Be part of the Intuity Army
Send your application to careers@intuity.it.
By submitting your application, you confirm that you have read the privacy policy regarding the processing of your personal data for recruitment purposes.
Last week I was invited by our friends of ISACA Venice Chapter to give a talk on the evolution of threats and approaches to defenses in the last 20ys in the OWASP world.
We all know that the number of vulnerabilities is constantly growing, we can take a look to the number of CVE from NIST CVSS in order to understand the dimension of the problem.
In OWASP we started a project in 2004 that is now called Web Security Testing Guide that collects all the possible tests that should perform against a web application to verify the security of the running software. The number of tests started from nearly 40 to arrive today at more than 100.
Application Security research is constantly identifying new test cases to perform because new kind of vulnerabilities is emerging day by day.
This fact is related only to the web application, if we think that many other technologies were developed during the last 20 years, for example, smartphones, smart tv, all IoT devices, interconnect cars, and avionics we can easily understand why the threat scenario is growing and so why we will have more and more vulnerabilities in the next coming years.
The way we are developing new projects was also modified a lot during the last 20 ys: we started from a Waterfall model where the 5 basic processes (Define, Design, Develop, Deploy, Maintenance) were siloed and each phase begins only when its previous phase is complete to an Agile or DevOps models that on the other hand, aims to unify different teams to work collaboratively.
The result
If 20 ys ago the Companies released 1-4 times per year, but today we have more than 100 releases per year.
Then also the evolution of the Software Development Lifecycle contributes to creating more and more software that becomes more and more complex introducing new possible vulnerabilities.
Another element that influenced the evolution of vulnerabilities was the concept of the company perimeter. The first computer networks have incorporate the principle that a Company had a well-defined perimeter and the users were outside that.
Today the concept of Company perimeter does not exist thanks to the development of all new technologies such as smartphones with the corporate app, cloud services and software that is running on the user’s browsers.
The vulnerabilities of a service or product no longer target the company itself but the users who use the company’s services.
So more and more vulnerabilities running on the client instead of the server-side carrying on a new set of vulnerabilities called client-side vulnerabilities that we added to the OWASP Web Security Guide in 2010.
Now we can talk about the common approach evolution to Software Security in the last 20 years. We have seen many different ways to solve software security issues.
2000’s
At the beginning of 2000 the company’s answer was always the same: test, test, and test! Uhm this is the very starting point to approach the problem, the reality is that the test should be the last action that Company should be performed. What about fixing? If you do not have a process to manage the vulnerabilities you can not fix it. Yesterday the Companies were used to implementing a single fix in months, but this is simply unacceptable.
Lesson learned
Today we need instant security feedback, security must be shared and security bugs have to be managed as bugs with high priority.
The first lesson learned was that Vulnerabilities in the software development process are expected. The control of the security bugs and flaws in the software should be considered as part of the process of software development. Vulnerability management (fixing process) is the most important step of the process of software security.
That said another common approach was the use of verification just to punish the responsible. That does not work, does not create the right energy and approach in the company, and contributes to increment the problem.
After that failed approach, the Companies answer to Software Security was: automate, automate, automate everything! What we learned is that automation is really important in a complex organization to manage all the development throughput but it is not enough! You need an application security expert to configure, run it and manage the results and a lot of awareness to fix the issues in the right manner and short time.
During the last decade, Companies started to understand that fixing is the key as we said before in order to implement an efficient software development life cycle.</p>
So I understand that we are living in the era of insecure software: what is the best approach today? Here comes #OWASP! The Open Web Application Security
Project is an online community that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of application security. OWASP has more than 400 open source projects, please see more information here: https://www.owasp.org
How OWASP can support Enterprises to create their security strategy? What is the approach to creating a security strategy?
OWASP SAMM represents today the standard de facto to measure the level of maturity of the software life cycle. Our mission is t
o provide an effective and measurable way for you to analyze and improve your secure development lifecycle. SAMM supports the complete software lifecycle and is technology and process agnostic. We built SAMM to be evolutive and risk-driven in nature, as there is no single recipe that works for all organizations. More information here: https://owasp.org/www-project-samm/
Traditional Secure SDLC frameworks lack of: – level of awareness for all the people involved in the process – description of the application security roles involved – set of security standards – security testing tools adopted. OWASP SwSec 5D represents a more practical framework that focus on 5 dimensions to evaluate the maturity of a SDLC that are the following:
SwSec PROCESSES
SwSec TESTING
SwSec TEAM
SwSec AWARENESS
SwSec STANDARDS
The project goal is to review the 5D framework and create an open-source framework adopted by the OWASP Community. Why the 5D Framework is interesting? Because you can perform a light assessment just to understand if your strategy is balanced or not. For example in the following example you can see a typical Company that is too focused on Testing and not mature in the other 4 dimensions:
Conclusion
What do we take home? In the last 20ys the scenario has evolved, the way of development, the release time, and the complexity needs a structured approach to software security. We need to stop thinking testing is the solution! Stop thinking that security is one person’s responsibility. Instead it has become relevant to start sharing security bugs and fix it asap and start thinking that everyone is responsible for security.
OWASP SAMM Assessment and 5D Framework are standards that allow you to create your Software Security Roadmap!
You need to grow in 5 dimensions in order to establish a mature software security program : TEAM, AWARENESS, STANDARDS, PROCESSES, and TESTING.
Thank you for the attention and thanks to Francesco Puccioni, Pierluigi Sartori for the invitation to talk and all the people involved in the conference #IsacaVenice.