10 immuntable laws of security

If a bad guy can persuade you to run his program on your computer, it’s not your computer anymore.
If a bad guy can alter the operating system on your computer, it’s not your computer anymore.
If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.
If you allow a bad guy to upload programs to your website, it’s not your website any more.
Weak passwords trump strong security.
A computer is only as secure as the administrator is trustworthy.
Encrypted data is only as secure as the decryption key.
An out of date virus scanner is only marginally better than no virus scanner at all.
Absolute anonymity isn’t practical, in real life or on the Web.
Technology is not a panacea.

Cost of data breach

about $150 per record. or 3.86 million per US company

Costs include:

Notifying affected customers
Hiring forensic experts
Additional call centers
Providing credit monitoring services to those affected
Internal investigations
Lost customers
Lost reputation
Public relations

The costs vary significantly from county to country:

Differences in privacy related laws.
Costs relating to notifying affected customers vary widely.
Some countries have additional penalties for breaches involving medical records and data relating to minors.
Some countries/regions experience more destructive attacks.

Other interesting points made in the report:

Average time to to discover a breach was 207 days.
Average time to contain a breach was 73 days.
80% of breaches exposed customer’s PII (Personally Identiable Information).
A company has a ~30% chance of having a serious data breach within the next 2 years (based on 2019 report).
The per-record cost increases with the number of records breached

CWE/SANS

CWE - Common Weakness Enumeration. A community developed list of software security flaw, and details on how to avoid them. SANS - (SysAdmin, Audit, Network, Security) Institute. A research and education institute for security practitioners. MITRE - A not-for-profit research organisation that works with the US government.

Top 25 errors

Out-of-bounds Write **
Cross-site Scripting (XSS) **
Out-of-bounds Read **
Improper Input Validation **
OS Command Injection **
SQL Injection **
Use After Free **
Path Traversal **
Cross-Site Request Forgery (CSRF) **
Unrestricted Upload **
Missing Authentication *
Integer Overflow
Deserialization of Untrusted Data **
Improper Authentication *
NULL Pointer Dereference **
Use of Hard-coded Credentials
Buffer overflow **
Missing Authorization *
Incorrect Default Permissions *
Exposure of Sensitive Information **
Insufficiently Protected Credentials
Incorrect Permission Assignment *
Improper Restriction of XML External Entity Reference
Server-Side Request Forgery
Command Injection **

**. covered in this lecture *. Covered in other lectures

OWASP top 10 errors

Injection
Broken Authentication
Sensitive Data Exposure
XML External Entities (XXE)
Broken Access Control
Security Misconfiguration
Cross-Site Scripting (XSS)
Insecure Deserialization
Using Components with Known Vulnerabilities 1
Insufficient Logging & Monitoring

Software development is not a core competency

A ‘core competency’ is an area that an organisation has extensive skill and experience in.
- Usually something that contributes directly to the organisation’s revenue stream, and that they consider to be a competitive advantage.
Unless the organisation is actually a software development business (or similar) then they probably lack the necessary skills and experience to manage a development project.
- Often massively underestimating the costs and complexity.
  - Ideally they will contract the development to a reputable software development company.
  - Too often this is not the case.

Layers of abstraction

Transistors
Logic gates
Arithmetic circuits
Arithmetic logic units (ALU)
Instruction set architectures (ISA)
Machine code
Compilers
Programming languages
OS kernels and drivers
System APIs
Programming language APIs
Library APIs
Application APIs
Applications

It is very likely that there are security flaws in lower layers before we even start writing code

Deficiencies in programming languages

some of these flaws are due to issue with programming languages. e.g.,

buffer overflow (1, 3, 17)
use after free (7)

Ideally the compiler or runtime should be able to detect these and throw an error. Some languages, like C and C++ dont. This is why some experts reccomend that they shuold no longer be used for systems and server programming

Injection flaws

SQL injection

a user provides malicious data which gets executed due to poorly constructed code.
fix by using prepared statements(java) or equivalent
use input sanitation libraries

command injection

cross site scripting

second order attack - inject redirect as data will be displayed on other users webpages

session id is as good as username and passoword

5.6 KiB Raw Blame History Unescape Escape