Securing Web Applications

18/08/2014

Securing Web Applications

Mark Garratt

15/04/2023 © Copyright 2014 - Cyber-Duck Ltd.

2

Introduction

• Was: UH Student - Graduated 2012• Now: Full Stack Developer at Cyber-Duck• Things I do:

– Programmer: PHP, MySQL, Node.js (JavaScript), MongoDB, HTML/CSS etc.

– System Administrator: Linux server management– Security Tester: Reviewing and testing web apps

• Things I use:– TDD / BDD– Continuous Integration (Jenkins/Travis)– Vagrant + Docker


3

Knowledge Transfer Partnerships

“A relationship formed between a company and an academic institution ('Knowledge Base' partner), which facilitates the transfer of knowledge, technology and skills to which the company partner

currently has no access. Each partnership employs one or more recently qualified people (known as an Associate) to work in a

company on a project of strategic importance to the business, whilst also being supervised by the Knowledge Base Partner.

Projects vary in length between 12 and 36 months. The Associates are either postgraduate researchers, university graduates, or individuals qualified to at least NVQ (Level 4) or equivalent.”

WHEN YOU GRADUATE APPLY FOR THESE


4

This talk…

• A bit about Cyber-Duck• Some example projects• Why security is important• Security testing process


5

About Cyber-Duck


6

Our Clients


7

Why bother securing web apps?

• The data we store:– Personal data– Payment data– Business critical data– Copyright material

• Compliance with the law and standards– Data Protection Act 1988– Copyright / Trademark law– PCI / DSS Compliance– ISO27k series


8

Losing data has consequences

• Breach of contract• Can result in legal proceedings

– Data Protection– Financial Regulations

• Lasting damage to reputation


9

How to protect data

• Training and Awareness• Regular security reviews

– Evaluate Risks– Define Policies– Implement Controls– Test– Repeat (automate where possible)

• Secure programming practices– Sanitise inputs– Avoid unsafe functions e.g. eval()– OWASP Secure Coding Practices


10

Amateurs hack systems, professionals hack people. — Bruce Schneier“

”


11

Identifying Vulnerabilities

• Static review– Read code– Observe practices

• Automated testing• Penetration testing


12

Penetration Test – Ethical Hacking

Attacking your own or a client’s systems (with proper permission).

1. Pre-Engagement Interactions2. Intelligence Gathering3. Threat Modelling4. Vulnerability Analysis5. Exploitation6. Post Exploitation7. Reporting (Executive Summary)8. Reporting (Technical Summary)


13

Hacking is not this…


14

1. Pre-Engagement Interactions

• Scoping• Goals• Testing Terms and Definitions• Establishing Lines of Communication• Rules of Engagement• Capabilities and Technologies Implemented• Protect Yourself


15

2. Intelligence Gathering

• Target Selection• Open Source Intelligence (OSINT)• Covert Gathering• Human Intelligence (HUMINT)• Foot-printing• Identify Protection Mechanisms


16

3. Threat Modelling

• Business Asset Analysis• Business Process Analysis• Threat Agents/Community Analysis• Threat Capability Analysis• Analyse Available Compromise Data


17

4. Vulnerability Analysis

• Testing• Validation• Research


18

5. Exploitation

• Detect countermeasures• Evasion techniques• Precision strikes• Tailored Expolits• Zero-day attacks


19

6. Post Exploitation

• Infrastructure Analysis• High Value/Profile Targets• Pillaging• Persistence• Further Penetration Testing Into Infrastructure• Clean-up


20

7. Reporting (Executive Summary)

• Background• Overall Posture• Risk/Ranking• General Findings• Strategic Roadmap• Recommendations


21

8. Reporting (Technical Report)

• Introduction• Information Gathering Intelligence• Vulnerability Assessment• Exploitation/Vulnerability Validation• Risk/Exposure• Conclusion


22

Questions?

Contact

Mark [email protected]

@MGarratt88http://www.cyber-duck.co.uk

Internet

Securing Web Applications