Herndon, VA 20170 Tel: 703-230-2600 Fax: 703-467-0218 Email: [email protected] India Operations โCrystal Plazaโ 9, 10 ,11 Bhuvanappa Layout, Hosur Road Bengaluru โ 560 029 Karnataka Tel: +91-80-2550 8830 Email: [email protected] ยฉ Copyright, Idexcel. All rights reserved. No part of this document may be reproduced, stored in a retrieval system, transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the express written permission from Idexcel. The information contained herein is subject to change without notice. All other trademarks mentioned herein are the property of their respective owners.