Setting up a secure development life cycle with OWASP - seba deleersnyder

Editor's Notes

• #4: REMEMBER… OWASP IS JUST PEOPLEAppSec is about not about tools or technology… it’s about people. OWASP is about community.______________
• #7: http://www.clerkendweller.com/2012/7/31/Integrating-Security-with-Agile-Software-Development
• #9: Define building blocks for an assurance programDelineate all functions within an organization that could be improved over timeDefine how building blocks should be combinedMake creating change in iterations a no-brainerDefine details for each building block clearlyClarify the security-relevant parts in a widely applicable way (for any org doing software development)
• #10: Three successive Objectives under each Practice define how it can be improved over timeThis establishes a notion of a Level at which an organization fulfills a given PracticeThe three Levels for a Practice generally correspond to:(0: Implicit starting point with the Practice unfulfilled)1: Initial understanding and ad hoc provision of the Practice2: Increase efficiency and/or effectiveness of the Practice3: Comprehensive mastery of the Practice at scale
• #12: The Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development lifecycle. At only 17 pages long, it is easy to read and digest.The focus is on secure coding requirements, rather then on vulnerabilities and exploits. It includes an introduction to Software Security Principles and a glossary of key terms.It is designed to serve as a secure coding kick-start tool and easy reference, to help development teams quickly understand secure coding practices.
• #15: LAPSE+ is a security scanner for detecting vulnerabilities of untrusted data injection in Java EE Applications. It has been developed as a plugin for Eclipse Java Development Environment,FxCop: An application that analyzes managed code assemblies for conformance to the Microsoft .NET Framework Design GuidelinesIn addition to security checks, FxCop analyzes assemblies for areas of improvement in design, localization, and performanceCAT.NET is a snap-in to the Visual Studio IDE that helps you identify security flaws within a managed code (C#, Visual Basic .NET, J#) application you are developing. It does so by scanning the binary and/or assembly of the application, and tracing the data flow among its statements, methods, and assemblies. This includes indirect data types such as property assignments and instance tainting operations. The engine works by reading the target assembly and all reference assemblies used in the application -- module-by-module -- and then analyzing all of the methods contained within each. It finally displays the issues its finds in a list that you can use to jump directly to the places in your application's source code where those issues were found. The following rules are currently support by this version of the tool. - Cross Site Scripting - SQL Injection - Process Command Injection - File Canonicalization - Exception Information - LDAP Injection - XPATH Injection - Redirection to User Controlled SiteWhile MS has not released the new version, the good news is you can still use the old Add-in for CAT.NET 1.1.1.9 in Visual Studio 2010.http://sourceforge.net/projects/agnitiotool/A tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.
• #19: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.The ESAPI is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway. The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers. ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.Allowing for language-specific differences, all OWASP ESAPI versions have the same basic design:There is a set of security control interfaces. They define for example types of parameters that are passed to types of security controls.There is a reference implementation for each security control. The logic is not organization‐specific and the logic is not application‐specific. An example: string‐based input validation.There are optionally your own implementations for each security control. There may be application logic contained in these classes which may be developed by or for your organization. An example: enterprise authentication.
• #20: The attacker can send data in any encoding. And the interpreters downstream from your application may decide to handle any encoding.CanonicalizeInput could be in any character setDouble-encodingMultiple encoding schemesDouble-encoding with multiple encoding schemesValidationSimple to configure for positive rulesImpossible to do perfectly, since you need special charactersGetSafeValueRich content – strip out bad stuff and continueDifficult – need to fully parse HTMLCanonicalize and Validate from databaseWatch out mass SQL injection?EncodeForHTMLNot perfect since browsers allow encoded characters to execute (particularly in attributes)Have to avoid double-encodingSetCharacterSetBrowser will try to guess the encoding
• #21: Stable quality projects are generally the level of quality of professional tools or documents.PROTECT - These are tools and documents that can be used to guard against security-related design and implementation flaws.Tools: AntiSamy Java/:NET, Enterprise Security API (ESAPI), ModSecurity Core Rule Set ProjectDocumentation: Development Guide, .NET, Ruby on Rails Security Guide, Secure Coding Practices - Quick Reference GuideDETECT - These are tools and documents that can be used to find security-related design and implementation flaws.LIFE CYCLE - These are tools and documents that can be used to add security-related activities into the Software Development Life Cycle (SDLC).