Defending Against Data Breaches, as a Practicing Ruby Developer - RMR 2015

Ab03678bbcfaa5425274e4d3905ae7b8?s=47 Frank Rietta
September 24, 2015

Defending Against Data Breaches, as a Practicing Ruby Developer - RMR 2015

You've been hearing about big data breaches in the news. As a developer who doesn't specialize in security, knowing how to protect your application from getting hacked may seem like a daunting task. However, fundamentals in the design and development process will greatly increase the security that protects your users from harm.

1. Data breaches are a major concern that cannot be mitigated by wishful thinking alone
2. Application Security is about preventing abuse by adversaries who have access to the system, focusing on the app itself rather than just its environment
3. Have an Information Classification system
4. Treat security as a requirement by writing Abuse Stories along with your User Stories.
5. Apply practical technical countermeasures, such as including OWASP Top 10 and your abuse stories in your automated test suite

This presentation covers the systematic use of Abuse Stories along with User Stories with security constraints. This is an open area of research how to best apply these practices to custom software development practices, especially within an Agile or Extreme Programming development environment that is developer lead.

For additional in depth discussion of preventing data breaches in custom software development, including additional User Stories and Abuser Stories, see my 2015 ISSA conference paper at https://rietta.com/papers/data-breaches/ISSA2015/Defending-Against-Data-Breaches-in-Custom-Software-ISSA2015-Rietta.pdf.

Ab03678bbcfaa5425274e4d3905ae7b8?s=128

Frank Rietta

September 24, 2015
Tweet

Transcript

  1. 1.

    Frank S. Rietta, 
 M.S. Information Security rietta.com/blog @frankrietta on

    Twitter September 25, 2015 Defending Against Data Breaches, as a Practicing Ruby Developer
  2. 5.

    Application Security is the subset of Information Security focused on

    protecting data and privacy from abuse by adversaries who have access to the software system as a whole. Its purpose is to make software resilient to attack, especially when network defenses alone are insufficient.
  3. 10.

    Major Preventable Flaws • Compromised staff credentials, which would be

    preventable by two-factor authentication • Automated technical exploits, that are aggressively applied over a large number of sites, succeeded because basics are ignored • Poor security, including unencrypted backups, leading to an unauthorized person having access to both the data and the means to read it
  4. 11.

    Hoglund, Greg , and Gary McGraw. (2004) Exploiting Software, p

    9. “Most outsourced software (software developed off-site by contractors) is full of backdoors…. Companies that commission this kind of software have not traditionally paid any attention to security at all” (2004).
  5. 16.

    Commercial Information Classifications 1. Public: Public information 2. Internal Use:

    Confidential business information 3. Confidential: Information that customers consider confidential 4. Sensitive: Personal and Private Information (PII), information that THE LAW considers confidential 5. Highly Sensitive: Encryption keys, server secrets, staff/admin passwords
  6. 17.

    Users can feel a privacy breach even if the terms

    and conditions spell out in mouse print that they agree to such sharing. This is a yellow line violation.
  7. 18.

    User Stories 
 & Abuser Stories I want an easy

    login experience I want to obtain credentials and steal things
  8. 19.

    User Stories Are composed of three aspects: 1. a written

    description of the story used for planning and as a reminder 2. conversations about the story that serve to flesh out the details of the story 3. tests that convey and document details and that can be used to determine when a story is complete
  9. 20.

    The New Customer As a Visitor, I can create a

    new account by filling in my e-mail address and desired password Security Notes: • Can we verify that the user really has the email address on signup? • The password should be at least 12 characters long and should definitely allow for spaces and punctuation
  10. 21.

    The Customer Service Rep As a Staff member, I can

    choose the “Assist Customer” button to login as that customer to provide him or her with excellent service. Security Notes: • We need to have a ton of logging around this feature • Staff members should be required to have authenticated with two- factor so that we do not have an unauthorized person accessing this with just a staff credential • Let’s identify certain private fields that customer service does not need access to while helping the customer. Those should be restricted; can we use the database SQL permissions to raise an exception if any of those fields is accessed while using this feature?
  11. 22.

    The Lawyer As general counsel, when I have received a

    subpoena for all material records for a particular account and have exhausted my options to reject it, I work with a system administrator to produce the data while not pulling unnecessary records. Security Notes: • As a matter of policy, we push back on all Law enforcement requests. • Even when the government compels access, we have to protect privacy.
  12. 24.

    URL Tweaker As an Authenticated Customer, I see what looks

    like my account number in the URL, so I change it to another number to see what will happen
  13. 25.

    Curious Editor As an Authenticated Customer, I paste HTML that

    includes JavaScript into every field possible to see what happens.
  14. 26.

    Infrastructure Takeover As a Malicious Hacker, I want to gain

    access to this web application’s Cloud Hosting account so that I can lock out the legitimate owners and delete the servers and their backups, to destroy their entire business
  15. 28.

    Disgruntled Employee As a disgruntled employee who will soon be

    fired, I want to permanently delete as much data as possible, so that I can cause chaos. Source: Fitzer, James R. Agile Information Security, p 37
  16. 29.

    Scam Artist / ID Thief As a scam artist, I

    want to obtain employee names, addresses, and social security numbers, so that I can steal their identity and finance a Corvette under their name. Source: Fitzer, James R. Agile Information Security, p 37
  17. 30.

    Hater As as Person with ill will towards a person

    I hate, I will seek to compromise any details about that person possible so that I can harm their reputation or endanger their life.
  18. 32.

    Additional Practical Countermeasures • Read the OWASP Top 10 •

    Use Secure HTTP Headers and enable SSL-only with Strict-Transport Security on all production sites • Run automated audit tools, such as Brakeman, Bundler-audit, Code Climate, and Linters • Use GnuPG (or PGP) as part of your workflow • Practice on the OWASP Railsgoat!
  19. 33.

    Recap 1. Data breaches are a major concern that cannot

    be mitigated by wishful thinking alone 2. Application Security is about preventing abuse by adversaries who have access to the system, focusing on the app itself rather than just its environment 3. Have an Information Classification system 4. Treat security as a requirement by writing Abuse Stories along with your User Stories. 5. Apply practical technical countermeasures, such as including OWASP Top 10 and your abuse stories in your automated test suite
  20. 34.
  21. 35.

    Frank S. Rietta, M.S. Information Security • My blog, where

    I write on security and other topics • https://rietta.com/blog • On Twitter • https://twitter.com/frankrietta • Learn more about Rietta’s community sponsorship, including the Atlanta Ruby Users’ Group videos • https://rietta.com/community
  22. 36.

    Rietta builds custom, secure code to automate business processes and

    web APIs. Unlike some other development shops, application security is actually our primary concern when we write code and build products. A Security-based Development Firm