Application security should be addressed in initial SDLC stages

IT applications are akin to the organization's blood vessels because they carry critical information and execute key processes. However, due to a peripheral approach to security, application security is often neglected.

Applications require strong embedded security to prevent breaches. Hence enterprises should start to address security at the software development lifecycle's (SDLC) early stages. There are several ways to go about this.

Education: Because business users or customers are often unaware about security risks, developers and the application architect should be familiar with possible security threats and application attacks. These personnel should inculcate the application security culture throughout the lifecycle.

If you estimate risk correctly from the beginning, it will also help you to save on costs. According to an industry statistic, if the cost of fixing a bug at design phase is X, post the release it would cost 60X. The cost of fixing bugs increases during each stage of application development. Developers can be trained on dummy applications to help them learn how attackers operate.

Build a threat model: A threat model for your application is essential to identify the involved risks, possible attack scenarios, controls and risk mitigation costs. To start, you should understand the application's utilization. You can categorize an application based on usage (internet or intranet), data sensitivity (sensitive or non-sensitive) and the technology used (web based or non-web based application). These parameters help you categorize the application security level as high, medium or low. Based on this classification, security controls are integrated during the application design process.

Read more on SearchSecurity.TechTarget.IN >>

My Top Excuses for Not Fixing Security Defects

Here are the TOP excuses/reasons I have come across from people who would not want to fix a critical or severe security defect:

1. Functionality is prioritized before security.
"Doesn't matter if the application can be accessed by unauthorized users, but the application should be working as we need to GO LIVE !!"

2. Ahh !! We do not need to be compliant to that level of security.
"Lack of basic security measures required for an application."

3. The application will be replaced soon with newer systems. Why bother to change now??
"The system owners with no concrete plan of replacing the system in next phase pounce with this excuse for not fixing the defects at this moment."

4. The security solution is conflicting with the business requirement.
"Remember the requirement is to email the password to the user in clear text. Ahh !! a defect in requirement itself."

5. Inadequate reach of security risk to the customer.
"The software vendor realizes the importance of security and the risks involved, but unfortunately his Point of Contact at the Customer side is a non-technical guy who doesn't realize the importance equally and denies a change."

Microsoft Security Intelligence Report v6

Microsoft has released the latest version of the Microsoft Security Intelligence Report (SIRv6), examining industry-wide software vulnerability disclosures, Microsoft vulnerability disclosures and exploits, malicious software (malware), and potentially unwanted software.

I understand that some of you may not wish to read a 150 page technical analysis document, except as a way to fight off insomnia. Because of that, if you go over to the main SIR page at www.microsoft.com/sir, there is also a "Key Findings" document that is much more concise and provides a nice summary of the findings from each section.

Report: http://www.microsoft.com/security/portal/sir.aspx

Can Security be incorporated in the Computer Science & IT courses?

Attacks on the web systems have become a common place and most of the issues have been attributed to software vulnerabilities. The IT software industry has recognized the importance of building secure software systems by incorporating security in their SDLC.

What amuses me is that the situation can be much better improved by integrating the basic security mantras in the graduate programs of Computer Science and Information Technology courses. The engineering courses for Computer Science and Information Technology at least can be sought to have the security touch points to enable the fresh candidates understand security implications while building software.

Currently, most security efforts at the university courses are in the form of specialized security classes which address particular topics in form of network security or cryptography. In contrast to the integrated approach currently being used in industry, education continues to handle security as an afterthought.

Something that everyone in the engineering courses would have learnt would be Database Management Systems (DBMS) and Web Technologies. Let’s take an example, we were taught that writing stored procedures are better compared to writing dynamic SQL because they are pre-compiled and hence better in terms of software performance. But we were not taught that stored procedures also helps protect you from a security threat called SQL Injection which is one of the most common attack.

My proposal is to plot security in the engineering curriculum with core courses. It just requires infusion as a subset in the main subjects. The concept of robust programming is native to secure coding. It is imperative to teach students that safe and reliable programs are inherently more secure.

The classic Software Development Lifecycle (SDLC) includes analysis, design, implementation, testing, and maintenance. Incorporating security into the SDLC yields the Secure Development Lifecycle. The touch points in the course should be Security Requirements and Analysis, Security Design, Security Implementation and Security Testing. Something that is fundamental to software programming and security assurance becomes the security coding mantras. A few are mentioned below.
• Principle of Defense in Depth
• Principle of Least Privilege
• Do not trust any user input
• By default Deny
• Assume the Impossible
• Graceful degradation on error



The idea is to make students aware of these small mantras while learning software programming. These small changes make a huge impact on the student who enters the industry and is already aware of security best practices if not all the attacks. It makes a great value add for the organizations too to hire a candidate with basic security knowledge. The ability to write secure code should be a fundamental to a university computer science as basic literacy. I am sure that the industry will also appreciate if the universities accept these changing demands.


Dharmesh Mehta
Technical Analyst, Mastek

Polymorphic Exploitation

The emerging attacks by attackers which is dynamically changing each time a potential victim visits the malicious page is defying the traditional regular-expression and heuristic-based protection that identifies Web exploits at the network or host.

The attacker are very effective in creating a unique exploit with each request and making it impossible for signature-based protection engines to uniquely detect each attack instance.

The major driving factor for the attacker still remains Financial gain. Stealing personal data, hijacking Web transactions, executing phishing scams and perpetrating corporate espionage
are all motivators.

Traditional security techniques focus on stopping file execution and viruses at the client’s operating system (OS) layer. Unfortunately, it is far more difficult to protect users at the browser level. While some signature-based protection is able to detect one layer of Web exploit obfuscation, polymorphic exploitation will pose a new problem.

Proposed countermeasures for Web 2.0 and client side attacks include:
• Educating Web developers on the need for secure coding throughout the development lifecycle, with emphasis on input validation.
• Transitioning from finger-print or pattern matching protection to heuristics or behavior-based protection.
• Enabling protection engines to understand JavaScript just as the browser does.
• Utilizing feedback networks to analyze malicious Web sites, encourage remediation and improve content filtering at the browser level.

Guarding Against Credit Card Frauds

The percentage of people using plastic money (cards) for transactions is growing day by day and so are the card scams rising along. We often hear or read about credit card frauds in our daily and how people end up in nightmares seeing huge bills for things they actually have never purchased. Likewise even the credit card companies are paying off handsome amount from their profit share to cover these fraudulent transactions.

Let me bring up few ways in which these frauds happen. By and large for physical credit card transactions, the deception story starts when the person who takes your card for swipe copies your card information to some other device. Later these details are copied to fake cards which are genuine card look alike with complete hologram markings and logos. The poor card holder remains completely unaware that his card has been cloned until he notices bill amounts of things he has never purchased. One of the other common methods is making a hoax call (often representing as card issuer authority) to the card holder and trying to retrieve card details. Credit card bills lying in trash cans or public places are other avenues where fraud originates.

Regarding users using cards for online transactions, one can see a large number of ways in which card data can be compromised. Falling in prey of a nice email asking for card details in return of discounts, or emailing card details to a friend or being a victim of card details being copied by an illegal software installed in cyber cafes are most common lines of attack sources.

One of the reasons in increasing successful frauds is inadequate knowledge of the card owner on proper use of credit cards. Here’s how credit card owners can better safeguard from these frauds.
• Over a credit card transaction, keep an eye on your card as it is being swiped. Make sure it is being swiped only once for a single successful transaction and get back your card as quickly as possible.
• Sign your credit card as soon as you receive it.
• Be protective of your credit card number so that others around you can't copy it or capture it on a cell phone or camera.
• Be prompt in keeping a check on your credit card bills to verify there are no bogus charges. For any charges that you don’t recognize, report these charges promptly to the card issuer.
• For people using cards at hotels or restaurants, remember to draw a line through blank portions of the receipt where additional charges could be fraudulently added other than hotel tips.
• In case of change of your billing address, notify your credit card issuers in advance so that bills reach safe hands.
• Save your receipts so you can compare them with your monthly bills.
• Always give your phone number to the company for verification of suspicious transactions.
• Be wary of any phone call or email seeking details of your account.
• Never give away photocopies of both sides of your credit card for any purpose.
• For online transactions, using credit card, remember to go by HTTPS and not HTTP.
• Avoid having e-transactions in a publicly share machine like Internet café or open free wireless network.

Leading Change

Hello All....

I have been taking a few lectures on 'Change Management in Enterprise' in one of the management institutes in Mumbai. We talked about McKinsey's Principles and Lewin's Principles for Change Management. Then I came across this wonderful piece on Leading Change from John Kotter.

John P. Kotter, a world-renowned expert on leadership at Harvard Business School, has been the premier voice on how the best organizations actually “do” change.

This is what he says...Hope people interested would enjoy as I did. In the world of IT, even inclining organizations to look into Security requires a 'Change'. Let us all try and achieve the BEST CHANGE. :)

Why do we need leaders?

Leadership is required for mobilising people to handle challenging times. In a world that has no challenges, things are fine and you don’t require leaders. In such a world, you don’t need to mobilise people for handling any crisis. But unfortunately, in our world, we a have huge number of challenges in the government, non-profit and business sectors; we have many challenges in the developing and the developed world. Hence, we require leadership in our world. In fact, in our world, the need for leadership is more now than ever before. In our current world of business, we cannot afford to restrict leadership to just the top management positions. Every employee, every engineer should rise to a leadership role. They should step in to solve customer problems; they should step in to solve internal company problems. The number of people that we need to provide leadership is huge now. The turbulences in life will never stabilise, and I see the demand for leaders going up steadily.

How are leaders different from managers?

Leaders mobilize people. Their role is to undertake challenging goals that involve change. Leaders focus on changing behaviour, while managers focus on existing circumstances. For example, if there is a DVD player that is built well, we don’t require a leader to press the on/off button, because there is no challenge in it and no change is involved. I am not saying that managers are not important. Of course, they are important since it is not just the story of one DVD player. It is the story of 100,000 DVD players in 20 different countries where things can get complicated. Managers are important in that they should manage all these different DVD players in different countries, and ensure that they play the right movies at the right time. But the role of leaders is different. They often create the systems that the managers manage. For example, initially, there was the VHS system and the tapes that we were used to. It took leadership to change the user habits into something better. In the case of the battle between Sony and VHS, the amount of leadership that was required initially to drive the battle was much greater than after they won. Leadership is important at times of change because most of the time, the systems are not in place and leaders drive change and face challenges that are humongous. In short, in the case of stable existing systems, you need managers, while in the case of new turbulent situations that require a change, you need leaders.

Do leaders always drive change?

Almost always, leadership produces change. Go back in history and read about the people who were great leaders, and you will see that they were always focused on change. They were always helping people to change their behaviour. They were always focused on changing systems. Look at Mahatma Gandhi — he induced change in Indian society: he mobilised Indians and changed the way they looked at their state of affairs.

Do leaders drive their selfish cause or altruistic cause?

More often, people are talking about the behaviour of people when they are talking about leadership. They think about the presidents or CEOs of companies when leaders are mentioned. That is not the right way. The belief is that people in those positions mobilize people. But, the reality is that most of the times they are just politicians, managers, or sometimes they are not good at any of these. That is not a good way of defining leadership.

Good leaders are always driving changes. They derive a sense of satisfaction out of the change they drive. Great leaders always do something for people. I call it altruistic because it is good for the people. They are progressing towards goals that the society needs.

What is India’s role in shaping effective future leaders?

India is becoming very important and has got a bigger role to play in the global economy. Offering services cheaper and better is not the end; it’s the beginning. You must lead the way. You need good leaders for that, but more often than not, you don’t get better leaders. Educational institutions should focus on mentoring good leadership.

Big B Watching or Is this Intrusion of Privacy?

I ain't talking about Big B - Amitabh Bachhan here....
This is about Big Brother - our own police force.

I read an article in Hindustan Times (April 30th, 2007). In first-of-its-kind intitative to tackle cyber-crime, the Nashik police is keeping an electronic eye on cyber cafe users. They aim to maintain real-time photo record of users at cyber cafes and the times spent surfing. This is all done using a software called Webcafe.

Hence if a user goes to a cyber cafe, his photo, name, address and identity proof gets recorded into the main server which would be connected to a central server located at police head quarters. So everytime a user logs on to a computer the details would be automatically transeferred to the police servers. I saw similar kind of photograph based logs in Hyderabad when I was touring. Now with these kind of systems coming in place, we would hope that cyber crimes would reduce atleast from cyber cafes as point of origin. I am still not seeing such measures from cyber crime cell in Mumbai though.

Let's see the other side of story. How many of us like to be photographed everytime you go to a cyber cafe? What is the guarantee that the cafe owners will not misuse the photographed data? Indian Penal Code asks cafe owners to keep a manual record of every user. I think this is really intrusion of one's privacy. If we see the real world attackers - the so called smart hackers will be doing away with all these measures either by using multiple proxy servers or spoofing IP addresses to cover their tracks. They have thousands of ways to find a victim for attack.

I do not say that we should not do anything. But should the measures be at cost of a general user's privacy? Do the police now storing these information now guarantee the safety of our data same way as our banks do for online transactions. Also one needs to wonder how secure are the central servers at police station. It surely has such large amount of personal data now. Are the softwares and servers tested for security before they store such data?

I think everybody should think about this. Feel free to share your comments here. You can mail me at dharmeshmm at gmail dot com

Thanks,

Dharmesh.

Security among The Hottest Skills for 2007

With fewer openings this year, expect these five premium skills to win the jobs

Top skills IT executives say they will hire for in 2007:

1. Programming/application development
2. Project management
3. IT/business analysis
4. Security
5. Help desk/technical support

Source: Computerworld's quarterly Vital Signs survey