24 March 2015


Posts relating to the category tag "vulnerabilities" are listed below.

07 October 2014

OWASP Testing Guide v4

The OWASP Testing Guide team of volunteers has announced the publication of version 4 of the OWASP Testing Guide.

Partial view of the OWASP Testing Guide's contents showing the new formatting and typography

The creation of version 4 (PDF, HTML) lead by Andrew Muller and Matteo Meucci. The guide is the de-facto standard for performing web application penetration testing.

Following an initial overview, introduction and discussion of testing objectives, the testing guidance is structured in eleven main sections:

  • Information gathering
  • Configuration and deployment management testing
  • Identity management testing
  • Authentication testing
  • Authorization testing
  • Session management testing
  • Input validation testing
  • Testing for error handling
  • Testing for weak cryptography
  • Business logic testing
  • Client side testing.

The previous edition was a large step forward in the maturity of the testing guide, and this version 4 goes further. Congratulations to everyone involved.

If you are looking for what to test, and how to build a software security programme, see also these two other OWASP documents respectively:

All OWASP materials are free to download and use.

Posted on: 07 October 2014 at 18:00 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

16 September 2014

AppSensor 2x2x2

OWASP AppSensor co-project leader John Melton has published two further AppSensor v2 assets.

Screen capture of the AppSensor 2 web site showing the headings on the user guide section - instrument your application, test and deploy the system, monitor, and tweak as necessary

AppSensor defines how to implement application intrusion detection and automated response.

Website 2.0.0

John has designed, coded and written a new standalone website for AppSensor. It was published on Friday and includes a brief description of the concept, an overview, getting started information and a user guide for the reference implementation. In John's words, the objectives were to:

  • Explain the high level concept in a simple way and point people back to the project site and the book for more detail
  • Give developers a nice entry point to the project - modelled after other framework/library sites
  • Give us more flexibility in how we present the project (not just wiki format)
  • In the future, hoping to have live demos.

I think it succeeds on the first three of these, and I will help if I can with the final statement.

To provide feedback or to contribute, please use the project's general mailing list.

Code 2.0.0 beta

If the new website wasn't enough, John has also been putting in many hours of coding to finish developing the new standalone version AppSensor reference implementation. On Sunday he announced the beta release of version 2.0.0.

The reference implementation currently supports three execution modes:

  • REST web service
  • SOAP web service
  • Local (embedded Java).

John is hoping a final release can be arranged for October/November.

To provide feedback or to contribute, please use the project's code development mailing list.


So the AppSensor project now has a new guide, a new website, and will imminently have a final release of the version 2 code. I am thrilled. I will be highlighting this new code when I speak at the London API event tomorrow evening. If you are attending that, I will have some free printed copies of the AppSensor Guide with me — if you would like one, please ask me a question about AppSensor.

Posted on: 16 September 2014 at 07:58 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

23 July 2014

Cyber Security in the Utility, Energy and Manufacturing Sectors

The Ponemon Institute has published the results of a survey examining how utility, energy and manufacturing organisations are addressing cyber security threats.

Photograph showing people in one of the service tunnels under the Thames Barrier, London

Critical Infrastructure: Security Preparedness and Maturity draws from interviews with 599 global IT and IT security executives in 13 countries, with a third of the responses from Europe.

The report demonstrates that although there is a high level of awareness, the priority given to reducing cyber risk is low, with a resulting low level of IT security maturity. Regarding actual incidents and breaches, there seem to be a high proportion of, or at least awareness of, accidents/mistakes, with negligent insiders being the highest rated threat. I think I'd like to see data for each of utility, energy and manufacturing as I suspect there will be marked differences in the threats.

From a monitoring perspective it seems that "real-time alerts are not effective" and that "more than 80 percent are false positives".

I think that's a "could do better" report.

Posted on: 23 July 2014 at 19:41 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

15 July 2014

Dr-Ing Heiderich Visits OWASP in Edinburgh

Earlier this year when I spoke at OWASP East Scotland in Edinburgh, Dr.-Ing. Mario Heiderich was also scheduled to speak but his journey was cancelled due to industrial action.

Photograph of the screen on an RBS NCR ATM displaying, in white text on the blue background, 'RBS - Windows XP Professional Build - Build RNCR205 In progress - Phase 4a of 7 - DO NOT REBOOT'

His previous absence was a disappointment to everyone, but his visit has been rescheduled to this Thursday. He will be presenting on the same subject "The Inner HTML Apocalypse: How mXSS Attacks Change Everything we Believed so Far" . This will introduce and demonstrate a recent technique called mutation-XSS, showing there is still a lot to be discussed about XSS attacks, than just reflected, persistent and DOM based cross site scripting (XSS).

Dr.-Ing. Heiderich is a researcher at Ruhr University Bochum and the director of a security consultancy and penetration testing company, and not to be missed if you can get to Edinburgh on Thursday 17th July - 18:00 hrs for an 18:30 hrs start.

All OWASP chapter meetings are free to attend, but you need to register. The event is being held at Edinburgh University's Informatics Department, 8th Floor, Appleton Tower, 11 Crichton Street, Edinburgh EH8 9LE.

Posted on: 15 July 2014 at 07:33 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

11 July 2014

Application Security Testing Magic Quadrant 2014

While on the topic of magic quadrants, the 2014 magic quadrant for application testing vendor products has also been released.

Partial screen capture of the introductory text from the Gartner Application Security Testing Magic Quadrant report

The report examines application security testing (AST) products and services spanning:

  • Static AST (SAST) i.e. automated application source, byte or binary code scanning
  • Dynamic AST (DAST) i.e. runtime automated testing
  • Interactive AST (IAST) that combines elements of both SAST and DAST.

The report is available "free" after registration from many of the vendors named, and here for Gartner subscribers, where it can also be purchased for a mere $1,995.00.

Interesting findings, but not quite what i would expect from seeing some of these in use in real life.

Posted on: 11 July 2014 at 13:58 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

06 July 2014

Results from the Nominet Internet Awards 2014

Following my card game's shortlisting in the Nominet Internet Awards 2014, the awards ceremony was held in the London Film Museum on Thursday 3 July 2014.

Photograph of the welcome sign to the Nominet Internet Awards 2014

The location has a large collection of original James Bond vehicles which added to the glamour of the event. Unfortunately Cornucopia was not successful in the Making the Internet a Safer Place category, but congratulations to:

Thank you to the Nominet for a very well organised competition and evening, the judges, and to all the other winners and other shortlisted entries.

I will be attending the related reception at the Houses of Parliament on Wednesday.

Posted on: 06 July 2014 at 16:48 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

03 July 2014

Presentation Videos from AppSec EU 2014 in Cambridge

Last week I attended the excellent AppSec EU 2014, held at Anglia Ruskin University in Cambridge.

Photograph of bicycle racks outside Cambridge railway station

The whole conference team, the local OWASP Cambridge chapter, Anglia Ruskin staff and volunteers and OWASP volunteers, sponsors, trainers and delegates who all contributed to the delivery of a very professional event, in an ideal university venue. But thanks must given especially to conference chair Adrian Winckles and co-chair Justin Clarke.

Six tracks of live content were streamed directly from the conference's main rooms, providing some access for people unable to attend on the day.

Recordings of all the sessions are now available on the OWASP channel. The full schedule is published on the conference site. As there was so much going on simultaneously I have some of my own catching up to do.

Mark Miller's interviews during the week for the OWASP Podcast are also being published progressively.

Posted on: 03 July 2014 at 12:41 hrs

Comments Comments (1) | Permalink | Send Send | Post to Twitter

20 June 2014

CBEST Threat-Led Penetration Testing for UK Financial Services Sector

The Bank of England announced a cyber security penetration testing framework earlier this month.

Partial view of the CBEST logo on the cover of the open source  CBEST Implementation Guide

The CBEST threat intelligence-led cyber security testing framework for financial institutions was revealed by Andrew Gracie (Executive Director, Resolution, Bank of England) speaking at the British Bankers' Association Cyber Risk Conference on 10th June. The scheme is backed by accreditation standards for threat intelligence and penetration testing.

The framework was developed in conjunction with Her Majesty's Treasury, and the Financial Conduct Authority, vendor Digital Shadows and impartial vendor-led accreditation quango CREST. There are a good range of CBEST-related quotations on Bob's Guide, some comment at The Register, a short description on the Digital Shadows web site, and CREST also outlines the framework. CREST lists additional documents which can be obtained under a non disclosure agreement (NDA).

The following open source documents, licensed under the Creative Commons Attribution 4.0 International Licence, have been published on the Bank of England website:

The name CBEST does not appear to be an abbreviation or acronym of anything in particular, other than perhaps a simple modification of the word CREST.

Posted on: 20 June 2014 at 10:34 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

17 June 2014

Cornucopia Shortlisted for the Nominet Internet Awards 2014

In early May I submitted an entry for my OWASP Cornucopia project in the Nominet Internet Awards 2014. Nominet manage the .uk domain space, and want to celebrate the good things about the internet, how the UK is a safe place to be online, and initiatives from the UK that help support this.

Banner logo for the Nominet Internet Awards 2014 'Shortlisted'

Yesterday I heard Cornucopia had been shortlisted in the Making the Internet a Safer Place category for initiatives that are doing any of the following:

  • Combating criminal activity online
  • Improving online trust
  • Championing online safety
  • Developing security and safety tools online
  • Safe data storage.

Cornucopia is a card game for website developers which helps them derive software security requirements. The game's goal is to identify relevant threats and thus mitigations, but players are motivated by the desire to win (for each threat identified and each hand won). But at the same time they are learning about application security and helping to create a safer and more secure website or web application.

An image of some of the playing cards from OWASP Cornucopia - Ecommerce Website Edition showing the attack text, cross-referencing and suit names

The Cornucopia entry outlined:

  • How the initiative was designed to help make threat modelling more fun, and to make it very relevant to websites and web applications
  • That most breaches are caused by attacks targetting application software directly, and almost every business is responsible for custom software in the form of a website, whether it be a few informational pages, an e-commerce shop, or a business process portal
  • That these websites often have weaknesses in them that can lead to damage to individual users (e.g. malware), and the organisations that own them (e.g. data breach), undermining trust in the online environment
  • What Cornucopia set out to achieve and how it met its targets
  • Plans to develop Cornucopia further.

The judges in this category are Peter Wilson (Director & SIRO, NFA & Action Fraud, The Home Office) and Chi Onwurah MP (Shadow Cyber Security Minister). The full shortlist for all categories has been published.

The awards ceremony is taking place at the London Film Museum on 3 July 2014, with a reception in Parliament on the 9th July. Good luck to everyone, especially Cornucopia!

Posted on: 17 June 2014 at 07:23 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

03 June 2014

Personal Data Protection in Online Systems - Part 2/2 Security Controls

Yesterday I described the new report from the ICO, Protecting Personal Data in Online Services: Learning From the Mistakes of Others. Below is a list of the matching security controls for each issue mentioned in the report.

Examining the ICO report in greater detail, provides additional clues about the requirements expected in each class of vulnerability. The report "is not aimed at experienced security professionals", but rather at those responsible for the security of the online systems, and hopefully this list will be useful to those individuals.

My breakdown of the matching security controls, based on my interpretation of the report's text, are listed below.

Issue from ICO Security Report Derived Security Controls
Failure to keep software security up to date
  • Create and maintain a policy for software patching
  • Maintain a list of all software, including components (e.g. third-party libraries, frameworks), their versions, source and method of monitoring for security patches and other updates
  • Define who is responsible for the patching of each software component
  • Create, use and maintain a procedure for assessing security patches and other software updates, that includes a risk assessment
  • Apply software security patches in a timely manner
  • Do not use software that is no longer supported by the supplier/vendor/development company; or limit its use and undertake a risk assessment and apply additional controls
  • Create, maintain and operate a process for checking that security patches have been applied to all software components, or those that have not been applied have adequately justified, documented and applied mitigating controls
Lack of protection from SQL injection
  • Create and maintain a process for other people and organisations to report security issues about your applications
  • Create and maintain a procedure for assessing and fixing security flaws in custom application code, and include these issues in the software patching documentation (see above), and if SQL injection is found in one place, examine similar code elsewhere
  • Identify who is responsible for preventing SQL injection in each custom coded application (e.g. software such as websites developed by/for the organisation)
  • Require the default to be to use the safest server-side method for database queries supported by the API or framework
  • Ensure the prevention, detection and remediation of SQL injection vulnerabilities are included at multiple stages of the software development lifecycle (e.g. coding standards, peer/independent code review with audit trail, automated code review, automated vulnerability assessment, penetration testing before going live)
  • Use the software patching policy and processes (see above) for software components used by the custom applications
  • Include a requirement in contracts with third party development to build security into their development practices and inform you when they become aware critical vulnerabilities like SQL injection, and then provide patches
  • Use automated application vulnerability assessments (scanning) to help identify SQL injection, but ensure these cover all the application (e.g. for authenticated customers and administrators too)
  • Undertaking penetration testing in the production/live environment of custom-built applications (external and internal-facing) that interact with databases and other data stores, and repeat periodically
Exposure of unnecessary protocols & services
  • Do not use insecure protocols such as Telnet and plain FTP
  • Implement access control for all protocols (e.g for secure FTP disallowing anonymous access, preventing SMTP being used as an open relay)
  • Use firewalls to prevent external access to internal services
  • Remove, disable or block un-necessary services (see also decommissioning below)
  • Limit remote access to trusted IP addresses and enforce access using an encrypted method
  • Segment services so that a compromise of one does not lead to wider system compromise
  • Consider using a Virtual private Network (VPN) using strong credentials (such as two-factor authentication) for all remote access
  • Scan ports of all system components periodically to verify that only the intended services are available externally, internally, and from particular other locations
  • Document and periodically review all the services allowed
Exposure of decommissioned software/services
  • Maintain a schedule of all software/services in use
  • Ensure all system components (hardware, software, configuration files, databases, files, services, ports, DNS records, etc) are decommissioned when no longer needed, and maintain a record of how this was undertaken
  • Test/audit that decommissioned components no longer exist and cannot be accessed
  • For hardware disposal, ensure data is securely removed
Insecure storage of passwords
  • Create and maintain a password policy for all types of system users
  • Encourage, and allow, users to choose stronger passwords
  • Discourage users from having the same password on multiple systems
  • Discourage or prevent commonly used passwords
  • Never store or send passwords in plain text
  • Never encrypt passwords unless there are extremely robust key protection and key management processes in place
  • Use one-way hashing of passwords with a long salt value, unique for each user
  • Use a hashing method that is slow (e.g. PBKDF2, bcrypt or scrypt)
  • Do not use weak hashing methods such as MD5 or SHA-1
  • Review hashing best practice periodically, and build in considerations to allow future changes to the hashing method
  • Ensure password breaches are included in incident report planning
Failure to encrypt online communications
  • Identify and record all information that should be encrypted in transit
  • Ensure the encryption method (e.g. SSL/TLS) is configured correctly and that certificate are valid
  • Maintain a list of all certificates and ensure they are renewed before expiry
  • Consider using Extended Validation (EV) digital certificates to provide a higher level of identity assurance to users
  • Do not use SSL v2, and preferably enable TLS 1.2), disable weak ciphers (i.e.enable ciphers with 128 bi strength or greater) and avoid weak ciphers (e.g. RC4) or those that provide no encryption or no authentication i.e. null ciphers)
  • Ensure the information cannot be accessed without encryption
  • When web pages are sent over SSL/TLS, ensure every single component in the page (e.g. images, style sheets, scripts and third-party hosted content) is also sent over SSL/TLS
  • Never send session identifiers (e.g. cookies identifying an authenticated user) over unencrypted connections
  • Ensure SSL/TLS websites are only accessible by hostnames included in the certificate, and not by IP address)
  • Consider making websites completely "SSL/TLS only
  • Review transport encryption best practice periodically and update configurations as required
Processing data in inappropriate locations
  • Identify and maintain an inventory of all locations where personal data is stored, processed and transmitted
  • Do not allow unauthorised access (e.g. public access) to personal data
  • Do not use production data in development and test systems
  • Incorporate personal data access into systems design processes
  • Use network segmentation to assist with limiting access to personal data (e.g. segregate non production systems, segregate teams or departments with access to sensitive personal data)
  • Use redundancy/diversity to protect against accidental loss or destruction of, or damage to, personal data
  • Create and maintain policies for the storage, processing and transmission of personal data
  • Create, maintain and use procedures for transfers of personal data
  • Do not place copies of personal data in unprotected locations
  • Enforce appropriate access control in custom applications (e.g. websites)
  • Provide training about the access, use and transfers of personal data
  • Monitor transfers of personal data
Use of default credentials including passwords
  • Change all default passwords across all system components
  • Disable or remove guest and demonstration accounts
  • Use strong passwords to replace default ones (see above)
  • Avoid hard coding of access credentials (and never in software code), but use encryption if possible if necessary to store elsewhere (e.g. configuration files)

So, not such a short list. It is a combination of technical, administrative and physical controls, and not just applicable to online systems, but all electronic systems that store, process and transmit personal data, and generally regardless of whether it is sensitive personal data or not.

Posted on: 03 June 2014 at 07:48 hrs

Comments Comments (0) | Permalink | Send Send | Post to Twitter

More Entries

Vulnerabilities : Application Security and Privacy
ISO/IEC 18004:2006 QR code for https://clerkendweller.uk

Requested by on Sunday, 29 March 2015 at 23:24 hrs (London date/time)

Please read our terms of use and obtain professional advice before undertaking any actions based on the opinions, suggestions and generic guidance presented here. Your organisation's situation will be unique and all practices and controls need to be assessed with consideration of your own business context.

Terms of use https://www.clerkendweller.uk/page/terms
Privacy statement https://www.clerkendweller.uk/page/privacy
© 2008-2015 clerkendweller.uk