Web Application Testing

Application Security: What Testers Can Do

Based on a Paper Presented at STAR EAST 2015 – Preview contains pages 1-5 of 15

Non-Functional

Adjective: (1) Not having any particular purpose or function. (2) Not operating or in working order.

Hmm, that definition seems to differ substantially from the accepted IT definitions of ‘non-functional’ which are best summarized as: ‘All the stuff that’s difficult to do or measure, and best left for someone else instead of me’. So long as we can pigeon-hole security as something outside the mainstream project activity it is easy to forget about it or transfer responsibility to outsiders.

And yet. What if for one day we considered application security was something other than non-functional? Perhaps it’s extra-functional, or just plain functional? There’s enough evidence for us to see security breaches are currently a massive problem. Take Marathon Oil for example. Marathon invested millions of dollars surveying the ocean floor for potential oil deposits, then submitted their bids to the Indonesian government for the undersea fields they wanted to drill. For every single field, a Chinese oil company outbid Marathon by the smallest possible margin, without bidding for any other fields or ever being seen undertaking surveys. The loss of potential earnings probably runs into billions of dollars.

Sure enough, when experts looked closely at Marathon’s IT system it was found to have been breached and we can only assume from the circumstantial evidence there was a connection between the hack and the bidding events. Elsewhere mega-breaches have become commonplace and I’ve even heard CISSP certified security professionals advise it’s impossible to prevent breaches so the focus should be on recovery after the breach. That argument wouldn’t make me feel good if ISIS took control of the US nuclear arsenal and the President assured us the recovery process would re-stock the silos with replacement missiles next week.

Why is Hacking So Successful

Why is hacking so successful despite enterprises spending $46 billion dollars on cyber-security last year? One very important concept to consider is the difference between the TCP/IP transport layer and the application layer.

According to the Open Web Application Security Project (OWASP), only 1.7% of security budgets are spent on defending the application layer, despite most attacks targeting the applications and the majority of breaches occurring at the application level.

Other research suggests that perhaps the application security budget may be around 15%. Certainly it is far smaller than the established network / perimeter defence budget which is well stocked with expensive yet significantly ineffective tools such as firewalls, Intrusion Prevention Systems (IPS), Intrusion Detection Systems (IDS) and anti-virus software. These defences rely primarily on pattern-matching messages travelling through the network with their catalogues of known-bad scripts. At least they do that if the message is in clear Hyper Text Transfer Protocol (HTTP), but no valuable data should be transported unencrypted, hence the 25% and growing quantity of traffic that layers HTTP over the Transport Layer Security (TLS) cryptographic protocol to create HTTPS. In case you were wondering, TLS version 1.0 replaced Secure Sockets Layer (SSL) after SSL version 3.0

Encrypting Network Traffic

Encrypting network traffic by using HTTPS prevents wiretapping and ‘man-in-the-middle’ attacks, but also prevents network defences from detecting an intrusion because they cannot read the inbound or outbound messages unless they are provided with the encryption keys and perform a benign ‘man-in-the-middle’ interception themselves. Allowing an IPS to break encryption and log events, however well intended, presents new opportunities for attackers and new risks for defenders. Examining encrypted messages in-flight also creates performance issues. NSS Labs report an 88% reduction in transactions per second when HTTPS is decrypted, and the greater the flow rate the lower the percentage sampled in-line becomes. Unstructured internet data is growing at around 60% per year and will probably increase from 7.9 zettabytes this year to 82 zettabytes by 2020.

Big volume businesses like Yahoo already use 10 Gigabit per second (Gbps) Ethernet and expect to have standard 100 Gbps network connections by 2020. That increase in flow rate will reduce the real-time security window from 67 nanoseconds to 6.7 nanoseconds per frame. In other works the network defences will have to load a message into a frame, decide if it is malicious, then either block it or allow it onwards in the time it takes a photon of light to travel two metres. A top-end next generation firewall such as the Palo Alto 7050 can cope with 120 Gbps, but the cheapest model starts at $300,000 and each one consumes 2.4 Kilowatt of power. This kind of defence is becoming unaffordable and looks like attempting to make propeller-driven airplanes fly at supersonic speeds. No matter how much money and effort is input, the diminishing return on investment will defeat the buyer before the objective can be achieved.

Malicious Scripts

Meanwhile attackers are taking advantage of the asymmetric economics of cyber-security. For as little as $20 a malicious script can be purchased on the dark-web (a marketplace for illegal activity) then hijack thousands of unsuspecting computers to attack the multi-million dollar network defences of a target, and possibly defeat them.

Security Standards

What about all the globally agreed security standards your organization follows? Surely passing an ISO 27001 Information Security Management System (ISMS) audit proves your IT systems are secure? Unfortunately standards set a floor not a ceiling for security, and many organizations have still suffered breaches after passing their security audits. One weakness of ISMS audits is that they only verify the defined processes are correctly implemented.

If there are no defined processes for developers to follow secure coding standards, or testers to perform thorough security testing, the audit will simply not consider them.

The Growth of Breaches Due to Malware and Hacking

The proof that our current security paradigm is not working can be seen in the Verizon research graph shown below.
Although an ISMS may contain insider misuse through defined disciplinary procedures, and limit breaches after physical loss of laptops by mandating password and encryption policies, the growth of breaches due to malware and hacking has now entered a golden era for criminals.

We need to reverse these trends, and work with limited or no budget to invert the asymmetric economics of cyber security in our favour. Perhaps there is no such thing as an un-hackable system, but if we can make it cost a hacker $10 to steal $9, they will give up attacking our systems. How can we start making software more secure, instead of buying more security software?

Penetration Testing

A first step is to see penetration testing and automated code reviews as just two parts of a much larger Secure Development Life Cycle (SDLC). Penetration testing is often used as a late tactical response to an ongoing strategic issue. If the project team have no understanding of application security, their relationship with penetration testers will be based not only upon trust but also ignorance, and that’s a problem.

Perceiving security as a black art permits its aficionados to test against an undefined and incomplete mental criteria, instead of providing confidence that controls have been effectively implemented to manage prioritized security risks. Automated code reviews by generic tools are never 100% accurate because they are not created specifically for your system. Most issues are not generic, but deeply embedded in the bespoke business logic and application design. Automated code reviews generate false positives that waste investigation time, and more seriously leave false negatives that allow vulnerabilities to remain undetected. Just like penetration tests, automated code vulnerability scans are only a part of the bigger picture.

Continue Reading

Download the Full Guide