Category: Uncategorized

“They’re totally ignoring it,” says IT consultant Joel Snyder. “When you go to your Web site design team, what you’re looking for is people who are creative and able to build these interesting Web sites… That’s No. 1, and No. 9 on the list would be that it’s a secure Web site.”

The biggest problem is designers aren’t building walls within Web applications to partition and validate data moving between parts of the system, he says. Security is usually something that’s considered after a site is built rather than before it is designed, agrees Khalid Kark, senior analyst at Forrester. “I’d say the majority of Web sites are hackable,” Kark says. “The crux of the problem is security isn’t thought of at the time of creating the application.”

That’s a big problem, and it’s one the nonprofit Open Web Application Security Project (OWASP) is trying to solve. An OWASP report called “The Ten Most Critical Web Application Security Vulnerabilities” was issued this year to raise awareness about the biggest security challenges facing Web developers. The first version of the list was released in 2004, but OWASP Chairman Jeff Williams says Web security has barely improved. New technologies such as AJAX and Rich Internet Applications that make Web sites look better also create more attack surfaces, he says.

Convincing businesses their Web sites are insecure is no easy task, though. “It’s frustrating to me, because these flaws are so easy to find and so easy to exploit,” says Williams, who is also CEO and co-founder of Aspect Security. “It’s like missing a wall on a house.”

Here is a summary of OWASP’s top 10 Web vulnerabilities, including a description of each problem, real-world examples and how to fix the flaws.

1. Cross site scripting (XSS)
2. Injection flaws
3. Malicious file execution
4. Insecure direct object reference
5. Cross site request forgery
6. Information leakage and improper error handling
7. Broken authentication and session management
8. Insecure cryptographic storage
9. Insecure communications
10. Failure to restrict URL access

http://www.computerworld.com.ph/?_s=4&_ss=P&P=3&PN=5398&L=H&II=299&ID=H,299,BYB,-1

Remember the OpenPGP and S/MIME email encryption wars? Back then, it was all about which encryption protocol would become the standard for protecting email messages from prying eyes. The headache and complexity of using encryption keys for messaging wasn’t appealing to the typical organization or end user. “The way a traditional PKI works, it’s useless to make the majority of information workers send and receive email” with it, says Richi Jennings, an analyst with Ferris Research.

But email encryption technology is actually getting easier to deploy and manage today, with new approaches such as identity-based encryption (IBE) from companies like Voltage Security and Identum that match users to their more tangible email addresses or logons.

So far, email encryption is still mainly used by organizations with highly sensitive missions or information, or paranoid security types who know too much. But enterprises, especially those under the heaviest regulatory microscopes like healthcare and financial services, are starting to look more closely at email encryption.

Aside from Voltage Security’s SecureMail, which uses a special algorithm that turns a user’s logon or email address into a public/private key pair, email encryption pioneer PGP yesterday rolled out a new feature for its PGP Universal Gateway product that lets you send encrypted mail to an organization or recipient that doesn’t have secure messaging. “It’s [email encryption] becoming more usable,” says Christopher Gervais, enterprise architect for Partners HealthCare System, a Boston-based network of hospitals and research labs, who says email encryption may be an option for the company in the near future.

“Some of the email encryption experience for end users has become more integrated — there’s no more goofy manual certificate management, or [having to decide] do I encrypt this or that. Integro Insurance, for instance, runs Voltage’s appliance for internal email among its 13 locations worldwide, and then with a Web-based setup for external messaging. “Encryption has to be painless or people are not going to do it,” says Fred Danback, principal and head of global technology services for Integro Insurance Brokers. “The [win] was largely due to the security of our infrastructure and our ability to send and receive encrypted messages.” “That’s not what encryption maestros call desktop-to-desktop, but it means certain email is not going unencrypted over the public Internet.”

http://www.darkreading.com/document.asp?doc_id=133830&WT.svl=news1_4

However, security is a complex issue, where many remedies are required for different aspects, so such a simplistic view may not be enough to look at when selling our security wares. Some industry participants complain about increased competition as a factor in depressing their security sales.

However, let’s take a quick look at a typical large European country as a “market” for example Germany or the UK. This reveals that there will be, on average, ten firms providing Managed Security Services (MSS), with the biggest firm holding about a 20% market share.

Then there is another way: proving security ROI. In the security industry, however, every vendor seems to have one, which is slightly different from other vendors’ and which ‘proves’ that buying that vendor’s product or service makes the best economic sense. For example, I’m sure we’ve all seen the statistics stating that having someone else to manage your company’s firewalls is a 400% ROI over one year, when compared to managing them in house. Whenever we are confronted with such figures, there are several things we need to ask: How many firewalls do these figures refer to?

How many clients participated in the survey, how many vendors? Many ROI calculations adopt a simplistic and/or simplified view of the underlying costs. From a client perspective, a lot of energy is usually spent debating whether security is best kept ‘in house’ and delivered by client’s own personnel (or built by internal efforts), or is it better to outsource or buy ‘off the shelf’. Because security is essentially a trust issue, the natural inclination is to keep it in house, shrouded in secrecy.

From an economic perspective, there will be security tasks which are more efficiently carried out by an outsourcer (e.g. managing firewalls or IDS), and some which are more suited for in house delivery (e.g. fraud and incident investigations), if skills exist in-house. A good provider will remind the client that they always retain the full responsibility for their organization’s security posture, even if some security tasks have been ‘delegated’ to hands and brains outside the firm. Economics also plays a part in everyday decisions taken by individuals (employees) when it comes to doing the “right security thing.”

The answer is making security a business enabler and with a relatively low compliance cost. The main idea we need to tell our clients is that security can be a business enabler and not just an “IT cost,” Let’s stop viewing information security through the prism of fear and start to quantify it and, more generally, technology risks and threats in economic terms.

At the end of the day, buying decisions are made by business people and not necessarily by technologists, so security investment decisions must make business sense in order to be adopted. We need to articulate the economics angle whenever we buy or sell security.

The economic benefit of complying with the security policy will accrue to both you and your organization. Then, you can concentrate on doing what you do best, knowing you’ve done “your bit” to keep your information safe.

http://www.net-security.org/article.php?id=1062&p=1

Stick it somewhere in your environment where it’s likely to get noticed by an intruder, and tell it to page your incident response team (or you) if anything unexpected tries to connect to it. It’s a fake computer asset, and nothing (once you’ve fine-tuned the false positives out) should ever connect to it.

Months and months go by without any significant updates, but this month has seen a cornucopia of new developments and updates. New honeypot book Niels Provos (creator of Honeyd and senior staff engineer at Google) and Thorsten Holz have written an excellent honeypot book in “Virtual Honeypots: From Botnet Tracking to Intrusion Detection.” As a seasoned honeypot and honeyclient professional (and honeypot book author), he had high hopes for this book — and it delivers. The only downsides he could even come up with is that the book deals with a lot of Unix/Linux-only products, just like the honeypot software world, which might be a put-off for Windows-only readers.

In the end, what he really liked about this book is its coverage of a wide range of products and its practical application to capturing and analyzing malware.

Updated Honeyd for Windows Honeyd, originally a Unix/Linux-only product by Niels Provos, is one of the best virtual honeypot software programs in existence. Michael Davis did the original Honeyd port to Windows (thank you very much, Michael), but that version didn’t keep up as Windows XP and later came out. Jesper Jurcenoks, co-founder of netVigilance, has released an updated version of Honeyd for Windows. It works on all Win32 systems, including Vista, and comes with the ability to exclude predefined types of activity (which is a must when you’re doing real-time file and registry analysis).

The New Zealand Honeypot Project, which produced Capture-HPC, also wrote an excellent white paper on using Capture-HPC to identify malicious Web servers.

http://www.infoworld.com/article/07/08/24/34OPsecadvise_1.html

She listed BorderWare Technologies and Sipera Systems as key providers of VOIP security tools on the infrastructure side, and Zfone’s encryption technology—which has been submitted to the IETF (Internet Engineering Task Force) as a proposed public standard—as important on the client side.

“because most of the voice-over-IP traffic is still not encrypted,” said Paul Wood, an analyst with MessageLabs, headquartered in Gloucester, England. However, he added, VOIP security threats remain largely theoretical, as hackers and cyber-thieves tend to focus their efforts on e-mail. e-mail is certainly the single biggest target for [such attackers] because it enables them to exploit this massive ecosystem,” Wood said, adding that the mix of hardware- and software-based VOIP deployments makes it harder for hackers to target systems.

It takes a mix of security tools, from session border controllers to dedicated firewalls for VOIP traffic to network and host intrusion detection/prevention systems, to secure VOIP, Fodale said. She added that the key challenge for businesses will be to integrate VOIP security into a unified security framework.

http://www.eweek.com/article2/0%2C1759%2C2175285%2C00.asp

To lock down a large Web services network involving multiple enterprises, everyone must agree on technologies, even security policies: There’s no use demanding that your employees use biometrics and physical tokens if a partner’s staff accesses the system with weak passwords.

Before buying the elements of SOA security, do your homework, because the market is in flux. On balance, the movement we’re seeing is good news for IT because it means more choices and potentially fewer vendors to deal with. But it also makes buying decisions a lot more complex.

For example, Web services exposed to the Internet need XML firewalls, also known as SOA security gateways. However, this product category is disappearing thanks to ongoing SOA consolidation.

Meanwhile, with XML firewall functionality rolled into everything from management platforms to core switches, what kind of product to use–even basic decisions such as whether to use hardware or software–will depend on the scale and predicted growth of each enterprise’s Web services, as well as any existing SOA infrastructure.

Decisions around encryption and authentication are harder, as they don’t depend on a single organization. Everyone in a Web services extranet needs to be using the same technologies, and right now, there are several competing standards. The biggest conflict is over identity management, the complex exercise of ensuring that a user or process logged on to one company’s systems is authorized to use those of a partner. The first, SAML (Security Assertion Markup Language), is supported by almost everyone–except Microsoft. Redmond prefers the newer WS-Federation, which is more tightly bound to other Web services standards. Although both use XML, the two are incompatible, meaning enterprises with public Web services must either support both or ensure that all their business partners using secure Web services choose the same standard.

To help, Oasis (Organization for the Advancement of Structured Information Standards) created WS-Security, a standard for applying XML Security and XML Encryption in Web services. Its main weakness is that, like all the WS-* standards, WS-Security requires SOAP–anyone doing business with Web services running REST (Representational State Transfer, a way of describing XML Web services that don’t use SOAP) need not apply.

Though WS-Security helps encrypt and sign SOAP messages, it doesn’t say anything about AAA (authentication, authorization, and accounting) or security policies. The exception is federated identity, where the relatively new WS-Federation and WS-Trust are competing with SAML 2.0, an established standard also published by Oasis. The main practical difference is that SAML uses XML Encryption and XML Signature directly, meaning it can work with REST, whereas WS-Federation requires SOAP. SAML also has a large installed base, though this may not count for much because Microsoft has thrown its weight behind WS-Federation and said it will not support SAML.

Unlike some other standards battles, this isn’t simply a case of Microsoft vs. everyone else.

On the public Internet, firewalls were one of the earliest drivers for Web services. Although different organizations have different security policies, almost all need to keep Port 80 open, so vendors and standards bodies gravitated toward text-based protocols that run over HTTP. And, for the same reason, so did attackers and malware. As a result, companies publishing Web services to the Internet have traditionally used application security gateways, appliances that can read and understand application-layer documents, filtering out potential attacks. The deep-packet inspection and understanding of XML required to recognize attacks also makes security gateways useful for XML transformation and routing, and often better at it than management software, thanks to specialized SSL or XML acceleration hardware. The other independent security gateway vendors–Layer 7, Vordel, and Xtradyne–are moving in the opposite direction, toward software and virtualization. Vordel and Xtradyne have always distributed their gateways as software, intended to be installed on dedicated blade servers.

http://www.informationweek.com/news/showArticle.jhtml;jsessionid=AWX5VKJHPYNXCQSNDLRSKH0CJUNN2JVN?articleID=201201384