BUILDING A SECURE STANDARD L IBRARY

Information Assurance Project IMN121051 Tajuddin hj. Tappe

Supervisor

Mdm. Rasimah Che Mohd Yusoff

ASP.NET TECHNOLOGY DEVELOPMENTF

OR

INTRODUCTION

Resource: OWASP Top 10 – 2013, The Ten Most Critical Web Application Security Risks

DEMO: SQL INJECTION

SECURE STANDARD LIBRARY

Library - is a pre-compiled code file (with extension .dll) that contains code and data that can be used by more than one program or application. By using a DLL file, a program can be modularized into separate components. Additionally, updates are easier to apply to each module without affecting other parts of the program (Microsoft, 2007).

Standard - means providing requirements, specifications, guidelines or characteristics that can be used consistently to ensure that processes and services are fit (www.iso.org/iso/home/standards.htm) is used because the proposed library will provide built-in functionalities as a standard for the purpose of the implementation to secure coding practices.

Secure - With the standard that will be implemented within the library, it also will take concern about validating data and input so that the process will be implemented in a secure manner.

WHY NEED TO EMPHASIZE ON SECURE CODING PRACTICES AND

STANDARDIZATION?1. Web application security is fundamentally

different than host or network security, and requires a different approach.

2. Custom code creates custom vulnerabilities.

3. Developers are not exactly the same with Security Experts.

4. Web Application Firewalls (WAF) are effective against known threats, but sometime they are less capable of discovering new issues or handling questionable use cases.

PROJECT AIMTo ident i fy the most common funct iona l i t ies that a lways be ing used by most deve lopers in an app l i cat ion pro ject deve lopment

Develop a c lass l ibrary that wi l l have a standard which wi l l provide the ident ifi ed common funct ional i t ies

Prov ided w i th secu re cod ing p rac t i ces , e spec ia l l y to encoun te r the mos t h ighes t i den t ifi ed a t tack such as SQL in jec t i on , C ross - s i te sc r ip t ing (XSS ) , e tc . wh i ch mos t l y w i l l be based on OWASP top ten mos t c r i t i ca l web app l i ca t ion secu r i ty r i sks

RESEARCH QUESTIONS

The research questions are as below:

a) How an application can be exploited from their vulnerability which caused by the developer themself.

b) What are the common functionalities that usually required by most developer in their development environment.

RESEARCH OBJECTIVES

The objectives of this study are as below:

a) To identify the secure coding practices requirements within ASP.NET technologies development.

b) To identify suitable standards for common functionalities in development environment.

c) To develop a secure standard library for ASP.NET technology development with secure coding practices.

d) To test the developed library with any ASP.NET technology development.

RESEARCH SCOPE

a) The library will be available to be used by ASP.NET developer and environment, specifically by using C# or VB programming language. It also requires .NET Framework installed on the machine or server.

b) The library will be applicable for a new ASP.NET project development and there are lots of code modifications required for existing application which are already developed.

c) Most of secure coding practices are based on OWASP Secure Coding Practices Document, but it will not cover all of the implementations in the checklist.

RESEARCH METHODOLOGY:OPERATIONAL FRAMEWORK

Phase 1 - Initiating

Phase 2 - Modelling

Phase 3 - Designing

Phase 4 - Developing

Phase 5 - Testing

Phase 6 - Implementing

Phase 7 - Finalizing

EVALUATION

1. UML Documentation

2. Test cases for testing report

3. Report for the usage of the library

4. Final report thesis

EXPECTED OUTCOME:SAMPLE OF IMPLEMENTATION

COMMON PRACTICE…

USING PROPOSED LIBRARY…

CONCLUSION

Developers cannot prevent security flaws in their code unless they know the types of flaws that can occur. But organization still could not rely hundred percent to developer for ensuring their program is secure all the time since developer is responsible to focus on development of functional requirements.

Developers want to do the right thing, but they need to know what the right thing is. It could be the responsible for organization to help developers to specify within their policy or procedure, about what tools / techniques / libraries for developer can use in order to implement secure environment within their application project development.

With the implementation of this study, it might allow other future researchers to continue upgrading and keep implementing new practices and techniques about this kind of study with other possible technologies available such as PHP, Java, ColdFusion, etc. This could be a good platform worldwide in our continuous efforts to reduce possible attack vectors within web application.

END OF SLIDE. THANK YOU.