Feeds

Time to dismount the hamster security wheel of pain

Quit patching, build a library

SANS - Survey on application security programs

Enterprises are spending a huge amount of effort scanning for vulnerabilities that they already know are in their applications. Here's a little secret: there's no point in scanning if you haven't at least tried to put in a basic set of defenses. You already know you're vulnerable.

So what kinds of defenses does the average web application need? Here's a good way to figure it out. Take a look at the common application security vulnerabilities and then list the security controls that developers need to prevent those holes.

You'll end up with a list that includes authentication, session management, access control, input validation, canonicalization, output encoding, parameterized interfaces, encryption, hashing, random numbers, logging and error handling.

It's not reasonable to expect developers to build a secure application without a decent set of security controls for them to use. So how can you make them available? Here's what you could and what you probably should do.

Build your own security controls in each application

This is a bad idea. Writing security controls is both time consuming and extremely prone to mistakes. MITRE's CWE project lists more than 600 different types of security mistakes you can make, and most of them are not at all obvious. Most people recognize developers should not build their own encryption mechanisms; the same argument applies to all the security controls.

Use security libraries directly

Another bad idea. There are plenty of libraries and frameworks out there that provide various security functions - Log4j, Java Cryptographic Extension (JCE), Java Authentication and Authorization Service (JAAS), Spring Security, and dozens more. Some of them are even pretty good at what they do. But there are several reasons why enterprise developers should not use them directly.

Most importantly, these libraries are too powerful. Most developers need just a very limited set of security functions and don't require a complex interface. Further, many of these libraries contain security holes themselves - such as encoding libraries that don't canonicalize or authentication libraries that don't use strong cryptographic functions. Many security controls use features from other controls, and using security libraries that aren't integrated is a problem waiting to happen.

Establish an organization-wide standard security API

Now you're talking. Organizations that have institutionalized a standard application security control tend to have less vulnerabilities. And organizations that have standardized on a cryptographic library, and especially the ones that have wrapped that library in a standard encryption component, have significantly less problems in building and securing applications.

3 Big data security analytics techniques

More from The Register

next story
OpenBSD founder wants to bin buggy OpenSSL library, launches fork
One Heartbleed vuln was too many for Theo de Raadt
Got Windows 8.1 Update yet? Get ready for YET ANOTHER ONE – rumor
Leaker claims big release due this fall as Microsoft herds us into the CLOUD
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Ubuntu 14.04 LTS: Great changes, but sssh don't mention the...
Why HELLO Amazon! You weren't here last time
Patch iOS, OS X now: PDFs, JPEGs, URLs, web pages can pwn your kit
Plus: iThings and desktops at risk of NEW SSL attack flaw
Next Windows obsolescence panic is 450 days from … NOW!
The clock is ticking louder for Windows Server 2003 R2 users
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Apple inaugurates free OS X beta program for world+dog
Prerelease software now open to anyone, not just developers – as long as you keep quiet
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.