Top 5 Tools to Consider For Application Security Testing

Security has become the single largest challenge for the digital enterprises to grapple with. The reason for this is not hard to find, as about 75% of all breaches are found to take place due to the misconfiguration of applications, especially at their end points (Source: https://www.gartner.com/newsroom/id/2753017.) Loss of revenue due to the security breaches is equally high. For, according to the BI intelligence report of 2016, the total revenue loss on account of mobile app frauds stood at a whopping $350 million. Given the enormity of the challenge, businesses have no option but to invest in strengthening the security aspect of the applications through rigorous application security testing.

What happens if application security testing is not done?

• It severely compromises the quality of the application and leaves users at the mercy of the hackers and cyber criminals. The growing number of frauds and security breaches are a testimony to the threat.
• The applications can be easily infected with malware, viruses, and trojans. This can not only undermine the functioning of the applications but worse, can lead to the siphoning of sensitive information and money.
• Customer’s trust in the application and by consequence, the business is eroded. This can result in business loss in terms of brand image and ROI.
• Businesses incurring additional costs to secure the application(s) post the breach.
• Enterprises inviting lawsuits from affected customers.
• Enterprises falling foul of the regulatory agencies and inviting strictures, penalties or an outright ban.

In the Agile or DevOps environment, carrying out application security testing should be alongside the development process. This is to ensure a better identification of bugs, faster time to market and an improved customer experience. The application security testing methodology can differ in its scope and objectives. The security testing of applications encompasses three types of methodologies -

Tiger Box: The methodology requires the security testing experts to hack into the application or software to find out the loopholes.

Black Box: The methodology involves the testing of the network and its various aspects. It includes the testing of the firewalls as well.

Grey Box: The methodology combines both white and black box testing to identify the structural vulnerabilities of an application.

In addition to following the above mentioned application security testing methodologies, security testing specialist use many tools as well. Below mentioned are the top 5 security testing tools that help testing experts to identify the vulnerabilities and validate the application.

Top 5 tools

#1 Network Mapper or NMAP: The tool checks for the vulnerabilities existing in the network of a business enterprise. With a built-in feature to automate the testing process, the open source tool creates a virtual map of the entire network and identifies the vulnerable areas. It uses raw data packets to determine the network hosts, services provided by the hosts, and the OS and type of firewalls used by the hosts.

URL: https://nmap.org/

#2 Metasploit: This popular open source tool or framework is used by certified ethical hackers as well as a large number of security testing experts. Built on the PERL platform, this integrated architecture of many Pen tools helps to launch cyberattacks from various access points. Armed with a ‘Meterpreter’ the tool flags the results after a vulnerability is breached. The results can be suitably interpreted to develop further test strategies.

URL: https://www.metasploit.com/

#3 Wireshark: The tool helps to identify the weaknesses of an application in real time by analyzing its traffic. It provides an easy to understand report and a colour coding scheme. The latter can help testers to investigate the loopholes further or isolate the erring data packet. The tool also helps to identify the threats such as SQL injection, memory buffer overflows, and data parameter pollution among others.

URL: http://www.wireshark.org/

#4 Vega: This GUI enabled testing platform based on Java comes with an automated scanner and proxy. It helps to identify threats such as cross site scripting, SQL injection, and header injection among others.

URL: https://subgraph.com/vega/

#5 Iron Wasp: Capable of generating HTML and RTF reports, this Python and Ruby based tool can detect a large number of vulnerabilities including false positives and negatives.

URL: https://ironwasp.org/

Conclusion

The changing risks landscape in terms of cybersecurity implies that testing tools should incorporate newer methodologies to identify any emerging vulnerability. The use of these tools helps to conduct a security audit and to enhance the quality of an application — the prerequisite to a better user experience.

This article is originally published at Medium - Top 5 Tools To Consider For Application Security Testing

Best practices for Security Testing of Web Applications

The Internet has today digitally connected the world and has made distances redundant. The web has spawned numerous opportunities for business entities to operate seamlessly with online transactions becoming the order of the day. There is a burst of Business Applications on the web, which has raised concerns regarding their security. Any information leak from these applications can lead to loss of sensitive data and impair individuals as well as organizations. Effective Web Application Testing is a solution to mitigate such risks. 

Security Testing implies testing web based applications to check vulnerabilities that could lead to any unauthorised access. This also means confidential data remains confidential and specific areas accessed by users is supported. For example, a data entry operator in an airlines reservation terminal should not get access to crucial reports pertaining to the airlines. Besides, a user should not deny access to other users or change the functionality of an application. Therefore, during Security Testing if the tester identifies any loophole that could be used wrongly, the same should be addressed.   

Web Application Security Testing identifies a number of techniques to address security breaches. The right approach is to use the entire spectrum of testing methodologies as shown below.

1) Adherence to user specific access: Any software system should have user specific areas where only the concerned user should get authorised access. Also, the areas that lay beyond the remit of a specified user should not in any way be accessed by the same user. To elucidate the same let us discuss an example: A data entry operator in an airlines reservation system should be able to enter passengers’ details only and in no way should be privy to forms, reports and database concerning the airlines per se. Such user specific access strengthens the security of a system. 

To check compliance, the tester should create multiple user access points and check if any user specific area is accessible to ‘others.’ In the event of non-compliance, the tester should log the issue and put correctives. 

2) Breaking passwords: User Ids and passwords are frequently used to log into a secured system. The use of password authenticates and authorises a user to access the application. The passwords are usually encrypted, but can be guessed by an intruder. The application should ensure that robust passwords are used by incorporating a combination of alphabets, numerals and special characters. Web Application Testing should also include password cracker programs. Moreover, the tester should see if ‘unencrypted’ passwords or usernames are stored in cookies – a real security issue. 

3) Check the URLs: Hackers generally use the HTTP GET protocol of a web application to source vital information by altering the parameters in a query string. The tester should use the technique to find out if the application accepts such a query, and should that happen, the gaps should be addressed to deter intruders. 

4) SQL Queries: Vital information can be stolen by hackers from servers by posting SQL queries through user input fields. Hence, the tester should ensure that the input field length is predefined. For example, a surname field should be a maximum of 25 characters instead of 150. Importantly, the input field should not allow special characters like single quotation mark (‘) or script redirects. 

5) Cross Site Scripting (CSS or XSS): This method involves stealing vital data from cookies by injecting HTML or JAVASCRIPT codes into the application. The tester, as part of the Web Application Security Testing process should ensure that the application does not accept such a script and the input field lengths remain well defined.

Why in Penetration Testing required?

Penetration Testing or Pentesting is a legal software attack on a software system which is carried out in order to uncover potential security weaknesses eventually gaining access to the data and features. Penetration testing can be described, executed and marketed in a lot many ways. It is often confused as a vulnerability scan, security assessment or a compliance audit. However, penetration testing stands apart from all in the following ways:

-      A penetration test is not over after detecting vulnerabilities. It proceeds forward to the next step to exploit the vulnerability to establish the attack vectors against the company’s data and assets.

-      The focus of penetration testing is on the team or individual testers and the experience they bring into practice. This is because even the most sophisticated technologies are vulnerable to the free thinking human mind which can analyze and synthesize, is capable of thinking more laterally and is driven by an unfading motive and determination.

-      A penetration testing is designed to evaluate effectiveness of the implemented security controls against a skilled human attacker. An organization with a 100% compliance may still be vulnerable against a human threat in the real world.

-      A penetration testing explores multiple attack vectors against the same target. Most of the successful compromises are generally the combination of vulnerabilities and information across different systems. 

There are many reasons for conducting penetration testing. The nature and scope of penetration testing is mainly dependant on the driving force of the organization, which in turn determines the goals of testing. This driving force also influences the other factors such as scope, target selection, assumptions as well as the budget amount allocated for the test.

Considerations for the Penetration Testing

-      Scope: For the purpose of testing it is very important what is to be scoped in and what should be scoped out of the target environment. Before test initiation, IP address ranges, external URLs and application should be clearly defined. Additional scope considerations include the acceptable level of social engineering interactions, physical access of tangible resources, etc.  In order to focus efforts on high value assets, the defined scope should always be prioritized. Limiting the scope increases the effort  of testing in the most important areas of the organization. It is important to maintain a balance in scope definition. If it is too broad, efforts may go stray and if it is too narrow, the testers may not get enough flexibility to explore all possible paths of exploitation.

-      The testing approach: The testing approach can be white box or black box. There are pros and cons of both these testing approaches. In case of the white box testing, less time and money is required for the identification of the tests and more can be invested in the actual exploitation process. However, it runs a potential risk of underestimating inside attackers and leaves them one step closer to the internal environment. On the other hand, the black box approach provides a better real life perspective of the system from the attacker’s point of view. It forces the hacker to spend time and effort in obtaining internal unauthorized information. This provides a good intel for the organization about potential breaches and enables them to take protective steps.

-      Objectives: Establishing the goals and objectives of the test is very important along with the scope. It helps to produce a report addressing the goals. Any objective of priority should be explicitly addressed in the goals. However, it should be taken into account that not all goals can be achieved despite repeated attempts. This is a positive outcome as  this ensures that the security stands tall.

Conclusion

At the end, all that matters is the real-world security. The effectiveness of penetration testing mainly depends on the people trusted with the task. Hence, after a security incident or a security testing, it is necessary for the company to determine the vectors which helped to gain access to the compromised syste

Implementing Continuous Security through DevOps

DevOps can be defined as a cultural change in work or a set of technology practices. It focuses on building a quality code, enabling automated testing based on a culture of continuous improvement eventually leading to improved stability and throughput and moving new features to customers quickly. Although DevOps is not a particular set of tools, but implementing DevOps practices leads to using certain tool sets.

-      The Version control systems track changes to the files and allow collaboration between teams. This leads to comparisons and merging of versions and rollbacks of issues. 

-      The Configuration management system automates new systems, enforces consistent application installation and configuration of system and application across different classes of servers. 

-      The ‘infrastructure as  code’ can be versioned and tested, ensuring that identical configurations are in place. This improves the odds that the software that was tested fine in the staging system will be fine in the production system as well. 

-      The automated system which helps to move through the build, deploy, test and release phase in the key component. 

Apart from the efficiency provided by DevOps, it can also create challenges in the implementation of security control infrastructures. Deployment through cloud reduces the control over the visibility of hardware and network layers. Further, it also complicates the tracking of hardware assets over time. DevOps blurs the limitations of the developers and operations and their duties are not well segregated.

Security teams need to be engaged early in the DevOps process in order to ensure continuous deployment. The following critical controls may be enforced in order to reduce potential security risks.

1. Inventory of Authorized and Unauthorized Devices: In DevOps environment, the very idea of ‘devices’ and servers is obscured in layers of deployed containers and virtual machines. Hence, cloud provider portals and APIs can provide verification of automated inventory along with cloud assets as well.
2. Inventory of Authorized and Unauthorized Software: The common practices of DevOps limit the servers to an approved list of the installed software. The configuration management tools can also be used to restrict to block software versions with known vulnerabilities.
3. Secure configurations for Hardware and Software on Servers: Installing and running only the required softwares, keeping them updated and configured is one of the best ways minimizing attacks. Once the configurations for OS and applications are developed, DevOps greatly simplifies the process of syncing these configurations throughout the system.
4. Continuous Assessment of vulnerability and Remediation: Keeping up with new vulnerabilities is a challenge. However, the DevOps environment provides a strong foundation for testing new patches. Deployment related security scans verify that all updates are addressed and reaches all intended targets.
5. Security of Application Software: The DevOps automated deployment pipeline performs  the code review, static analysis and web application scanning before the new software is deployed in production. Further, security testing such as security related functionality, vulnerability scanning and application security scans can be run in parallel to acceptance testing within the staging environment.
6. Controlled use of Administrative privileges: In a DevOps model, the code itself acts as a privileged user. Administrative privileges are used by configuration management that install new software, make configuration changes as per events and alerts. These credential secrets must only be used by orchestration systems and should not be made available to any unauthorized access.

As the DevOps movement matures,  security can no longer be considered as an afterthought, rather the best security practices need to be implemented into the DevOps evolution. Recently, there has been a considerable development of tools which help in securing DevOps environment. They range from repository firewalls, new application scanners, security functional test infrastructures to new SSH management solutions.

Conclusion

DevOps practices come with both advantages as well as disadvantages when Critical control based control infrastructure is implemented. The DevOps team needs to implement security early in the process to ensure a seamless deployment. The new security tools that is enforced for DevOps provides a new level of visibility and automation for security control implementations.

IoT Devices – Areas of Security concern

The Internet of Things(IoT) is actually much bigger than anyone realizes. IoT revolves around machine to machine communication. It is built on networks of sensors gathering data. These are virtual, mobile with instantaneous connectivity. The real value of the Internet Of Things is in the collection of data and leveraging it. The cloud based applications help in the interpretation and transmission of data from these sensors. 

Of all the current technology trends going on today, the Internet Of Things is the biggest one and hence it will also be the biggest one to give the most disruption. With IP and personal data accessible through connected devices,  hackers have the potential to bring an organization or  even a government to a standstill. Hence, we need to start with building new security approaches. Continuous monitoring, threat mitigation, secure operating systems are a few approaches to start with. 

Some of the aspects for SecurityTesting of IoT devices are as follows:

 -          Web Interface security: Most of our devices now have an inbuilt Web Server. Hence, cover the following points in this regard:

- Clear default login credentials while the initial setup

- Ensure complex passwords

- Check for Cross Side Scripting

- Check for SQL Injection

- Check for vulnerabilities of Cross Site Request Forgery(CSRF)

-          Authorization and Authentication: Authentication is much weaker in smart devices. Often limited to four digit codes. Check for weak passwords during the initial installation, use client side Java codes, send for authentication without using HTTPS transports or ask for no password at all. 

-          Network Services: The IoT devices mostly use insecure services like Telnet, FTP, TFTP etc. Penetration testing tools like Nessus, OpenVAS can check the use of such dangerous services.

-          Privacy Concerns: Three areas of concern that need to be covered here are

-  Ensuring collection of minimal data.

- Ensuring encryption of data

- Ensuring protection of data.

-          Transport Encryption: Failure in Transport Encryption exposes all the data and credentials at the same level of risk as an insecure web application. Hence, this aspect needs to be covered for complete security testing.

-          Mobile Interface: IoT devices can also act as wireless access devices. Here security specialists lack in a concrete security checking methodology. 

-          Cloud Interface: Most of the IoTdevices need to connect to the cloud server. These web services, may carry certain vulnerabilities. Hence, focus should be put on situations such as username harvesting, no lockout after brute force guessing attempts etc.

-          Security Configuration: This generally involves features such as password enforcement, data encryption and access through different levels. One additional aspect is to check the multiple user level access(full administrator/root permissions) of the operating system in use. Privilege Escalation attacks need to be attempted if they exist in the device.

-          Software Security: Two main threats to data sent over the network is that it could be changed and sensitive data can be intercepted. To cover these two contexts of insecurity ensure cryptographic signature for all updates, use of only the HTTPS ports and a cryptographic identity of the server provided.

-          Physical Security: Five things to over for ensuring physical security of these devices are encryption of stored data, physical protection of the USB ports, ease of dissembling and removing of unnecessary ports and ease of storage media removal.

Conclusion:

According to recent studies, majority of the IoT devices have security vulnerabilities. With millions of new smart devices, hardware endpoints, innumerable lines of coding and more complex infrastructure to cope up with the load, an extensive set of challenges has been created. Instead of researching on testing techniques, a clear mandatory emphasis on security from day one is a better approach, especially when dealing with such immature miniature technologies.