Covid-19 Security and OWASP with Adiran Thirmal

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking about adiran, all about OWASP top 10 for 2020 and beyond and probably other security topics that may come up. Adarian Thermal is an application security professional who who has dedicated his career to helping companies with their AppSec initiatives. He's joining us from Vancouver, Canada. So really excited to have him back on the show. Really has a lot of information in this area. You don't want to miss it. Check it out.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The the need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey Darren, welcome to the show.

Hey Joe, how's it going? Great to be back with you here today.

Awesome. Awesome to have you back. So before we get into it, is there anything more you want to tell the Guild about yourself that I may have missed or what you've been up to since the last time we spoke?

Yeah, the last time we spoke was when the whole COVID 19 was just kicking off. And yeah, I've just been kind of stuck at home ever since a few restaurant visits while that was open, but it looks like we're starting to hunker back down. So. Yeah, just getting ready for a long winter, I guess that's the way I want to describe it. How about you Joe?

Yeah, no, I've been really busy actually. It's funny how things change along with what things are going on. Not necessarily better, but different. So you just have to be adapt, I guess. So speaking about adapting, it's been like a few months now since COVID has been around and looking back on maybe where we talked, what we were saying before we really got deep into Covid and how it impact companies. Have you seen any impact on security since then that you thought, wow, I didn't realize this would have a this Type of impact on this type of security or this type of company?

Yeah, no, definitely weirdest one. The most interesting thing that I've seen kind of crop up is insider threat. So it's really interesting because when we were all in the office, you would have a lot of eyes on you as you were doing things. So typically you'd have your manager just around the corner. You might have your manager's manager, you have coworkers, and ultimately there's a lot of eyes on what you're doing. But now that we're all working from home, there's no one that can really peek over your shoulder and see what you're up to. And it's been interesting because there's been a number of insider threat related data breaches. Most recently, actually, Shopify had nearly 200 of its stores get attacked. And the way that they were attacked was ultimately two Shopify employees leaked the data from those stores out towards the public. And ironically or oddly enough, one of the stores was Kylie Jenner's makeup store. And she's got quite a big Instagram and Twitter following. So when you're thinking of the mean girls influencers, Kylie Jenner is definitely one of those. And so you don't really want her tweeting or Instagramming about some negative aspects of your organization. And I feel bad for Shopify for having to go through that. But they've done a good job of handling it. They've reported it, told all the various merchants that were affected, brought in law enforcement as appropriate. But insider threat, that's a tough one with COVID 19.

Yeah, I was going to say, I mean, even without COVID 19, it's almost like unavoidable. Almost. I don't know, are there controls you can have in place to completely eliminate it or will always be social engineering where people are going to be able to get insider type information.

So ultimately it's always defense and depth. So it's just kind of like your front door. You always have the opportunity to leave your front door completely open and anyone can kind of walk in. But even if you don't lock your door, even if you just close your door, it kind of deters people from coming in. And then if you take some of those next steps, if you might put one lock, you might put 20 locks. It's all up to you there. But very similarly, when it comes to insider threat, you can have a number of different deterrents and a number of different mechanisms to help you prevent it. I think the biggest of them has got to be logging. So ultimately looking at what sensitive items your employees are looking at what sensitive items your employees are doing and logging those. And then the big next step on top of that is a reading those logs and then taking some automated action on those logs. So if you have, you know, whether it be a script or whether it be a more comprehensive tool, that'll actually go in and trigger a specific sequence of events if something happens. So if you have an employee that goes into your sensitive accounting data and it happens to be one of your developers, I think you have to raise the alarm. Why is the developer there? And you might want to take some corrective actions and ideally just stop the developer from being in that spot. So kick off their connection. And I think that's a little bit easier to do now as we're all on vpn. It's just a matter of toasting that VPN connection. And all of a sudden the employee can't do anything else. They don't have connectivity into that specific spot. So lots of different ways to approach it. But you got to think back towards locking that door, so you can leave it wide open or you can put a bunch of locks on it. So it's all up to you.

Absolutely. And I guess there's a lot of things that are in your logs, but there's so much of them that it's hard to know when to parse them or what's a real issue. So any strategies for that? Are there any tools you just throw in something like Splunk and then, you know, put it in a dashboard. How do you monitor logs in general for security issues?

Yeah. And so it's interesting. Even a tool like Splunk, ultimately it's really geared towards helping you read those logs. It's really helping you kind of capture those logs. There are a number of different tools that are more in towards kind of this area called Soar. And it's this idea of automated response. And ultimately there's a huge variety of those. The easiest approach, though, is ultimately creating scripts. So being able to actually take decisive action based on activity that you're seeing. And there's a number of vendors that support this. And you can go even as low down as your firewalls. And a lot of firewall vendors do have capabilities and they have some mechanisms in place to allow you to be able to prevent attacks. So, you know, if you see someone going into a distinct, unique area of your network, your firewalls could take decisive action. And so you can obviously expand that up. And if you have some Better tooling out there to capture better data, that's always awesome. So if you have more of like those ids, IPS devices, that's always perfect. But then on the automated response side of things, if you've got some better capabilities in there, if you can tap into things like the buzzword of the day, machine learning and artificial intelligence, and be able to actually understand what an attacker looks like at that specific point in time. Because as you and I both know, security changes by the second and so the what you know, when you might have deployed those firewalls might not necessarily be true today. So being able to have capabilities and tools that are constantly changing with the times, that's the way to go. But yeah, there's a number of different approaches and it's a really tough nut to crack. I think there's a lot of multimillion dollar companies and multimillion dollar products that are trying to do it. So any one of those I'm sure will definitely help.

Yeah, so this shows, I think more gets towards beginners. So anytime I hear something about creating your own scripts, is that a common thing? People creating their own homegrown type of solutions? And if so, is there a common language that usually lends itself to be easier to do this type of activity? Like, I know I was kind of surprised to talk to another security expert and they were really up on PowerShell. Other people like C, other people like Python. Does it matter? Is it just a preference?

It's interesting. I don't think you necessarily always get the choice to pick any language out of the box. I think it's really dependent on your actual infrastructure. So for those PowerShell users, they're probably on either Microsoft Azure or they've got a number of different Windows type infrastructure. If you've got more of a Linux type of an environment and you've kind of got your own homegrown environment, you know, you might have the ability to use things like Python, Perl, but if you are using another cloud provider, you might be on the hook in terms of leveraging their own APIs. And so, for example, with Amazon and Google, there are a number of different APIs that exist within those environments. And then those APIs are only addressable through specific languages. So you kind of are a whim of those providers. But yeah, it's a little bit of choose your own adventure, a little bit more constrained than that.

Cool. And I know we've been talking about COVID 19 a lot, but you know, you brought up something. And once again, I've never Worked on a security team. I always thought of security as being a lone wolf. So I mean, does COVID 19 really impact a team's ability to really create better secure software because they're not all together in the same room, or does it matter? Is it just like any other type of agile type project?

It's a big challenge with COVID 19, with not having people right beside you. When it comes to security, one of the tough things is there's always this air of secrecy with a lot of what's going on, especially as you are being attacked. I know prior to COVID 19 you have the ability to round up the people that you need into a room. You can close off that room so no one else can really hear what's going on. Just in case the attacker can somehow get a hold of that information. You're able to really kind of lock things down. Versus now with COVID 19 we're all in unique environments and we can't bring ourselves into a single room anymore. So you're at that whim again of different communication channels and being able to maintain that air secrecy. But even beyond the secrecy, even if that wasn't there, I think security suffers from the same problems that COVID 19 has created for offices and organizations and all walks of life. Ultimately you've got to deal with a brand new communication mechanism of being completely virtual. And it's something that we're all dealing with. We're not perfect at it by any means. I think now we're about seven months, eight months into the whole COVID 19, maybe a little bit longer for certain regions and we're starting to get understanding and a good feel for what communication looks like in this new normal that we're in. But I think there's always new challenges and new things to kind of face with that. So I think Covid's been tough for security and communication.

Absolutely. So now I want to pivot a little more into OWASP top 10 and I think you mentioned some of OWASP top 10, 20, 20 and beyond. Now, does the top 10 ever change? I've been looking at like the top 10 for a while and it seems like these attacks are always the same. Unfortunately, it doesn't seem like we ever find solutions that people have realized that they should be hardening their systems against it, like SQL injection. So little thoughts for people that don't know for us what is OWASP then maybe we can dive into maybe OWASP top 10 and maybe did it change at all with COVID or is it the same or are there new attacks because of COVID that you see happening more and more that people need to know about in the new year coming up?

Sure, yeah. So starting off OWASP itself. So OWASP is a organization that's out there to provide more information about application security. So it is a open source centralized body that is supported by organizations around the world and individuals from around the world. And ultimately it is a group of professionals, ultimately. And so you have the ability, as a application security engineer, manager, practitioner, you have the ability to join OWASP to get more information. And OWASP itself does take great pride in publishing a lot of information just publicly. The OWASP top 10 is probably the most famous of them all. And there are some unique variants for that OAuth top 10. There are some mobile specific top 10s, and there are some more top 10s for other areas. But generally we're always talking about the web application based OAuth top 10. And it has gone through actually quite a number of different iterations. And so the latest one that exists currently was the one that was created in 2017. And by that I mean the data that's underneath the OAuth 102017 was captured in 2017. And prior to that. And actually there were some changes in 2017 with the prior version which was the OAuth top 10 2013. And so the biggest change was primarily there's this insecure direct object references which ultimately kind of got broken up and it also merged with the missing function level access control. And so in the OAuth top 102017 there is this idea of broken access control. So it's the fifth item in there, it's A five. And so that really combines the previous insecure direct object references and the missing function level access control. And both of the previous A4 and A7, they just disappeared out of the OWAS top 10 and got merged. Obviously the other big one too is cross site request forgery. So that got completely knocked off of the OAuth top 10. It's there kind of in theory. So there's kind of this idea within cross site scripting that ultimately you could use cross site request forgery as your end mechanism that you want to get towards with cross site scripting. So it's kind of there, but it's not in the top 10 at all. It's not directly called out. The other big one too is unvalidated redirects and forwards. So that has completely been eliminated off of the OS Top 10 2013. And in 2017 there were two brand new items. Actually, sorry, I should say there are three brand new items that were introduced. The very first one is something called XML external entities. And this is this XXE attack itself is related towards XML having extra pieces of data that you can go in and actually capture and go in and actually exploit. And so it goes back ToWards poorly configured XML and the external references that exist within your XML. And so there are a number of attacks that can result from this. And primarily it could be remote code execution, denial of service, or even just more port scanning and just kind of identifying what you have in your environment. The Insecure Deserialization A8 is a new one that also came out for 2017. And Insecure Deser is around remote code execution as well. And so ultimately you have the ability to do replay attacks, injection attacks and escalation attacks throughout that deserialization. And then the last one that came out too is insufficient logging and monitoring. And we touched on that a little bit earlier in terms of with COVID 19, if you don't have sufficient logging and monitoring, you ultimately are at the whim of attackers. So that's a lot. Bit of a mouthful, but yeah. So that's kind of what changed with 2017 versus 2013. And definitely what I wanted to chat with you about is there is a call to action within OWASP Top 10, 2020 and what that really is calling for is more data. Right now it is open and OWASP is as an organization, is looking for contributions. Contributions will close on November 30, 2020. But the OWASP organization is looking for data from 2017 to the current time. And what they're going to do is sift through that data and be able to create a new OWASP top 10 to figure out what are the things that have changed, what are the things that are still the same and ultimately refresh that for a more of a modern day.

So I guess how does that work? Is it just people saying, yeah, I had this exploit, Well, a lot of people had this exploit. Is it more scientific than that? Do you actually check out government data and say, oh, this actually was a common attack since 2017 that we need to add to the list?

It's very, very scientific and I'm not the greatest data analysis person, so I can't necessarily go into the specifics, but it is very, very scientific. They owasp, being a very open organization, completely makes it transparent in terms of how they're calculating the top 10. And ultimately it's not up to as specific organization, just kind of calling out hey owasp, make sure this is kind of on the list. They are going to be looking across organizations, across regions, across industries, and as you mentioned, the public sector versus the private sector, ensuring that vulnerabilities exist across the board there. And so there's a lot of different things to consider. The most primary of those though has got to be language when it comes towards development. So very similar towards, you know, what we chatted about there a little bit earlier in terms of how do you kind of automate your actual scripts when it comes to words identifying security flaws, it's really different in Java versus a JavaScript versus a golang. Right. So it's really kind of dependent on language. And The OAuth top 10 is across all languages in theory. So I think realistically what that means though is if there is more data that's being submitted that's on Golang, on Ruby, on brand new languages that are emerging, then those are going to be captured more so than languages that were maybe potentially older. So I'm not sure exactly how many submissions we're going to have in 2020 that are going to be on C, but I can definitely assure you there was a lot more in 2017, way more in 2013 and even more in 2010. So I think that is, it does change over time and the data hopefully reflects that.

So what do you mean by submission of data? What kind of data are you all looking for that people could submit?

Yeah, and so primarily the OAUTH organization is looking for metadata related towards vulnerabilities that were identified. So what was the testing mechanism that you might have done to be able to capture that specific finding? So did you use a specific tool? And I know at the top of the program we talked about, Micro Focus is fortified tool and there are a number of other tools that are out there that could help you identify those vulnerabilities. But there might also be just in house type testing that you have. So through that mechanism, what did you find? And then you know, when was it found, what's the time period for it, how many applications did you test across your organization and how many times did this specific vulnerability crop put? And then other things around, what's the language that was used, what's the geographic region that actually captured that vulnerability? And what's your primary industry as an organization? Are you a software company, are you a finance company, are you a manufacturing organization? And OAUTH actually just calls this out in their data structure section of the 2020 Data Analysis Plan. So it's definitely there, wide open for people to go in and take a look at. But I would say please, please, if you do have vulnerability data, definitely consider contributing it to the OWASP organization. Again, this is anonymized such that OWASP isn't going to go out and actually publish this data publicly. They are just looking for that metadata to be able to go in and create a brand new version of the OWASP top 10.

Now, I know there's a lot of different OWASP top 10. There's one for web application security, there's one for mobile. So is it for all top 10 that they're looking for or just web application security risk?

The primary focus of this collection is web applications, but from my understanding, if you do have mobile apps, if you do have other applications, definitely you can submit them into this mechanism. It's probably one of the bigger ones that OWASP does have. I think they will have some more targeted data capturing mechanisms that will be out there for specific OAS top 10s, but this is probably going to be their primary one. So if you do have unique environments, things like IoT might be a really interesting one. I'm kind of curious if people do have IoT related vulnerability data and this might be a spot in which you can submit it to try and poke oauth to create that OAuth top 10 for IoT environments. And there might be some others out there as well. So definitely submit the data. But I think the focus is on web applications.

I know you said it's very scientific, so this is probably not a good question, but is there anything that you think should be on the list? You know, I've been speaking with a few people and they keep up bringing up AI data poisoning, which I didn't know was a thing, but apparently it is. So anything you think should be added or, you know, especially in 2020 with AI and machine learning growing, or anything you think should be taken away or is it just, you know, not really up to you? You need to see the data.

Yeah, so definitely I can't necessarily make the call until the data is there, but I've got a few speculations and, and definitely when it.

The AI data itself, it's interesting because ultimately if you do go back towards data integrity, it's something that really was pertinent way back when. And I feel as though things are kind of cyclical. I feel like we will go back towards that data integrity aspect being really important. And you're going to see across many organizations around the world, there's going to be more security data lakes. And so if you flood those data lakes with invalid data, you're ultimately going to prevent your organization from being able to take appropriate actions, being able to understand what's actually going on. And it's interesting though, because flooding that AI data set, whether it be a data lake, whether it be a specific database system that's out there, you are typically going to use one of the other OAS top 10 type attacks to get that data. There's but I think it is worth calling out data integrity for sure. The other one though that I think is going to be really applicable for the top 10 is this idea of least privilege. It's one of those table stakes, core tenants within security. And especially as we've come towards COVID 19, as we've all moved to working from home, this idea of least privilege is just becoming more and more prominent. One of the interesting things that I think is transpired within applications over the last five to 10 years is applications have gotten much smaller. You know, 2010 we had a lot more monoliths out there versus right now we've got some applications that might only need to run for 5 seconds, 10 seconds. And so they are much smaller, very thin slices of what needs to get done. And I think that's a really good mechanism when it comes towards least privilege because if you have to do something, you can actually do it in little 10 second splice and then shut that entire application off for the rest of the time. If it's off, you know an attacker can't go in and exploit it. It's not there to be flooded with denial of service attacks or be flooded with like false data with injection attacks, anything like that. I think least privilege is going to be huge. And there is this idea of broken access control with a 5 and it does really talk to the idea of least privilege. But I feel as though least privilege is going to be a little bit more than that. It's going to get in towards more of how long your application is going to be running for and then also your network design. I think over time OAuth10, the OAuth10 has moved really far away from this idea of network segmentation and network focus and specialization where you keep the things that you need in a very specific secure zone and you really control the access. So we go back to that Shopify attack. Was the data that those employees access really necessary for their day to day job? And I can only speculate because I haven't seen the data and I don't believe Shopify will ever release this, but I'm going to speculate that that data is probably not very useful for their day to day life or for their day to day work and they shouldn't have had access to that data anyways. Right. So just removing that access completely is going to be huge. And just really thinking through does an individual need that access, does that individual need to be able to go to that specific network zone? And I think you're going to see a little bit more of that because when it comes to injection attacks, when it comes towards cross site scripting, ultimately I feel as though if you do have some control mechanisms in place around least privilege your injection attacks and your cross site scripting attacks are going to be a little bit less fruitful from an attacker perspective.

Now it's curious what you just mentioned there about Shopify. You don't think they would release it? So does that impact the results of the OWASP top 10? I know you said it's anomalies, but is there a lot of companies actually like I'm not even going to report it. So there may be a lot of things missing from the WASP top 10 because they're people are just secretive about their security exploits I guess, or security leaks or issues.

That's a really good question and I should clarify ultimately when it comes to organizations within Canada, within Europe, within a lot of countries around the world, California specifically as well, has just created their ccpa. And so what a lot of those mechanisms are out there for is for organizations to report to the law enforcement, to public bodies, that an attack has actually occurred and ultimately to inform the consumer who has been affected that their data has been leaked. A lot of times when we kind of think about it, a lot of organizations have been attacked. I was actually just listening to General David Petraeus this morning and he talked about this idea of there's only two types of organizations. There's organizations that have been hacked and then there's organizations who've been hacked and don't know it. And what ultimately a lot of these mechanisms, new laws are out there to do, is to go to those second groups and make them look through their data to see if they have been attacked and if they have to go and report it. And I think you've seen more and more of that, especially after the onset of gdpr. We've had some organizations come out and talk about breaches and talk about long term attacks that have resulted in data coming out and so I hope that means that the organizations will report it, but they won't necessarily report it publicly for any consumer to understand what's going on. They ultimately don't want to necessarily glamorize those specific attacks, glamorize the attackers themselves. So I think it's a tough balance, but you definitely don't want to necessarily bring those attackers into the limelight such that there'd be more attackers kind of encouraged to do that when it comes to the OWASP top 10. Definitely. I do hope Shopify and other organizations around the world consider sending their vulnerability data over. It's interesting because the OAuth top 10 with this data collection, they're not necessarily looking for exploits that have actually been attacked. It's just vulnerability. So what are the weaknesses that are out there? It's great if you do have legitimate attacks that have occurred, and especially if those have been cleaned up, I think that could definitely help with the data collection itself. But there's actually not even a mechanism within their the OWASP data structure to determine whether or not a vulnerability has actually resulted in an attack or not, like a successful attack or not. Definitely something that you can maybe attach into the metadata and call out and hopefully that could be something that the OWASP organization and community can look towards for the next top 10 data collection.

I know we talked about OWASP for a while and we make assumptions that everyone knows what it is and how to use it. So if you work for an organization, if you're a security professional, how can you get the best of or the most out of using OWASP Top 10 as an organization, how would you approach it?

Yeah. So the big thing with The OWASP top 10 is it's a training mechanism. It's a training tool. So if you have a brand new developer that has just come out of college, or if you have a brand new developer that's just come out of a development boot camp. Security might have been a small topic of conversation, but it's not something that has been drilled home. And The OAuth top 10 is a great mechanism to use as a brand new employee or even as a seasoned developer who wants to learn more about application security and security in general. It's a great mechanism that's there to talk about. These are the common attacks that we've seen, These are the common vulnerabilities that we've seen. And this is how you go out and actually remediate and fix them. So within the OAuth top 10, it is a very long document, but there is a lot of good data around. How do you fix these vulnerabilities and how do you prevent from occurring in general? And so it's a great training tool. So if you've got that brand new dev who's just joined your organization, you might want to set aside a day for them to go through the OAuth top 10. There's a lot of great organizations that have made this content a lot more consumable. There's good YouTube videos out there and there's just great training material. So if you can consume that and get that towards your new hires, your entire organization will be safer for it.

Awesome. Okay, Darren, before we go, is there one piece of actionable advice you can give to someone to help them with their OWASP security testing efforts and what's the best way to find or contact you?

Yeah, for sure. And so the best way to contact me, I'll tackle that one first, is either through Twitter or through LinkedIn. So Diren Thermal, if you look up my name, I'm usually the only one. If there's more than one, it might be someone trying to steal my identity. So I'll let me know and I'll take a look. But when it comes to the OAS top 10, one big thing that I want to talk about is to make it actionable. You don't want to necessarily boil the ocean by trying to tackle all 10 of the OAuth top 10 items. You might really just want to pick one, maybe two, and hone in and focus in on those. So a lot of organizations that have seen look at the OAuth top 10 for the very first time. Injection, a 1 or a 7 cross site scripting are typically the two big ones that I've seen where an organization just goes, we are really bad at this and we should create some new programs and new training, some new mechanisms to be able to go out and just squash those attacks. And so I would just pick one or two of these and really just focus in on that because your program is going to get really good, really fast. And then you can start adding in more of the OAuth top 10 items and there is more attacks out there. These are just things to allow your organization to focus. And it's not a one size fits all. So maybe a 10 insufficient logging and monitoring. Although it seems like it's the last item, it might be the first one for your organization. So not a one size fits all. Just pick one or two and just tackle away from there. And yeah, definitely reach out to me if you have any questions with your journey. And definitely poke your security team if you do have one in house because I'm sure they've got a lot of good opinions and a lot of good advice for you when it comes to.

Award COS10 thank you Adairen for your security Testing awesomeness. The links to everything value we covered in this episode. Head on over to testguild.com S37 and while you're there, make sure to click on the Try Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.