OWASP DHS SWA Day 2010 OWASP - Revision history

Walter Houser at 22:13, 4 October 2010

2010-10-04T22:13:54Z

Walter Houser at 20:33, 4 October 2010

2010-10-04T20:33:17Z

Walter Houser at 20:32, 4 October 2010

2010-10-04T20:32:33Z

Walter Houser at 20:25, 4 October 2010

2010-10-04T20:25:34Z

Walter Houser at 20:24, 4 October 2010

2010-10-04T20:24:50Z

Walter Houser at 20:23, 4 October 2010

2010-10-04T20:23:26Z

Walter Houser at 20:21, 4 October 2010

2010-10-04T20:21:13Z

Walter Houser at 20:17, 4 October 2010

2010-10-04T20:17:04Z

Walter Houser at 20:14, 4 October 2010

2010-10-04T20:14:15Z

Walter Houser at 20:07, 4 October 2010

2010-10-04T20:07:35Z

← Older revision		Revision as of 22:13, 4 October 2010
Line 79:		Line 79:

	When you think of software assurance, please don’t confuse all of this with verification. Verification is not application security. We should spend 80% building it right, then 10% checking, then 10% for other things.		When you think of software assurance, please don’t confuse all of this with verification. Verification is not application security. We should spend 80% building it right, then 10% checking, then 10% for other things.
		+
		+	--[[User:Walter Houser\|Walter Houser]] 22:13, 4 October 2010 (UTC)

	[[Category:OWASP_Conference_Presentations]]		[[Category:OWASP_Conference_Presentations]]

@@ Line 13: / Line 13: @@
 == Notes ==
-Introduction to OWASP – Jeff Williams takes a different view of assurance.  Heis trying to push the assurance view into high speed software development.  Also he will explain how OWASP works and the methods used to change the world.  These are ideas that can actually change the game.
+Introduction to OWASP – Jeff Williams takes a different view of assurance.  He is promoting the assurance view into high speed software development.  Also he will explain how OWASP works and the methods used to change the world.  These are ideas that can actually change the game.
-“Security is a process, not a product.”   If security is a process we could just follow it.  Security is more like an artifact of a process; an emergent characteristic of following a procedss.  We like to look at security as an eco-system.
+“Security is a process, not a product.”   If security is a process we could just follow it.  Security is more like an artifact of a process; an emergent characteristic of following a procedss.  We in OWASP like to look at security as an eco-system.
 Background – There are roughly 10 million developers writing code and about a trillion lines of code.  If there were just 100 developers looking at 100 apps for 100 organizations.

@@ Line 13: / Line 13: @@
 == Notes ==
-Introduction to OWASP – Jeff Williams
+Introduction to OWASP – Jeff Williams takes a different view of assurance.  Heis trying to push the assurance view into high speed software development.  Also he will explain how OWASP works and the methods used to change the world.  These are ideas that can actually change the game.
-“Security is a process, not a product.”   If security is a process we could just follow it.  I think security is more like an artifact of a process; an emergent characteristic of following a procedss.  I like to look at security as an eco-system.
+“Security is a process, not a product.”   If security is a process we could just follow it.  Security is more like an artifact of a process; an emergent characteristic of following a procedss.  We like to look at security as an eco-system.
 Background – There are roughly 10 million developers writing code and about a trillion lines of code.  If there were just 100 developers looking at 100 apps for 100 organizations.

@@ Line 46: / Line 46: @@
 OWASP’s mission is focused on visibility to break the cycle.  OWASP is working toward a security facts label (like a food nutrition label)
-There is an underlying economic principle at work.  At markets where there is asymmetric information, it is very difficult for consumers to get a fair price. When you buy software you have no idea if it is a lemon so you cannot get a fair price for security.  Until we fix the software market, nothing else matters.  We will not get secure code out of it.  See 1970 paper by the economist George Akerlof [http://en.wikipedia.org/wiki/The_Market_for_Lemons The Market for Lemons ]. Ross Anderson’s paper [http://www.acsac.org/2001/papers/110.pdf Why Information Security Is So Hard ] also discusses the ecomonic challenges facing security practitioners.
+There is an underlying economic principle at work.  At markets where there is asymmetric information, it is very difficult for consumers to get a fair price. When you buy software you have no idea if it is a lemon so you cannot get a fair price for security.  Until we fix the software market, nothing else matters.  We will not get secure code out of it.  See the 1970 paper by the economist George Akerlof [http://en.wikipedia.org/wiki/The_Market_for_Lemons The Market for Lemons ]. Ross Anderson’s paper [http://www.acsac.org/2001/papers/110.pdf Why Information Security Is So Hard ] also discusses the ecomonic challenges facing security practitioners.
 OWASP is an eco-system.  An OWASP intern started the [http://www.Pythonsecurity.org Pythonsecurity.org ] project due to a void of information. These ecosystems pull together information, a community, etc.  There are builders and breakers working together for security.   Security is co-evolutionary.  The bad guys break in, the good guys add more defenses, repeatedly. This is the process that generates security.

@@ Line 46: / Line 46: @@
 OWASP’s mission is focused on visibility to break the cycle.  OWASP is working toward a security facts label (like a food nutrition label)
-There is an underlying economic principle at work.  At markets where there is asymmetric information, it is very difficult for consumers to get a fair price. When you buy software you have no idea if it is a lemon so you cannot get a fair price for security.  Until we fix the software market, nothing else matters.  We will not get secure code out of it.  See 1970 paper by the economist George Akerlof [The Market for Lemons http://en.wikipedia.org/wiki/The_Market_for_Lemons]. Ross Anderson’s paper [http://www.acsac.org/2001/papers/110.pdf Why Information Security Is So Hard ] also discusses the ecomonic challenges facing security practitioners.
+There is an underlying economic principle at work.  At markets where there is asymmetric information, it is very difficult for consumers to get a fair price. When you buy software you have no idea if it is a lemon so you cannot get a fair price for security.  Until we fix the software market, nothing else matters.  We will not get secure code out of it.  See 1970 paper by the economist George Akerlof [http://en.wikipedia.org/wiki/The_Market_for_Lemons The Market for Lemons ]. Ross Anderson’s paper [http://www.acsac.org/2001/papers/110.pdf Why Information Security Is So Hard ] also discusses the ecomonic challenges facing security practitioners.
-OWASP is an eco-system.  An OWASP intern started the [Pythonsecurity.org http://www.Pythonsecurity.org] project due to a void of information. These ecosystems pull together information, a community, etc.  There are builders and breakers working together for security.   Security is co-evolutionary.  The bad guys break in, the good guys add more defenses, repeatedly. This is the process that generates security.
+OWASP is an eco-system.  An OWASP intern started the [http://www.Pythonsecurity.org Pythonsecurity.org ] project due to a void of information. These ecosystems pull together information, a community, etc.  There are builders and breakers working together for security.   Security is co-evolutionary.  The bad guys break in, the good guys add more defenses, repeatedly. This is the process that generates security.
 Evolution of an ecosystem – individual, website, contributors, self-sustaining, etc.

@@ Line 69: / Line 69: @@
 Q. Is there a roadmap for APIs?
-A. Wait for the ESAPI presentation.
+A. We will cover that in the ESAPI presentation.
 Q. So many people think of other types of security other than application security.  How can we bridge these two communities?
@@ Line 77: / Line 77: @@
 Q. There is a large knowledge gap between the developers and the security folks that have never written a line of code.  Could OWASP do anything to point out the knowledge gap?
-A. There is no silver bullet.  The solution is complex.  If a new cycle of visibility and collaboration can be created, then this would make a big difference.
+A. There is no silver bullet.  The solution is complex.  If a new cycle of visibility and collaboration can be created, then this would make a big difference. We have an issue of many compliance and security people that are not engineers.  They are analyzing artifacts without understanding the fundamental pathways of how the code works.  There are no people in between the developers and the assessors.  We need people who understand both to serve this intermediate position.  We either need to teach security people engineering or vice versa.
 When you think of software assurance, please don’t confuse all of this with verification.  Verification is not application security.  We should spend 80% building it right, then 10% checking, then 10% for other things.  Ross Anderson’s paper [http://www.acsac.org/2001/papers/110.pdf Why Information Security Is So Hard ] discusses these challenges.

@@ Line 48: / Line 48: @@
 There is an underlying economic principle at work.  At markets where there is asymmetric information, it is very difficult for consumers to get a fair price. When you buy software you have no idea if it is a lemon so you cannot get a fair price for security.  Until we fix the software market, nothing else matters.  We will not get secure code out of it.
-OWASP is an eco-system.  An OWASP intern started the project [http://www.Pythonsecurity.org] due to a void of information. These ecosystems pull together information, a community, etc.  There are builders and breakers working together for security.   Security is co-evolutionary.  The bad guys break in, the good guys add more defenses, repeatedly. This is the process that generates security.
+OWASP is an eco-system.  An OWASP intern started the [Pythonsecurity.org http://www.Pythonsecurity.org] project due to a void of information. These ecosystems pull together information, a community, etc.  There are builders and breakers working together for security.   Security is co-evolutionary.  The bad guys break in, the good guys add more defenses, repeatedly. This is the process that generates security.
 Evolution of an ecosystem – individual, website, contributors, self-sustaining, etc.
-OWASP is trying to bootstrap lots of ecosystems like this Python Security ecosystem.
+OWASP is trying to bootstrap lots of ecosystems like this Python Security ecosystem. OWASP operates on a shoestring budget.  It has only two full time employees.  It is a 501c3 organization.   OWASP just began the college chapters program.  This program seeks to embed security knowledge into all colleges with computer science degrees.
-OWASP operates on a shoestring budget.  It has only two full time employees.  It is a 501c3 organization.
+OWASP offers many conferences around the world. OWASP works with industry. OWASP has a connections committee to bring together people who need to speak to each other to improve security. OWASP receives approximately 15000 page views on its website.  Last week when twitter was infected with the XSS worm, there was a large spike in traffic.
 The reasoning behind the agenda:  start narrow with things you can use now, then expose you to ways to improve security, show you the OWASP live compact disc (CD), then move toward success stories from implementing the DISA STIG.
@@ Line 70: / Line 60: @@
 While consumers may not be risking a significant amount, there are companies that are losing millions of dollars per day, and this does not need to be happening.
-How do you get a developer passionate about security?  What made the community shift toward focusing on security?
+Q. How do you get a developer passionate about security?  What made the community shift toward focusing on security?
-Developers want to do the right thing and build secure code.  There is a lot for developers to learn.  I don’t think we can expect developers to become security experts.  We need to focus on making security easier for developers.  We should take security out of their hands and put it into standards and tools.  Visibility is at the core of the solution to get people focused on it and to improve.
+A. Developers want to do the right thing and build secure code.  There is a lot for developers to learn.  I don’t think we can expect developers to become security experts.  We need to focus on making security easier for developers.  We should take security out of their hands and put it into standards and tools.  Visibility is at the core of the solution to get people focused on it and to improve.
-You mentioned critical infrastructure and legacy.  What is OWAPS’s position on legacy systems?  There must be an interim solution.
+Q. You mentioned critical infrastructure and legacy.  What is OWAPS’s position on legacy systems?  There must be an interim solution.
-There has to be an interim because of the vast amount of lines of code.  We need to take the same approach with new systems.  Identify the risk, prioritize the risks, and then put controls in place to counter them.  We become hypnotized by little problems that are revealed by tools, but we miss the larger more important risks that may not be as easy to detect.
+A. There has to be an interim because of the vast amount of lines of code.  We need to take the same approach with new systems.  Identify the risk, prioritize the risks, and then put controls in place to counter them.  We become hypnotized by little problems that are revealed by tools, but we miss the larger more important risks that may not be as easy to detect.
-Is there a roadmap for APIs?  Wait for the ESAPI presentation.
+Q. Is there a roadmap for APIs?
-So many people think of other types of security other than application security.  How can we bridge these two communities?
+Q. So many people think of other types of security other than application security.  How can we bridge these two communities?
-We have had challenges turning network security folks into software security folks.  We have had luck with making developers more aware of software security.  There is more work to be done.
+A. We have had challenges turning network security folks into software security folks.  We have had luck with making developers more aware of software security.  There is more work to be done.
-There is a large knowledge gap between the developers and the security folks that have never written a line of code.  Could OWASP do anything to point out the knowledge gap?
+Q. There is a large knowledge gap between the developers and the security folks that have never written a line of code.  Could OWASP do anything to point out the knowledge gap?
-There is no silver bullet.  The solution is complex.  If a new cycle of visibility and collaboration can be created, then this would make a big difference.
+A. There is no silver bullet.  The solution is complex.  If a new cycle of visibility and collaboration can be created, then this would make a big difference.
 We have an issue of many compliance and security people that are not engineers.  They are analyzing artifacts without understanding the fundamental pathways of how the code works.  There are no people in between the developers and the assessors.  We need people who understand both to serve this intermediate position.  We either need to teach security people engineering or vice versa.
-When you think of software assurance, please don’t confuse all of this with verification.  Verification is not application security.  We should spend 80% building it right, then 10% checking, then 10% for other things.
+When you think of software assurance, please don’t confuse all of this with verification.  Verification is not application security.  We should spend 80% building it right, then 10% checking, then 10% for other things.  Ross Anderson’s paper [http://www.acsac.org/2001/papers/110.pdf Why Information Security Is So Hard ] discusses these challenges.
 [[Category:OWASP_Conference_Presentations]]

@@ Line 19: / Line 19: @@
 Background – There are roughly 10 million developers writing code and about a trillion lines of code.  If there were just 100 developers looking at 100 apps for 100 organizations.
-<>83 apps would have a serious vulnerability
+* 83 apps would have a serious vulnerability
-apps would have XSS
+* 72 apps would have XSS
-would have SQL injection
+* 40 would have SQL injection
-company would have responsible appsec program (rounded up)
+* 1 company would have responsible appsec program (rounded up)
-developer would have any security training
+* 1 developer would have any security training
-All applications would have code from unknown origin
+* All applications would have code from unknown origin
-apps use libraries with known unpatched holes
+* 90 apps use libraries with known unpatched holes
-apps have has some sort of scan or test
+* 5 apps have has some sort of scan or test
-app has had a manual code review (rounded up)
+* 1 app has had a manual code review (rounded up)
-	There is no amount of automation that can find the problems
+* There is no amount of automation that can find the problems
-apps provide any visibility into security
+* 0 apps provide any visibility into security
 Every website has a privacy page, but none have a security page.