Software Development Security - Paiet/Tech-Journal-for-Everything GitHub Wiki

Software Development Security Pt1

• Best practices during software development

• Security requirements definition

  • What are my organization's specific requirements?

• Security testing phases

  • Static code analysis
    • "White box" testing
    • Full code accessibility
    • Automatic testing
      • Good at finding know issues
        • http://192.168.55.145/rips-0.55/
          • Scan /var/www/dvwa/vulnerabilites/ BUT...
      • May miss things
        • Business specific problems
    • Manual review
  • Web app vulnerability scanning
    • Looking for common web app vulnerabilities
      • XSS, SQLi, Command Injection, LFI/RFI, directory traversal, data leakage
  • Use interception proxy to crawl application
    • Automated tools
      • Acunetix
      • Burp Suite
      • Nikto
    • Manual testing
      • Manually throwing test strings at web app
  • Fuzzing
    • Attempting to get a program to crash or act unexpectedly
    • Good for finding Input Validation issues

• Manual peer reviews

  • Pair programming
  • Over-the-Shoulder
  • Pass-Around

• User Acceptance Testing(UAT)

  • aka Beta testing
    • Leveraging a community of users to find flaws and bugs

• Stress test application

  • Checking that the app can handle peak load
  • http://www.appperfect.com/products/load-test.php

Software Development Security Pt.2

• Security regression testing
  • Verifying that new changes made to app don't introduce any vulns
    • Patches/fixes may break more than they fix
  • How to reduce regression
    • Change control
    • Version management
      • Git
    • Source code management
• Input validation
  • Making sure that any input passed to the system by the user is acceptable and only allows expected input types
    • Exclude special characters that can be used to pass arbitrary code
      • <>'";/
      • Can't send 1000 bytes of data when 20 bytes will suffice - Secure coding best practices
• OWASP
  • https://www.owasp.org/images/0/08/OWASP_SCP_Quick_Reference_Guide_v2.pdf
• SANS
• Center for Internet Security
  • System design recommendations
  • Benchmarks
    • Step-by-Step guides for OS, database, and system configuration