24 April 2015

Non-repudiation

Posts relating to the information security principle "Non-repudiation" are listed below.

24 April 2015

AppSensor CISO Briefing

Following the release of the Introduction for Developers in February, the OWASP AppSensor team has now created and published a new document aimed at Chief Information Security Officers (CISOs) and others with similar responsibilities.

Cover of the 'AppSensor CISO Briefing'

The CISO Briefing is a high-level overview, with pointers to the more detailed resources for specifiers, architects, developers and operators.

The document's content was partially taken from the introductory sections of the AppSensor Guide and the AppSensor Microsite. This was then edited and changed by myself, John Melton and Louis Nadeau.

I incorporated several quotations from industry analysts, reports and standards to help set the context in the current security environment. The quotations are all publicly available but are mostly not OWASP AppSensor specific — instead they illustrate current trends and concerns about attack visibility, real-time detection, the need for automation, runtime application self-protection (RASP), and active defences.

The 12 pages comprise the following:

  • Defending Software Applications
  • Detect and Respond to Attacks From Within the Application
  • Benefits For Organizations and Users
    • Lower information security risk
    • Improved compliance
    • Reduced impact of attacks and breaches
    • Increased system survivability
  • Enterprise Ready
    • Extremely low false positives
    • Intelligence driven security
    • Low system resource overhead
    • Machine-speed response
  • Next Steps
  • Additional AppSensor Resources
  • About OWASP.

The CISO Briefing can be downloaded free of charge as a PDF, or purchased at cost in hardcopy from Lulu.com. There will also be some copies available during the CISO track at the AppSec EU conference in May.

Posted on: 24 April 2015 at 08:54 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

21 April 2015

Data Breach Investigations Report 2015

The Verizon annual Data Breach Investigations Report was published last week.

Partial view of Figure 43 from the Verizon 'Data Breach Investigation Report' showing the SANS critical security controls mapped to incident event chains

The Data Breach Investigations Report (DBIR) summarises findings from the collection and analysis of almost 80,000 security incidents relating to over 2,000 confirmed data breaches, sourced from 70 contributing organisations.

A breakdown by industry sector is provided. The 2015 DBIR incident and breach information collection processes have no substantial changes from the 2014 DBIR, focusing on security events resulting in confirmed data disclosure, as well as other security incidents such as denial-of-service attacks, and compromises of systems without data loss. The report re-iterates that it only represents a sample of events — the results are only representative of the sources of information contributed.

An analysis of the threat actions illustrates that the proportion of actions involving RAM scraping is growing, spyware/keylogger is falling and both credentials and phishing are broadly similar.

There is plenty of interesting data on breach discovery, phishing, patching, malware, industry profiles and impacts. The discussions on the problems with threat intelligence and the limited impact of mobile device compromise are insightful.

Nine common incident classification patterns are used to summarise the findings, including "web application attacks", accounting for 9.4% of incidents. Almost all the attacks in this category were opportunistic in nature, with information, financial services, and public entities being particularly affected. Use of stolen credentials are the most common action involved.

The last figure in the report (illustrated above) is a mapping from the recommended SANS Critical Security Controls to incident event chains. Although this only relates to Verizon's own source data, and not any of the other contributors, it illustrates that many basic security measures can help protect against the most common attacks. These include two-factor authentication, patching web services, verifying the need for internet-facing devices, proxying outbound traffic and web application testing.

Posted on: 21 April 2015 at 10:49 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

31 March 2015

Participate in the OWASP Project Summit in Amsterdam

The Open Web Application Security Project (OWASP) is supporting a project summit during the two days prior to the main AppSec EU conference.

Photograph of a sign mounted on a door in Amsterdam which reads in Dutch and English 'Denk aan de buren a.u.b. - Please mind the neighbours'

A project summit on Tuesday 19th and Wednesday 20th May has been announced and information published on the AppSec EU 2015 web site. The concept of the summit is to work on improving and extending project outputs with other volunteers, and as such requires active participation and contribution.

Across all the sessions there are a wide range of inputs needed including requirements specification, architecture review, coding, testing, documentation/wiki writing and review, user interface design, planning, graphical design, video creation and translation. Full details, timings and objectives of each session are provided on the summit's wiki pages.

There are many projects participating, including sessions for projects I am actively involved in. My own parts of the summit are

Tuesday 19th May

  • 10:30-12:00 hrs OWASP Codes of Conduct - Document Review
    The current Codes of Conduct were developed primarily during the last major OWASP Summit in Portugal. They cover: Government Bodies Educational Institutions Standards Groups Trade Organizations Certifying Bodies Development Organizations This 1.5 hour session will review, edit, update and release v1.2 of each document. Participants should be interested in how external entities can be encouraged to support OWASP's mission, read the existing Codes of Conduct in advance, and come with suggestions for changes. The session agenda is 1. Introduction; 2. Joint review and edit (15 mins each document); 3. Publish updated documents to wiki (PDF and Word).
  • 13:00-15:00 hrs OWASP AppSensor (Documentation) - Guide Review
    The AppSensor Guide v2 was published in May last year, and has had two minor updates, the last one mainly due to the important release of the v2 code implementation. This session is to edit and improve the guide, since many of the chapters have not been fully reviewed. Participants should read a chapter or two in advance of the summit (chapter 5 onwards, but choose randomly/what is of interest) and bring their edits/comments to the session, where the guide will be updated. All participants will be acknowledged in the guide and on the project wiki page. The session agenda is 1. Briefing; 2. Live editing; 3. Publication updated PDF.
  • 15:30-16:30 hrs OWASP Snakes and Ladders - Dutch Translation
    OWASP Snakes and Ladders (web applications) has been translated into 5 other languages already, and Portuguese is in progress. But so far not Dutch. This rapid session will ask participants to translate the 900 words or so into Dutch, so that a PDF and Adobe Illustrator version can be created. It will also be possible to help remotely, as it will be set up on Crowdin. The session agenda is 1. Meet; 2.Translate; 3. Create Illustrator and PDF output; 4. Publish.

Wednesday 20th May

  • 09:00-12:00 hrs OWASP Cornucopia - Ecommerce Website Edition - Video
    The objective is to create a short "how to play the Cornucopia card game" video during this half-day session. Cornucopia is a card game that helps identify security requirements, but people may not be familiar with how easy it is to get started. Participants for this session are needed to be players, to create a narrative, to video the game being played, and if there is time and anyone has the skill, to edit the video and sound into a release version. It is preferable if participants are already a little familiar with the game and/or threat modelling. If there is time, we will also discuss alternative game strategies like a Jeopardy format. The session agenda is 1. Storyboarding; 2. Game play recording; 3. Editing; 4. Soundtrack; 5. Publish video.
  • 13:30-17:00 hrs OWASP AppSensor (Code) - Dashboard
    The AppSensor v2.0.0 code implementation final release was undertaken in January. One of the tasks to continue with is the development of a reporting dashboard. This session is to brainstorm ideas and layouts for the dashboard, and identify what tools/libraries can assist in the creation of the dashboard. Bring ideas, energy, URLs, paper and pens! The outputs will be dashboard mockups. The session agenda is 1. Introductions and objectives; 2. Information requirements; 3. User stories; 4. Information design; 5. Code libraries and frameworks.
  • 17:00-18:00 hrs OWASP Automation Threats to Web Applications - Website Owner Experiences
    The OWASP Automation Threats to Web Applications Project is undertaking research and will publish its outputs immediately prior to AppSec EU 2015. This meeting seeks input from training and conference attendees on their own organisations' experiences of automated attacks: What types of automated attacks occur and with what frequency? What were the symptoms? How are they detected? What incident response measures were taken? What steps were undertaken to prevent or mitigate such attacks? Participation/contribution can be anonymous or otherwise. The intention is to update the published documents during the session and if possible create additional sector-specific guidance.

Registration

Attendance at the project summit is free, but everyone is a participant to help achieve the objectives. Please register to let the team know who will be attending. Join as many or as few of the sessions as you like.

The summit is co-loacted at the Amsterdam RAI as the chargeable training courses running on the same days. Why not sign up for those and the conference at the same time?

I look forward to seeing some of you there.

Posted on: 31 March 2015 at 13:52 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

10 March 2015

Web Site Oops Roundup

Some news stories about web site security incidents caught my eye in the last week.

Photograph of a sign reading

These events outline some disappointing behaviour:

Not on your systems I hope!

Posted on: 10 March 2015 at 08:15 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

06 March 2015

Introduction to AppSensor for Developers

Following the recent v2.0 code release and promotion to flagship status there has been increased interest in the OWASP AppSensor Project concerning application-specific real-time attack detection and response.

Front page of the new 'AppSensor Introduction for Developers'

During the OWASP podcast interview with project co-leader John Melton, the idea of creating briefings for target groups was discussed by podcast host Mark Miller. I am pleased to say that thought rolled onto the project's mailing list, and John Melton rapidly wrote and published the text copy.

I took that copy and additional suggestions by Louis Nadeau to design a two-page briefing document. This is available to download from the OWASP web site:

Please circulate this to software developers. The text is also available on CrowdIn if anyone would like to volunteer to translate the briefing, or the guide for that matter, into other languages..

We also plan to create a short guide for Chief Information Security Officers (CISOs), with content drawn primarily from the first few chapters of the existing AppSensor Guide v2.0.

Posted on: 06 March 2015 at 10:21 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

03 March 2015

User Interface Modifications to Combat Buyer Fraud

A paper published for the 2015 Network and Distributed System Security (NDSS) Symposium in February describes user interface modification techniques to address liar buyer fraud, and the results of experiments assessing the potential for these to reduce ecommerce fraud losses.

Title from the paper 'Liar Buyer Fraud, and How to Curb It' by Markus Jakobsson, Hossein Siadati and Mayank Dhiman

Liar Buyer Fraud, and How to Curb It authors Markus Jakobsson, Hossein Siadati and Mayank Dhiman describe "liar buyer" fraud, how traditional anti-fraud technology fails to curb this problem, and details the results of experiments of proposed alternative techniques to reduce the problem.

The authors explain that liar buyer fraudsters are generally not repeat fraudsters, but are otherwise honest people who are first-time offenders that act fraudulently as the result of temporary poor judgement. This manifests itself in claims that deliveries were not made. It is believed that at least a quarter, and as much as half, of direct fraud affecting some organisations is the result of liar buyer fraud.

The ideas considered by the authors for their research involve changes to the user interface that promote user honesty:

  1. Disclosure that the customer's computer/device has been recognised
  2. Disclosure of the customer's location (e.g. IP address, post code or location map)
  3. Production of statements by the delivery person
  4. Simplifying methods of goods return
  5. Forcing the customer to make a promise
  6. Attending to angry and upset customers carefully.

The research focused on the first two of these and found they have a significant reduction in customer's willingness to file false claims. The other options look promising and, perhaps with the exception of the third approach, could be undertaken by real-world retailers in A/B/N testing.

Posted on: 03 March 2015 at 07:48 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

27 February 2015

Register Today for OWASP AppSec EU 2015 in Amsterdam

The leading application security training and conference event is being held in Amsterdam from 19th to 22nd May 2015. Register today.

Photograph of houses overlooking boats on a canal in Amsterdam - the location for OWASP AppSec EU 2015

OWASP AppSec EU 2015 is being held in the Amsterdam RAI Convention Centre just a single train stop from both Schiphol Airport in one direction, and central station in the other.

AppSec EU 2015 comprises:

It looks like it will be a superb event. Thanks to the event team for their work to date.

And of course, there is everything else Amsterdam has to offer.

Registration is open, but the price increases on 1st March (this Sunday), and there is another higher charge for tickets bought at the door. Amsterdam RAI Hotel and Travel Service is the official accommodation partner of OWASP AppSec EU 2015. Lastly, there are still a few sponsorship packages available.

Posted on: 27 February 2015 at 09:32 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

24 February 2015

Report on an Evaluation of Application Security Assessment Vendors

Forrester Research published an evaluation of a dozen application security vendors in December.

Figure 1 Evaluated Vendors: Product Information from the The Forrester Wave Application Security, Q4 2014, listing Beyond Security, Checkmarx, Contrast Security, Coverity, HP Fortify, IBM, Qualys, Quotium, Trend Micro, Veracode, Virtual Forge and WhiteHat Security

The researchers reviewed the market to identify application security assessment vendors that offer multiple capabilities, provide easy deployment and integration, are used by other Forrester clients and have competitive offerings.

Their selection was Beyond Security, Checkmarx, Contrast Security, Coverity, HP Fortify, IBM, Qualys, Quotium, Trend Micro, Veracode, Virtual Forge and WhiteHat Security.

The vendors offer mixed approaches in static analysis (SAST), dynamic analysis (DAST), and instrumented/ interactive technologies (IAST) techniques in order to detect weaknesses and vulnerabilities in general code, web applications, mobile applications, and commercial off-the-shelf (COTS) products. Their current product offerings, strategy and size of market presence were compared.

The brief report is available for an eye-watering $2,495 if you are not an existing client of Forrester. Alternatively, you can request a free copy from either IBM or WhiteHat Security (business details required).

Posted on: 24 February 2015 at 08:05 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

20 February 2015

Two Factor Authentication for Many UK Domain Registrants

UK domain registry Nominet is offering increased identity authentication measures for access to its online services.

Partial screen capture of Nominet's online portal for authenticated registrants showing the domain listing that includes clerkendweller.co.uk and clerkendweller.uk

Nominet has enabled optional two-factor authentication (2FA) for online log in. Some organisations have had their web site availability affected by compromise of the domain name, rather than the application or host systems. If your company owns any domains administered by Nominet, you probably have at least one online account.

Nominet Online Services is a system that allows registrants to manage their domain name register entries, including transferring or cancelling a registration, notifying Nominet of a change of details, and moving a domain name to a new registrar. Check all the email addresses used across your domain portfolio, and log in or create accounts. Then enable 2FA. Ensure these credentials are managed by the company and not individuals, or third parties for that matter.

Nominet is responsible for:

  • Top level domains (TLD)
    • cymru
    • wales
    • uk
    • (but not .scot)
  • .uk second level domains (SLDs)
    • co.uk
    • ltd.uk
    • me.uk
    • net.uk
    • org.uk
    • plc.uk
  • .uk restricted
    • .nic.uk
    • .sch.uk

Nominet has also published a short guide to the process. You will also need to manage credentials in domain acquisition processes, employee starters and leavers processes, and in handling security incident events when a 2FA device is lost or stolen.

Of course, you should make sure the designated email accounts are also protected with strong passwords that are changed regularly, and also have two-factor authentication implemented themselves.

Posted on: 20 February 2015 at 13:10 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

20 February 2015

Software Assurance Maturity Model Practitioner Workshop

The OWASP Open Software Assurance Maturity Model (Open SAMM) team are holding a summit in Dublin at the end of March.

Extract from the Open Software Assurance Maturity Model (Open SAMM) document that describes the four business functions - governance, construction, verification, and deployment

As part of the two-day Open SAMM Summit 2015 a full day is being allocated to software assurance practitioners and those who want to learn about using the vendor-neutral and free Open SAMM to help measure, build and maintain security throughout the software development lifecycle.

Open SAMM helps organisations formulate and implement a strategy for software security that is tailored to the specific risks facing the organisation. The resources provided by SAMM assist:

  • Evaluating an organisation's existing software security practices
  • Building a balanced software security programme in well-defined iterations
  • Demonstrating concrete improvements to a security assurance program
  • Defining and measuring security-related activities within an organisation.

There seems to be plenty activity in the project. Keep up-to-date by following or joining the mailing list.

The users day, on Friday 27th March, is a combination of presentations, workshops and round-table discussions to help explain the approach, to make best use of a maturity model, to show how SAMM is being used by other companies, and to describe some upcoming project initiatives. The user day runs from 08:00 for 09:00 hrs through to 17:00 hrs, and is followed in the evening by an optional social event. Attendance is limited to the first 40 people who register and costs 150 EUR + VAT (21%). Travel, accommodation, subsistence at your own cost.

The following day, the SAMM project team, and any other volunteers who want to participate, will be working on creating outputs for the project.

The event is being held at The Gibson Hotel at Point Village Dublin 1, Ireland.

Posted on: 20 February 2015 at 09:59 hrs

Comments Comments (2) | Permalink | Send Send | Post to Twitter

More Entries

Non-repudiation Security Principle : Application Security and Privacy
https://www.clerkendweller.uk/Non-repudiation
ISO/IEC 18004:2006 QR code for https://clerkendweller.uk

Page https://www.clerkendweller.uk/Non-repudiation
Requested by 54.89.91.165 on Sunday, 26 April 2015 at 10:46 hrs (London date/time)

Please read our terms of use and obtain professional advice before undertaking any actions based on the opinions, suggestions and generic guidance presented here. Your organisation's situation will be unique and all practices and controls need to be assessed with consideration of your own business context.

Terms of use https://www.clerkendweller.uk/page/terms
Privacy statement https://www.clerkendweller.uk/page/privacy
© 2008-2015 clerkendweller.uk