Posted: June 29th, 2022

OWASP Top 10 – A9:2017– Using Components with Known Vulnerabilities

Code Security – Issues and Best Practices

1

Outline

Intro to Code Security

Need for Code Security

Code Security Fundamentals

Code Security Issues

OWASP Top 10 – A4:2017– XML External Entities (XXE)

OWASP Top 10 – A8:2017– Insecure Deserialization

OWASP Top 10 – A9:2017– Using Components with Known Vulnerabilities

Attacks against Code Security Mechanisms

Code Security Best Practices

2

Intro to Code Security

3

What is Code?

Code refers to instructions issued to a computer that tells it which actions to perform and in what order

Code is made of strings of typed letters, numbers, and figures, which constitute a language complete with spelling rules and syntax

Code is used to do all sorts of activities including:

Building websites

Flying airplanes

Running NASA satellites

Making cars/cellphones/TVs/gaming consoles, etc. work

Intro to Code Security

Source: Indeed.com – How to Write Code in 6 Steps? –

https://www.indeed.com/career-advice/career-development/how-to-write-code

4

Code Types

Markup Languages – Use start tags (<>) and end tags () to represent different components

Examples:

HTML – Is the code that describes the structure and content of a web application

XML – Is code that is designed to store and transport data in both human– and machine–readable format

SAML – Is a framework for describing and exchanging security information between online business partners

Intro to Code Security (contd.)

5

Code Types (continued)

Scripting Languages – Used to write small programs that are usually interpreted at runtime by a runtime environment

Examples (client-side):

JavaScript – Is a cross-platform scripting language that can be embedded within web pages to create interactive documents

AJAX – Is a collection of technologies that allows web developers to improve the response times between web pages

Intro to Code Security (contd.)

Source: NIST SP 800-44 – Guidelines on Securing Public Web Servers –

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-44ver2.pdf

6

Code Types (continued)

Scripting Languages – Can also be used from server-side

Examples (server-side):

CGI – Is used to make web sites interact with databases and other applications

SSI – Is a limited scripting language supported by most web servers

ASP – Is used to create dynamic and interactive web applications for servers that serve “.asp” web pages using the .NET framework

PHP – Is used to create dynamic web pages that extract data from a database and present it on a web page

Intro to Code Security (contd.)

Source: NIST SP 800-44 – Guidelines on Securing Public Web Servers –

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-44ver2.pdf

7

Code Types (continued)

Programming Languages – Used to code the business logic behind the web applications

Examples:

Java – Is a cross-platform programming language that is secure, fast, powerful, open-source, and free

C# – Is an object-oriented programming language created by Microsoft that runs on the .NET framework

Python – Is an interpreted programming language used to create web applications that can be used to handle big data and perform complex math

Ruby – Is an open-source programming language with a focus on simplicity and productivity

Intro to Code Security (contd.)

8

Code Market Share:

Intro to Code Security (contd.)

Source: Programming Languages Market Share Report – Datanyze –

https://www.datanyze.com/market-share/programming-languages–67/

9

Secure Coding Concepts – Professor Messer

Intro to Code Security (contd.)

Source: Professor Messer – Secure Coding Concepts – CompTIA Security+ SY0-401: 4.1 –

10

Code security refers to “a set of technologies and best practices for making software as secure and stable as possible. It encompasses everything from encryption, certificates, and federated identity to recommendations for moving sensitive data, accessing a file system, and managing memory” (Red Hat, 2020)

As per Apple (2016), code security involves writing software that:

Is resistant to attack by malicious or mischievous people or programs

Stops an attacker from accessing and taking control of a server or a user’s computer resulting in denial of service, compromise of secrets, or damage to the systems of thousands of users

Protects a user’s data from theft or corruption

Is secure regardless of whether it is a small script or a commercial application

Intro to Code Security (contd.)

11

Need for Code Security

12

As per OWASP (2010):

It is much less expensive to build secure software than to correct security issues after the software package has been completed, not to mention the costs that may be associated with a security breach

Securing critical software resources is more important than ever as the focus of attackers has steadily moved toward the application layer

Failure to do secure coding can compromise:

The software and its associated information

The operating systems of the associated servers

The backend database

Other applications in a shared environment

Need for Code Security

13

As per Veracode (2020):

Code security analysis is a must for competitive enterprises

Most current threats are directed at the application layer

It is critical to search code for vulnerabilities such as backdoors and malicious code before hackers discover and exploit those vulnerabilities using a variety of attacks

Such code-targeted attacks on the enterprise can have severe consequences:

Reduce productivity

Tie up valuable organizational resources

Damage brand reputation

Cut into profits

Need for Code Security (contd.)

14

As per the Veracode (2019) State of Software Security Report, web applications coded in most common languages have at least 1 vulnerability:

Need for Code Security (contd.)

15

As per the Veracode (2019) State of Software Security Report, the flaw intensity vs flaw prevalence are:

Need for Code Security (contd.)

16

As per the Veracode (2019) State of Software Security Report, the flaw intensity vs flaw prevalence are :

Need for Code Security (contd.)

17

As per the Veracode (2019) State of Software Security Report, the flaw debt types by language are :

Need for Code Security (contd.)

18

Poor code security continues to be a major cause data breaches (Privacy Rights Clearinghouse, 2020)

Need for Code Security (contd.)

19

Code Security Fundamentals

20

Secure Coding Standards – SEI | CMU | CERT

Code Security Fundamentals

Source: SEI | CMU | CERT – Secure Coding Standards –

21

Code security (by code type):

Markup language security

HTML security

XML security

SAML security

Scripting language (client-side) security

JavaScript security (in Firefox)

AJAX security

Code Security Fundamentals (contd.)

22

Code security (by code type):

Scripting language (server-side) security

CGI security

SSI security

ASP security

PHP security

Programming language security

Java security

C++ security

Python security

Ruby security

Code Security Fundamentals (contd.)

23

Code Security Issues

24

Specific code security issues include the following:

Vulnerabilities in C amounted to 50% of all reported vulnerabilities

The most common CWEs across most programming languages are Cross-Site-Scripting (XSS), Input Validation, Permissions, Privileges, and Access Control, and Information Leak / Disclosure

A significant rise was seen in reported vulnerabilities as a result of the use of automated tools and the trend of bug bounty programs

While there was a spike in the number of reported security vulnerabilities in the past couple of years, the number of high severity vulnerabilities has decreased in most languages.

Code Security Issues

Source: Whitesource – Most Secure Programming Languages –

https://www.whitesourcesoftware.com/most-secure-programming-languages/

25

Specific code security issues include the following:

Total reported vulnerabilities per language

Code Security Issues (contd.)

Source: Whitesource – Most Secure Programming Languages –

https://www.whitesourcesoftware.com/most-secure-programming-languages/

26

Top 3 vulnerabilities per language

Code Security Issues (contd.)

Source: Whitesource – Most Secure Programming Languages –

https://www.whitesourcesoftware.com/most-secure-programming-languages/

27

Code Security Issues (contd.)

Top 3 vulnerabilities per language

Source: Whitesource – Most Secure Programming Languages –

https://www.whitesourcesoftware.com/most-secure-programming-languages/

28

OWASP Top 10–A4:2017 – XML External Entities (XXE)

Code Security Issues (contd.)

Source: OWASP Top 10 2017 A4 – XML External Entities (XXE) –

https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE).html

29

Common code security vulnerabilities:

Code Security Issues (contd.)

Source: OWASP Top 10 2017 A4 – XML External Entities (XXE) –

https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE).html

30

OWASP Top 10–A8:2017 – Insecure Deserialization

Code Security Issues (contd.)

Source: OWASP Top 10 2017 A8 – Insecure Deserialization –

https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization

31

Code Security Issues (contd.)

Common code security vulnerabilities:

Source: OWASP Top 10 2017 A8 – Insecure Deserialization –

https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization

32

OWASP Top 10–A9:2017 – Using Components with Known Vulnerabilities

Code Security Issues (contd.)

Source: OWASP Top 10 2017 A9 – Using Components with Known Vulnerabilities –

https://owasp.org/www-project-top-ten/2017/A9_2017-Using_Components_with_Known_Vulnerabilities

33

Common code security vulnerabilities:

Code Security Issues (contd.)

Source: OWASP Top 10 2017 A9 – Using Components with Known Vulnerabilities –

https://owasp.org/www-project-top-ten/2017/A9_2017-Using_Components_with_Known_Vulnerabilities

34

Code Security Attacks

35

Most common code security attacks:

Code Security Attacks

Attack Type Description
Billion Laughs Attack / XML Bomb A block of XML that is both well-formed and valid according to the rules of an XML schema but which crashes or hangs a program when that program attempts to parse it (Microsoft, 2015)
Buffer Overflow An attack which consists of overwriting memory fragments of a process resulting in errors that end execution of the application in an unexpected way
Code Injection An attack which consists of injecting code that is then interpreted/executed by the application
36

Most common code security attacks (continued):

Code Security Attacks (contd.)

Attack Type Description
JSON Injection A simple server-side attack that could be performed in PHP to grant admin privileges to a regular user
SSI Injection An attack allows the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary codes remotely
XXE Attack The attacker breaks out of the usual processing schema and bypasses the security verification and reads locally stored files
37

What is an XXE Attack – Hacksplaining

Code Security Attacks (contd.)

Source: Hacksplaining – What is an XXE Attack? –

38

Code Security Best Practices

39

Code Security Best Practices

Best practices for code security include :

Establishing coding standards and conventions

Select languages based on security issues they inherit

Use built-in security features

Use loosely coupled frameworks / libraries / components

Enforce standards

Using safe functions / APIs only

Provide guidance to developers on what functions / APIs to avoid

Use appropriate tools to Help in identifying and reviewing the usage of dangerous functions

Use the latest versions of compliers / interpreters / runtime environments

Source: SAFEcode.org – Fundamental Practices for Secure Software Development –

https://safecode.org/wp-content/uploads/2018/03/SAFECode_Fundamental_Practices_for_Secure_Software_Development_March_2018.pdf

40

Code Security Best Practices (contd.)

Best practices for code security include (continued):

Using code analysis tools to find security issues early

Use tools to analyze code to identify deviation from requirements

Use tools that plug in directly into the IDE

Use secure code review to identify logical errors in the source code

Handling data safely / handling errors gracefully

Use input validation techniques to begin with

Enforce data segregation to prevent data from becoming application logic

Use encoding so that data is interpreted in the context in which it is used

Use data binding which prevents data from being interpreted as control logic

Use sanitization techniques to remove, replace, or encode unwanted characters

Source: SAFEcode.org – Fundamental Practices for Secure Software Development –

https://safecode.org/wp-content/uploads/2018/03/SAFECode_Fundamental_Practices_for_Secure_Software_Development_March_2018.pdf

41

Code Security Best Practices (contd.)

Best practices for code security include the following:

Take Security Requirements and Risk Information into Account During Software Design

Review the Software Design to Verify Compliance with Security Requirements and Risk Information

Verify Third-Party Software Complies with Security Requirements

Reuse Existing, Well-Secured Software When Feasible Instead of Duplicating Functionality

Create Source Code Adhering to Secure Coding Practices

Source: NIST – Cybersecurity White Paper –

https://csrc.nist.gov/CSRC/media/Publications/white-paper/2019/06/07/mitigating-risk-of-software-vulnerabilities-with-ssdf/draft/documents/ssdf-for-mitigating-risk-of-software-vulns-draft.pdf

42

Code Security Best Practices (contd.)

Best practices for code security include the following:

Configure the Compilation and Build Processes to Improve Executable Security

Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements

Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements

Configure the Software to Have Secure Settings by Default

Source: NIST – Cybersecurity White Paper –

https://csrc.nist.gov/CSRC/media/Publications/white-paper/2019/06/07/mitigating-risk-of-software-vulnerabilities-with-ssdf/draft/documents/ssdf-for-mitigating-risk-of-software-vulns-draft.pdf

43

Use the following code security best practices to protect against XML External Entities (XXE):

Code Security Best Practices (contd.)

Source: OWASP Top 10 2017 A4 – XML External Entities (XXE) –

https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE).html

44

Use the following code security best practices to protect against insecure deserialization:

Code Security Best Practices (contd.)

Source: OWASP Top 10 2017 A8 – Insecure Deserialization –

https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html

45

Use the following code security best practices to protect against using components with known vulnerabilities:

Code Security Best Practices (contd.)

Source: OWASP Top 10 2017 A9 – Using Components with Known Vulnerabilities –

https://owasp.org/www-project-top-ten/2017/A9_2017-Using_Components_with_Known_Vulnerabilities.html

46

Code security issues are among the OWASP Top 10 list of web application security risks

This is due to weaknesses in coding technologies such as markup languages, scripting languages (client- and server-side), programming languages, etc.

Hackers are able to exploit the weaknesses using attacks such as billion laughs, buffer overflow, code/SSI/JSON injection, XXE attacks, etc.

Best practices to protect code include establishing coding standards, protecting data, performing input validation/error handling/logging, ensuring proper memory management, using code analysis tools to do secure code review, etc.

Recap

47

Thank you!!!

48

Order | Check Discount

Tags: apps that write essays for you free, assignment writing services in usa, bes, best dissertation writing services, best essay writing service