Uniplus Consultants

What to look for in a Web Application Security Testing Solution

In the previous blog, I described the new security tools and methodologies that IBM envisions – since then, I’ve been taking a closer look at the challenges executives and developers are encountering while trying to integrate security tools and processes into the software development lifecycle and have some interesting results to share!

Traditionally, organizations depend on perimeter controls to keep them secure. Unfortunately, network firewalls and network vulnerability scanners can not stop application-level attacks. By design, web applications allow outsiders to interact with an organization’s systems and data. This interaction passes through network defense mechanisms such as firewalls and network-based intrusion detection systems.

Studies indicate that 75 percent of attacks are now targeting web applications, and that these tend to be vulnerable to these types of attacks. Clearly, web application security can no longer be ignored.

From a technology perspective, the use of automated web application security tools is beneficial in scale and cost. An automated tool allows consistent, reliable and scalable examination of web application security vulnerabilities across large diverse environments. In addition, an automated tool can be used to provide consistent and relevant recommendations that are consistent with corporate policy and requirements.

From a process perspective, integrating web application security testing into the software development lifecycle is a key initiative for establishing good risk management. While this can and should be performed by a dedicated and knowledgeable security assessment team as part of the final review, it should also be integrated into the early stages of application development to focus on security issues as they appear and to save on time and cost.

Threats to web applications include but are not limited to:

• Cross-site scripting: 80% of web applications are vulnerable to this threat that would permit Impersonating another user
• SQL injection: 60% of web applications are vulnerable to this threat that would permit total data compromise
• Parameter tampering: 60% of web applications are vulnerable to this threat that would permit fraud and altering distributions
• Cookie poisoning: 40% of web applications are vulnerable to this threat that would open the door to stealing someone’s identity

The optimal web application testing tool would allow dedicated security auditors to provide detailed information around web application vulnerabilities as well as executive, management and developer reporting that is specifically designed for the role of the unique individual.

In the next blog, we will look at IBM Watchfire which is known as the best web application vulnerability assessment software.

In conclusion, Web Application Security Testing tools are becoming more integrated into the software development lifecycle. In my future blog, I would like to evaluate the best product in this category. IBM WatchFire AppScan happens the market leader in this space – much more to come!

Key security implications of opening up your LAN to wireless traffic

Wireless technology is taking its place in today’s society, thus increasing the demand for wireless LAN.  Risks once associated with WLAN can be easily mitigated due to the advancement in WLAN security.

With the increase in and popularization of various mobile computing devices such as laptops, and PDAs, more people need to access the network to perform a variety of data transference functions at any time in any place. WLANs offer a new dimension in productivity for users.  A Gartner study suggested that enterprises could expect a 22 percent productivity improvement by introducing WLANs.

To evaluate the main implications of using WLAN form the security perspective, we need to look at both the benefits and the potential risks of introducing such technology into the LAN landscape.

WLAN benefits can be expressed as follows:

• Connection is near and instantaneous for mobile workers
• Staff can remain online even when in meetings or working away from desks
• Online information is always available
• Integration of new devices and applications into the IT environment improve significantly
• The cost of provisioning network access to new buildings is substantially lowered
• Network can be easily scaled to respond to different levels of demand
• Increases organizational adaptability to internal growth through improvised seating configuration and lower marginal cost for relocation per user

Potential Risks introduced by WLAN are the following:

4      Rogue access points

4      Traffic analysis and eavesdropping

4      MAC spoofing/session hijacking

4      Denial of Service (DOS)

4      Masquerading

4      Modification of data

4      Increased system complexity from switch locations in various  areas due to limited rack space

4      Effectively planning and configuring wireless backbone 

4      Greater network management costs associated with wireless specific activities (managing coverage, network activity)

4      Procurement of user’s wireless hardware (wireless card, laptop or other required equipment) incurred in addition to the expense of established hardware refresh cycle

Each organization needs to look at the benefits and the potential risks introduced with using WLAN technology and judge its overall impact on its business goals and strategic objectives. Judging from the latest trend in the corporate world, as the security concerns raised form the use of WLAN are being addressed by technologies such as 802.11i, more and more companies are willing to assume the risks that come with opening up their network to wireless traffic and benefit from the flexibility of WLAN technology.

In the next blog we will look at the major areas that need to be addressed in order to successfully secure a wireless environment.

How to implement network level security using IPv6?

Introduction

IPv4-based networks form most of today's networks due to its relative resilience in spite of its age. Cracks have however been apearing on a new version of the protocol has been in the work.

All new techniques introduced to overcome some of the IPv4’s most-known security deficiencies (SSL, IPSec, etc.) have been judedged useful but insufficient. In other words, despite all recent improvements, the supporting Internet infrastructure continues to lack the appropriate security framework.

IPv4 security issues

Security was not a primary concern when designing IPv4. Basically, the idea was to establish an end-to-end pipe with no regards for security. The end-nodes where assumed address security requirements such as encryption and digital signing (e-mail applications would perform own encryption).

The following resilience requirement are needed to deal with security threats:

• Denial of service attacks (DOS): Certain services are flooded with a large amount of illegitimate requests that render the targeted system unreachable by legitimate users
• Malicious code distribution: Worms and viruses use infected hosts to infect remote systems
• Man-in-the-middle attacks: IPv4’s lack of proper authentication mechanisms may facilitate men-in the-middle attacks
• Fragmentation attacks: This is achieved by exploiting large IPv4 packets at he O/S level (e.g. ping of death attack)
• Port scanning and other reconnaissance attacks: Network is scanned to find potential targets with running services
• ARP poisoning and ICMP redirect: This occurs when forged ARP responses are broadcasted with incorrect mapping information that could force packets to be sent to the wrong destination. ICMP redirect attacks use similar approach.

IPv4 short term remedies

To deal with IPv4 security limitations, certain techniques such as Network Address Translation (NAT) and Network Address Port Translation (NAPT) have been developed . They can offer certain level of protection against some of the security threats addressed above. Also, the introduction of IPSec facilitated the use of encryption communication, although its implementation is optional and continues to be the sole responsibility of the end nodes.

The Network Working Group of the Internet Engineering Task Force (IETF) proposed in 1998 a new suite of protocols called the Internet Protocol version 6 (IPv6) to deal with the limitations of the current Internet infrastructure . This new suite of protocols aims to deal with a number of the issues that affect IPv4-based networks, including its lack of network level security.

Podcast/Blog: 8 Deciding Factors in Selecting Disk and Folder Encryption Products

Background

Listen to the podcast (.mp3).

A new report filed by federal security auditors finds that that the Internal Revenue Service (IRS) has had almost 500 laptop computers lost or stolen over the last three years, many of which were loaded with sensitive taxpayer information. The report contends that between 2003 and 2006 the IRS had some 490 laptops lost or stolen in 387 individual incidents.

Perhaps the most notorious loss of a laptop in the federal sector came in May 2006 when a contractor working with the Department of Veterans Affairs had a computer stolen from his that carried the personal data of an estimated 26.5 million people. The laptop was eventually recovered by law enforcement officials.

In addition to failing to properly secure their devices in and out of the office, the auditors said that some of the IRS' 100,000 employees were not properly encrypting data on their machines or utilizing adequate password protections.

In their final recommendations, the auditors recommend that IRS leaders refine their incident response procedures to ensure for better understanding of any potential data exposure and more frequently remind employees to use proper device security measures. The report also contends that the agency should consider implementing a "systemic disk encryption solution" on its laptops that does not rely on employee interaction to protect sensitive information.

Systemic Disk Encryption Solution

Security mechanisms to consider when evaluating the right disk encryption solution could be expressed as follows:

Policy: Which policies and certifications are required by the organization

Information architecture: Where sensitive information is stored

Application architecture: How the application uses information

Communication: How the devices communicates

Device Management: How the device is managed

Primary use of the device: An office automation tool, industrial purposes, or mobile communication

Selection Criteria

Given the recent high profile announcements with regards to the loss of laptops and the associated liabilities to organizations that fail to take the appropriate steps with regards to addressing mobile devices vulnerabilities, I decided to take a look at Full Disk and Folder Encryption products that are commercially available today that help mitigate mobile device vulnerabilities.

The factors contained in the following table should help you in going through the process of selecting disk and folder encryption products:

Area of Comparison	Full Disk Encryption	Folder Encryption
Encrypts the entire disk	The entire disk is encrypted	Only selected files and folders are encrypted
Impact on the computer system	MBR is modified	Operating system files are excluded
Platform support	Generally limited to single desktops and mobile computer systems	May not be used on most systems
Authentication options	Limited to drivers available at pre-boot.  Vendors are expanding the capabilities to include network connectivity	Generally, any authentication mechanism supported by the operating system
Multiple user authentications	Authentication required at pre-boot Authentication maybe be synchronized or linked to network authentication	May require authentication on file access can be linked to the operating system or network authentication
System maintenance	Reboots during patching may be a problem	No issues during maintenance
Backups	Information is generally not encrypted if the backup runs within the operating system	Information may be encrypted or not depending on how backups perform
User control	User makes no determination as to whether to encrypt a file or not	User may have control over which files are encrypted.  New policy-based products transfer encryption decisions to administrator

Smart Card Blog - Multiple Profiles Part II

As a number of readers have pointed out, supporting concurrent access to multiple cards would be another way to avoid requiring customers to swap cards in order to sign in using a different profile.

As much as I wish this approach could be pursued, I think it would be problematic.

Concurrent access is not common industry practice and (perhaps most troublesome of all) changes in the application software code may be required to concurrently access multiple cards from a given process. This is b/c such access would have to be segregated into different threads, and application software is currently single–threaded.

The Top PKI-Specific Criteria When Selecting HSM Solutions.

The selection criteria for the HSM within the context of PKI implementations, can be broadly grouped into the following categories: Operational Quality, Scalability, Functionality and Vendor Health.  A description of the selection criteria follows:

Operational Quality: 

Resiliency & reliability: The large capacity HSM customers will expect months of continuous operations and the ability to deploy resilient configurations of HSM(s) where a single HSM failure does not result in an application failure. 

Product lifecycle: Selected HSM(s) should have a product lifecycle compatible with your organization’ needs with the actual lifecycle dependent on the cost of acquiring, distributing and upgrading the customer premises technology.

Durability: Customers should be able to subject HSM to continuous duty cycle for extended periods each day.

Operational support: Vendors should be able to provide service level agreements in line with your 24x7 support model. The large capacity HSM(s) should provide the necessary audit and trace information to enable effective helpdesk & operational support procedures.

Scalability:

Performance: A small capacity HSM supporting 0.25 TPS and a large capacity HSM supporting 40+ TPS. 

Capacity: The large capacity HSM needs to support storage of multiple PKI identities.

Scalable footprint: The large capacity HSM(s) should be able to scale both vertically and horizontally

Functionality:

PKI support: HSM must offer the following security features - 2048-bit (the expected key length size necessary for proper security of PKI) key pair generation, private key storage, and private cryptographic operations. The HSM must be compatible with the Public-Key Cryptography Standards #11 (PKCS#11) standard and certified for usage with Entrust PKI software.

Security level: Vendors that verify their security implementations by subjecting them to government and industry driven security validation programs are preferred. Compatibility with FIPS level-2 or higher is required.

OS certification: Vendors should be capable of certifying their products on your supported Operating Systems. 

Connectivity: Large capacity HSM(s) should be LAN connected and multi-server shareable. The small capacity HSM(s) should allow for USB connectivity.   

Vendor Health & Focus:

Vendor size: Large publicly held vendors are preferred as they would have substantial resources to support our needs and it is easier to monitor their financial health. 

Existing relationship: Vendors with existing relationship are preferred as the organization already has worked out commercial and legal contract terms and conditions with them and has experience working with them.

Mission-critical deployments: Vendors with mission critical customer deployments are preferred.

Status as a ‘top account’: Any new commercial technology needs to be supported by a strong vendor relationship.  Being a top account gives us sufficient leverage to ensure timely resolution of problems.

What are the PKI specific benefits of using Hardware Security Modules (HSM)?

A hardware security module (HSM) is a device that provides a secure and dedicated environment for performing cryptographic operations thus reducing the likelihood of secret key material being compromised as well as improving cryptographic processing performance. Here we try to address the secret key protection aspect of using HSMs.

Confidential electronic keys, such as those used by the PKI private key are critical to application security.  If their confidentiality is compromised, a fraudulent message purporting to be from a legitimate user can be sent to another user.  The receiver of such a message may not be able to detect this fraud, because the signature appended to the message would appear to be valid.  Accordingly, it is critical that confidential keys be adequately protected.

The first step to protecting confidential keys is to have good controls on access to environments where the keys are created and where they reside.  For additional protection, one approach is to employ various software techniques to secure the keys on the host computer where the keys reside, and where they are used for cryptographic operations.  Typically, the keys are encrypted on disk, and memory protection measures are employed to protect the key during cryptographic operations.  Additionally, encryption and other measures can be used to protect keys when they need to be transported to another host computer.

Although software-based approaches can offer significant additional protection, an even greater level of security is possible by employing hardware devices, such as HSMs, that are specifically designed to protect confidential electronic keys.  Typically, these devices are used to safe-store keys.  The keys are created in these devices and cryptographic operations performed with these keys can be carried out within these devices, thus making sure that the keys never need to leave the hardware.  Various physical and logical security features of these devices further minimize the risk of key compromise. 

If a user’s private key were only protected by a software-based approach, a successful attack could occur if there were co-ordinated security breaches at two customer institutions or two branches of an institution.  Such an attack would be relatively difficult but not impossible. Use of an HSM instead of software-based protection would likely make this attack more difficult since it is harder to steal HSM private key information without being detected.

How to make sense of your hardware-assisted cryptographic needs.

A hardware security module (HSM) is a device that provides a secure and dedicated environment for performing cryptographic operations thus reducing the likelihood of secret key material being compromised as well as improving cryptographic processing performance.

Cryptographic devices can be divided in two categories: smart cards/tokens and Box HSM(s). Smart cards/tokens are slow but are cost-effective and easy to administer. Box HSM(s) offer performance and security benefits, but are relatively more expensive and complex to administer than smart cards.

Both Box HSM(s) and smart cards offer improved security over software implementations but choosing one or the other will require customers to balance security, cost, performance, and administrative overhead.

nCipher and SafeNet are the market leaders in the Box HSM segment due to their incumbent status, size, and technical fit. Other Box HSM vendors are either small private companies, or niche players in this market like IBM.

In the smart card space there are vendors, like Axalto, Gemplus, Oberthur, etc., that produce smart cards for varied applications (like mobile telephony, credit-cards, national identity cards, etc) and niche vendors, like SafeNet, that specialize in cards and tokens for user identification. Vendors generally use standard chips from manufacturers like Philips, Infineon, STMicroelectronics, etc, so product differentiation is hard to sustain.

FIPS 140 certification is widely used for selecting HSM products, since FIPS 140 is an industry standard for assessing the security of HSMs.

How to translate regulatory compliance into plain old IT security practices

At the heart of most regulations (SOX, GLBA, HIPAA, PCI, etc) is the intention of protecting the confidentiality, integrity, and availability of information that impacts a corporation's stakeholders. These laws can be distilled down to their essential goals:

• Establish and implement controls
• Maintain, protect, and assess compliance issues
• Identify and remediate vulnerabilities and deviations
• Provide reporting that can prove your organization's compliance

Let's explore the available best practices that can help IT professionals who have been charged by the CEO, CFO and Audit Committee with making the comany compliant. These best practices can be divided into one of two orientations: process or technology.

• CobiT, Process Control and Managment, a process standard for PCAOB
• COSO, Process Enterprise Risk Managent, Used by PCAOB as guide for SOX
• ITIL, IT Service Process, Detailed process-oriented approach to IT services managment
• ISO 17799, Technology, Provides guidance on creating an IT security Program
• NIST SP 800 Series, Detailed IT security implementations adoped by FISMA and FIPS

If your enterprise is embroiled in SOX compliance issues, the best approach would be to use a combination of CobiT and ISO 17799. If your organization is a financial services enterprise trying to meet the requirements of BSA/AML, USA PATRIOT Act, and GLBA, a best approach would be to use ISO 17799 since the FFIEC audit criteria align most closely with it. If your company is working to comply with HIPAA, a blended approach would be the best, with elements of ISO 17799 and the direct requirements of the HIPAA Final Rule from the U.S. Office of Health and Human Services.

If you're not an expert yourself, it isn't easy to figure out which best practice is right for you. That's where IT Security and Compliance specialists can help, by providing you with the least costly method for compliance. The cost reductions come from a deep understanding of all components of all best practices and how they match the requirements of the law or regulation you must comply with.

What is the Sarbanes-Oxley Act?

Among the most critical laws impacting public corporations passed in years is the Sarbanes-Oxley Act of 2002 — referred to as SOA throughout this paper — enacted on July 30, 2002 and signed into law by President George  W. Bush. SOA was created by Congress in the wake of the major corporate accounting scandals that occurred in 2001 and 2002, notably Enron & Tyco, in an effort to restore investor confidence and to improve corporate governance and financial ransparency.

There are many elements to SOA, including sections that were intended to enhance and tighten financial disclosures, improve “whistle-blower” processes and the well-known requirement for the corporation’s financial statements to be certified by the CEO and CFO. Very importantly, SOA also creates and expands on existing criminal penalties for misrepresentations. No longer will “I didn’t know” provide any legal protection for management.