Assessing and Measuring Security in Custom SAP Applications

Assessing and Measuring Security in Custom SAP Applications Sebastian Schinzel IT-Security Consultant Virtual Forge GmbH

Common Security Vulnerabilities Threat Modelling Measuring security How can I improve my security performance? Hands-on Threat Modelling Agenda

Common Security Vulnerabilities http://www.zdnet.com.au/news/security/soa/XSS-flaw-makes-PM-say-I-want-to-suck-your-blood-/0,130061744,339282682,00.htm

Cross Site Scripting (XSS) “most serious web application vulnerability” according to OWASP Top 10 Common Security Vulnerabilities Learn about XSS at http://virtualforge.de/vmovie.php Or meet me at the Virtual Forge booth

Common Security Vulnerabilities http://www.theage.com.au/news/tv--radio/porn-privacy-glitches-hit-big-bro/2007/04/23/1177180548617.html

Vulnerabilities in handling of user session IDs Small pool of available session IDs Pool got exhausted with many concurrent users Users were falsely logged in as another already logged in user Small pool of session IDs = predictable session IDs Easy to find and exploit for an attacker Attack easy to automate Possibility of getting caught is low Common Security Vulnerabilities

Common Security Vulnerabilities

Problems: SAP architectures very complex You had no security incidents because... ... your application landscape is secure? ... you regularly pray to god? ... the hacker covered the tracks? ... nobody bothered so far to look for vulnerabilities?  How can you reasonably protect your business data? Common Security Vulnerabilities

Problem: Security experts and business people speak different languages Security expert: “XSS, XSRF, SQL-Injection, Input Validation, Output Encoding, Encryption, ...” Business people: “Return of Investment, Industrial Espionage, Risk Management, Business Assets, ...” Threat Modelling creates a common language for security experts and business people Threat Modelling

How can you reasonably protect your business data? Cost-Benefit analysis from an attacker viewpoint Targets are interesting for an attacker if Cost of attack << Benefit of successful attack Threat Modelling Probability of getting caught Skill needed for attack Time needed for attack Cost Repudiation Blackmail Industrial espionage Benefit

Determine threats your applications face List the assets of your company How are these assets processed by your applications? (  Processes) Who uses the applications to work with the company’s assets? (  Actors) Threat Modelling

Assets Employee data (e.g. SSN) Customer data (e.g. Credit Card Data) Process Online Recruiting Online shop (order form, edit customer data) Actors HR Department Customers, shipping department Threat Modelling

Example: Asset: Private data of customers (e.g. CC data ) Process: A registered user edits the private data in the web form Threats A registered user views private data of other customers by tampering with the form’s request A registered user edits private data of other customers Threat Modelling

Add further information to the threats Business impact Level of exposure Affected users Damage potential Exploitability Threat Modelling

People thinking about security “ Yes, others have issues, we read that in the news – but not here.” “ We haven’t been attacked so far.” “ We use a firewall and IDS.” “ This is a feature, not a defect!” “ This is the responsibility of the vendor.” Measuring Security  How do you know?  What is the impact?  Is that enough?  How can you tell?  How secure is your code?

Measuring Security Another view on metrics … There is an 80% risk that a child hit by a car driving at 40 mph hour will be killed There is an 80% chance that a child hit by a car driving at 30 mph would survive People now drive slower as a result Smoking ban reduces likeliness of heart attacks … That’s how security metrics should be  shaping behaviour and not just being interesting! 

Measuring Security Recall Secure code is the real line of defence Metrics should change behaviour Software Security Metrics should lead to secure software! Change behaviour of customers, vendors, consultants, developers, …

Different levels of measurement Measuring Security

Rank entries in threat model Determine the most critical threats to your business assets Determine threats that are easy to mitigate (easy wins) Perform a security assessment (external security experts) Check applications that are involved with critical threats Find security vulnerabilities in those applications Determine root causes of vulnerabilities (faulty input validation, faulty output encoding, faults in application design, misuse of frameworks and libraries) Map found vulnerabilities to threats in the threat model How Can I Improve My Security Performance

The aftermath: Rank the vulnerabilities that were found during the assessment What are the most critical vulnerabilities? What vulnerabilities are easy to fix (quick wins) Fix it! Fix easy wins immediately Create plan about how to mitigate the most critical threats as soon as possible Create road map for Security Assurance How Can I Improve My Security Performance

The aftermath: Create road map for Security Assurance Train software architects for secure software application design Train developers for security development guidelines and best practices Include regular security assessments in your development lifecycle Incorporate managed security services (e.g. regular scans of web page for trivial security vulnerabilities) How Can I Improve My Security Performance

Security incidents happen regularly SAP application landscapes are very complex, thus difficult to build securely Use Threat Modelling to find the risks to your assets Measure security to improve security Create a road map for security assurance Conclusion

3 Key Points to Take Home “ Complexity is the worst enemy of security” (Schneier) Measure security to improve security Security can only be successful when it is an ongoing process. One-time efforts are not effective.

QUESTIONS? Sebastian Schinzel [email_address]

Assessing and Measuring Security in Custom SAP Applications

More Related Content

What's hot

Viewers also liked

Similar to Assessing and Measuring Security in Custom SAP Applications

Assessing and Measuring Security in Custom SAP Applications

Editor's Notes