Difference between revisions of "Top 10 2013-What's Next for Verifiers"

To verify the security of a web application you have developed, or one you are considering purchasing, OWASP recommends that you review the application’s code (if available), and test the application as well. OWASP recommends a combination of secure code review and application penetration testing whenever possible, as that allows you to leverage the strengths of both techniques, and the two approaches complement each other. Tools for assisting the verification process can improve the efficiency and effectiveness of an expert analyst. OWASP’s assessment tools are focused on helping an expert become more effective, rather than trying to automate the analysis process itself.

Standardizing How You Verify Web Application Security: To help organizations develop consistency and a defined level of rigor when assessing the security of web applications, OWASP has produced the OWASP Application Security Verification Standard (ASVS). This document defines a minimum verification standard for performing web application security assessments. OWASP recommends that you use the ASVS as guidance for not only what to look for when verifying the security of a web application, but also which techniques are most appropriate to use, and to help you define and select a level of rigor when verifying the security of a web application. OWASP also recommends you use the ASVS to help define and select any web application assessment services you might procure from a third party provider.

Assessment Tools Suite: The OWASP Live CD Project has pulled together some of the best open source security tools into a single bootable environment or virtual machine (VM). Web developers, testers, and security professionals can boot from this Live CD, or run the VM, and immediately have access to a full security testing suite. No installation or configuration is required to use the tools provided on this CD.

Secure code review is particularly suited to verifying that an application contains strong security mechanisms as well as finding issues that are hard to identify by examining the application’s output. Testing is particularly suited to proving that flaws are actually exploitable. That said, the approaches are complementary and in fact overlap in some areas.

Reviewing the Code: As a companion to the OWASP Developer’s Guide, and the OWASP Testing Guide, OWASP has produced the OWASP Code Review Guide to help developers and application security specialists understand how to efficiently and effectively review a web application for security by reviewing the code. There are numerous web application security issues, such as Injection Flaws, that are far easier to find through code review, than external testing.

Code Review Tools: OWASP has been doing some promising work in the area of assisting experts in performing code analysis, but these tools are still in their early stages. The authors of these tools use them every day when performing their secure code reviews, but non-experts may find these tools a bit difficult to use. These include CodeCrawler, Orizon, and O2. Only O2 has been under active development since the last release of the Top 10 in 2010 There are other free, open source, code review tools. The most promising is FindBugs, and its new security focused plugin called: FindSecurityBugs, both of which are for Java.

Testing the Application: OWASP produced the Testing Guide to help developers, testers, and application security specialists understand how to efficiently and effectively test the security of web applications. This enormous guide, which had dozens of contributors, provides wide coverage on many web application security testing topics. Just as code review has its strengths, so does security testing. It’s very compelling when you can prove that an application is insecure by demonstrating the exploit. There are also many security issues, particularly all the security provided by the application infrastructure, that simply cannot be seen by a code review, since the application is not providing all of the security itself.

Application Penetration Testing Tools: WebScarab, which was one of the most widely used of all OWASP projects, and the new ZAP, which now is far more popular, are both web application testing proxies. Such tools allow security analysts and developers to intercept web application requests, so they can figure out how the application works, and then submit test requests to see if the application responds securely to such requests. These tools are particularly effective at assisting in identifying XSS flaws, Authentication flaws, and Access Control flaws. ZAP even has an active scanner built in, and best of all it’s FREE!