BUILDING A SECURE STANDARD LIBRARY Information Assurance Project I MN121051 Tajuddin hj. Tappe...
-
Upload
barnard-blair -
Category
Documents
-
view
214 -
download
1
Transcript of BUILDING A SECURE STANDARD LIBRARY Information Assurance Project I MN121051 Tajuddin hj. Tappe...
BUILDING A SECURE STANDARD L IBRARY
Information Assurance Project IMN121051 Tajuddin hj. Tappe
Supervisor
Mdm. Rasimah Che Mohd Yusoff
ASP.NET TECHNOLOGY DEVELOPMENTF
OR
INTRODUCTION
Resource: OWASP Top 10 – 2013, The Ten Most Critical Web Application Security Risks
DEMO: SQL INJECTION
SECURE STANDARD LIBRARY
Library - is a pre-compiled code file (with extension .dll) that contains code and data that can be used by more than one program or application. By using a DLL file, a program can be modularized into separate components. Additionally, updates are easier to apply to each module without affecting other parts of the program (Microsoft, 2007).
Standard - means providing requirements, specifications, guidelines or characteristics that can be used consistently to ensure that processes and services are fit (www.iso.org/iso/home/standards.htm) is used because the proposed library will provide built-in functionalities as a standard for the purpose of the implementation to secure coding practices.
Secure - With the standard that will be implemented within the library, it also will take concern about validating data and input so that the process will be implemented in a secure manner.
WHY NEED TO EMPHASIZE ON SECURE CODING PRACTICES AND
STANDARDIZATION?1. Web application security is fundamentally
different than host or network security, and requires a different approach.
2. Custom code creates custom vulnerabilities.
3. Developers are not exactly the same with Security Experts.
4. Web Application Firewalls (WAF) are effective against known threats, but sometime they are less capable of discovering new issues or handling questionable use cases.
PROJECT AIMTo ident i fy the most common funct iona l i t ies that a lways be ing used by most deve lopers in an app l i cat ion pro ject deve lopment
Develop a c lass l ibrary that wi l l have a standard which wi l l provide the ident ifi ed common funct ional i t ies
Prov ided w i th secu re cod ing p rac t i ces , e spec ia l l y to encoun te r the mos t h ighes t i den t ifi ed a t tack such as SQL in jec t i on , C ross - s i te sc r ip t ing (XSS ) , e tc . wh i ch mos t l y w i l l be based on OWASP top ten mos t c r i t i ca l web app l i ca t ion secu r i ty r i sks
RESEARCH QUESTIONS
The research questions are as below:
a) How an application can be exploited from their vulnerability which caused by the developer themself.
b) What are the common functionalities that usually required by most developer in their development environment.
RESEARCH OBJECTIVES
The objectives of this study are as below:
a) To identify the secure coding practices requirements within ASP.NET technologies development.
b) To identify suitable standards for common functionalities in development environment.
c) To develop a secure standard library for ASP.NET technology development with secure coding practices.
d) To test the developed library with any ASP.NET technology development.
RESEARCH SCOPE
a) The library will be available to be used by ASP.NET developer and environment, specifically by using C# or VB programming language. It also requires .NET Framework installed on the machine or server.
b) The library will be applicable for a new ASP.NET project development and there are lots of code modifications required for existing application which are already developed.
c) Most of secure coding practices are based on OWASP Secure Coding Practices Document, but it will not cover all of the implementations in the checklist.
RESEARCH METHODOLOGY:OPERATIONAL FRAMEWORK
Phase 1 - Initiating
Phase 2 - Modelling
Phase 3 - Designing
Phase 4 - Developing
Phase 5 - Testing
Phase 6 - Implementing
Phase 7 - Finalizing
EVALUATION
1. UML Documentation
2. Test cases for testing report
3. Report for the usage of the library
4. Final report thesis
EXPECTED OUTCOME:SAMPLE OF IMPLEMENTATION
COMMON PRACTICE…
USING PROPOSED LIBRARY…
CONCLUSION
Developers cannot prevent security flaws in their code unless they know the types of flaws that can occur. But organization still could not rely hundred percent to developer for ensuring their program is secure all the time since developer is responsible to focus on development of functional requirements.
Developers want to do the right thing, but they need to know what the right thing is. It could be the responsible for organization to help developers to specify within their policy or procedure, about what tools / techniques / libraries for developer can use in order to implement secure environment within their application project development.
With the implementation of this study, it might allow other future researchers to continue upgrading and keep implementing new practices and techniques about this kind of study with other possible technologies available such as PHP, Java, ColdFusion, etc. This could be a good platform worldwide in our continuous efforts to reduce possible attack vectors within web application.
END OF SLIDE. THANK YOU.