Securing the New Breed of Web Applications

Dave Ferguson

Solution Architect, Application Security SME

Web Application Security

Often overlooked or neglected

Regulatory compliance

Reduce risk / due diligence

Contract language may include application

security

But how to assure your applications are secure?

2

Application Testing Approaches

3

Dynamic Analysis

Static Code Analysis

Manual penetration testing

In the Beginning

4

Server-side Includes

CGIClassic ASP

Java servlets / JSPs

Static site / HTML 4

ASP.NET

1995

1996

1997

1998

1999

2000

2001

2002

ColdFusion

PHP

Web 2.0

5

2002

2003

2004

2005

2006

2007

2008

2009

Dynamic HTML

AJAX

JSON

Flash/Flex

Silverlight

JavaFX

Mashups

The New Breed of Web Apps

6

2009

2010

2011

2012

2013

2014

2015

2016

HTML5

AngularJS

WebSocket

Single Page Apps

GWT REST APIsURL Rewriting

Backbone JSExt JS

Challenges for Dynamic Scanners

Web Applications

Crawling must be more intelligent

Can't simply parse HTML to find links or forms

Identify JavaScript events to "fire" them

Determine injection points in URL rewriting

REST APIs

Commonly used as backend for mobile apps

Crawling concept does not apply

Tool must know how to invoke the service endpoints

7

Responding to the Challenge

8

Dynamic Test Tools Are Evolving

Automation is critical (resources are scarce!)

Many scanners adapting to the new web technologies

Also testing for new types of web vulnerabilities

Test coverage remains vital

Tool should be able to authenticate to the system

Tool should be able to crawl web apps, even with new JS framework

Tool should support URL rewriting

Tool should support REST APIs

9

SDLC

10

Application Security Program

AppSec Center of Excellence

Maintain secure coding guidelines/standards

Organize security training for developers

Manage testing activities

Confirm 3rd-party libraries are not vulnerable

Track metrics to demonstrate improvement

OpenSAMM (www.opensamm.org)

BSIMM (www.bsimm.com)

11

Software Assurance Maturity Model

12

Security in the SDLC

Define security requirements

Maintain an inventory of applications

Scan apps early and often in the dev lifecycle

Leverage scan tool APIs to automate testing

Perform application threat modeling

Require secure code training for developers

Leverage the security features of development frameworks

13

Thank You