OWASP CLASP Project Pravir Chandra OWASP CLASP Project Lead OWASP AppSec Europe May 2006 Chief Security Architect Secure Software [email protected] Copyright © 2006 - The OWASP Foundation Permission is granted to.
Download ReportTranscript OWASP CLASP Project Pravir Chandra OWASP CLASP Project Lead OWASP AppSec Europe May 2006 Chief Security Architect Secure Software [email protected] Copyright © 2006 - The OWASP Foundation Permission is granted to.
OWASP CLASP Project Pravir Chandra OWASP CLASP Project Lead OWASP AppSec Europe May 2006 Chief Security Architect Secure Software [email protected] Copyright © 2006 - The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License. The OWASP Foundation http://www.owasp.org/ Agenda What is CLASP anyway? The CLASP Best practices Resources that CLASP provides Details on the OWASP CLASP Project OWASP AppSec Europe 2006 2 CLASP Comprehensive, Lightweight Application Security Process Prescriptive and Proactive Centered around 7 AppSec Best Practices Cover the entire software lifecycle (not just development) Adaptable to any development process CLASP defines roles across the SDLC 24 role-based process components Start small and dial-in to your needs OWASP AppSec Europe 2006 3 Origins of CLASP Developed by Secure Software Always publicly available and free to use Released under the Creative Commons-SA-Attr 2.5 Based on several years of field experience Basis of the OWASP Process project OWASP AppSec Europe 2006 4 Resources that CLASP provides We already know of some Role definitions 7 Best practices 24 Activities to bolt-on to dev process Summaries for the core security services Authz, Authn, Confidentiality, Integrity, etc. Design principles for building secure software Defense in depth, least privilege, etc. A large lexicon of vulnerabilities found in code Some use-cases for CLASP, process engineering & roadmap information OWASP AppSec Europe 2006 5 Roles in the SDLC High-level and abstract Can map one real person to more than one role Architect Designer Implementer Project Manager Requirements Specifier Security Auditor Test Analyst OWASP AppSec Europe 2006 6 The CLASP Best Practices 1. 2. 3. 4. 5. 6. 7. Institute awareness programs Perform application assessments Capture security requirements Implement secure development practices Build vulnerability remediation procedures Define and monitor metrics Publish operational security guidelines OWASP AppSec Europe 2006 7 1. Institute awareness programs Need organizational buy-in for success Don’t just educate the developers! PMs must understand high-level security goals Testers should be prepared to test for security Only one activity, but it’s broad Activities: Institute Security Awareness Program OWASP AppSec Europe 2006 8 2. Perform application assessments Probably the most well-known best practice Clearly important, but not the only thing Covers both ‘high-level’ and ‘low-level’ views Activities: Perform Security Analysis of System Requirements and Design (Threat Modeling) Perform Source Level Security Review Identify, Implement, and Perform Security Tests Verify Security Attributes of Resources Research and Assess Security Posture of Technology Solutions OWASP AppSec Europe 2006 9 3. Capture security requirements Product conception to downstream releases Get setup for success (or vector toward it) Activities: Identify Global Security Policy Identify Resources and Trust Boundaries Identify User Roles and Resource Capabilities Specify Operational Environment Detail Misuse Cases Identify Attack Surface Document Security Relevant Requirements OWASP AppSec Europe 2006 10 4. Implement secure development practices Preaching to the choir Activities: Apply Security Principles to Design Annotate Class Designs with Security Properties Implement and Elaborate Resource Policies and Security Technologies Implement Interface Contracts Integrate Security Analysis into Source Management Process Perform Code Signing OWASP AppSec Europe 2006 11 5. Build vulnerability remediation procedures Fed by software assessments Also by 3rd party vuln reports Otherwise, important items may get dropped Or, lots of chaos when they occur (wasted resources) Control information when disclosure must occur Activities: Manage Security Issue Disclosure Process Address Reported Security Issues OWASP AppSec Europe 2006 12 6. Define and monitor metrics Crucial despite only one associated activity Any good process must have metrics Measuring security directly can be hard Measure adherence to process as an indirect indicator Metrics are easy, interpretation is trickier Activities: Monitor Security Metrics OWASP AppSec Europe 2006 13 7. Publish operational security guidelines Crucial that operators know how to operate securely Lots of information gets lost from dev to ops Environment assumptions made by dev Ways to debug and interpret logs Definition of what is ‘normal’ Activities: Specify Database Security Configuration Build Operational Security Guide OWASP AppSec Europe 2006 14 Lexicon of Vulnerabilities ‘Top-down’ approach to creating a catalog of coding flaws Perhaps vulnerability is a misnomer Arranged into 5 high-level categories Range and Type Errors Environmental Problems Synchronization and Timing Errors Protocol Errors General Logic Errors OWASP AppSec Europe 2006 15 On vulnerability taxonomies Work in progress by NIST/DHS in the US PLOVER Seven Kingdoms CLASP too The word taxonomy implies a single top-level ordering I personally don’t think that is possible and the rigidity makes it less applicable The folksonomy approach is more useful OWASP AppSec Europe 2006 16 The OWASP CLASP Project Mission Reinforce application security through a set of prescriptive and proactive process components that are adaptable to any development model. Tactical Goals 1. Porting all of the CLASP v1.2 materials to the OWASP wiki 2. Generating more introductory materials to help users get started with CLASP 3. Enhancing the vulnerability catalog with more information (descriptions, examples, etc.) OWASP AppSec Europe 2006 17 Get involved We need volunteers and ideas Start by browsing the wiki pages for CLASP Project Roadmap page on the wiki Has the up-to-date goals Open and assigned tasks are listed Mailing list for discussions [email protected] OWASP AppSec Europe 2006 18 Pravir Chandra [email protected] OWASP AppSec Europe 2006 19