SlideShare a Scribd company logo

Security Firm Program - Corporate College

•
•
WorkSmart Integrated Marketing
WorkSmart Integrated Marketing

Why care about secure web apps? - 7 out of 10 web apps were vulnerable to the use of a hyperlink with a malicious code embedded to it - 1 in 3 web apps aided hackers through information leakage: when a website unintentionally or unknowingly reveals sensitive information such as error messages or developer comments. With Web 2.0 technologies and other development platforms, applications are becoming increasingly powerful and complex

Related slideshows

Introduction to cyber security
Introduction to cyber securityIntroduction to cyber security
Introduction to cyber security
 
Briskinfosec - Threatsploit Report Augest 2021- Cyber security updates
Briskinfosec - Threatsploit Report Augest 2021- Cyber security updatesBriskinfosec - Threatsploit Report Augest 2021- Cyber security updates
Briskinfosec - Threatsploit Report Augest 2021- Cyber security updates
 
Are Your IT Systems Secure?
Are Your IT Systems Secure?Are Your IT Systems Secure?
Are Your IT Systems Secure?
 
1 of 9
The Security F.I.R.M. Program < From TSI @ Corporate College® >
Lead Instructor: David J. Kennedy Principal - Profiling and e.Discovery CISSP, GSEC, MCSE 2003 As the Practice Lead for Profiling & e.Discovery, Dave provides security solutions to companies and organizations worldwide. His team focuses on the technical side of security, performing penetration tests, source code review, web application security, data forensics, electronic discovery and wireless assessments. Before joining SecureState, Dave spent over five years working with elite security groups and the National Security Agency. He was also in the United States Marine Corp’s Intelligence Agency, where he worked with the National Security Agency to combat terrorism and eventually became an instructor for wireless security and data forensics. Your Host: Chuck Mackey, HISP Executive Director, TSI /Security F.I.R.M. Program As the Technology Solutions Institute’s (TSI) Executive Director, Chuck provides IT and Security program direction for Corporate College, a division of Cuyahoga Community College (Tri-C). He is the College’s former CISO where he created the Office of Safe and Secure Computing (OSSC). Chuck holds and MBA in Systems Management and carries the Holistic Information Security Practitioner (HISP) certification. Prior to joining Tri-C, he worked at Deloitte Consulting, Ernst & Young LLP, and Boeing’s (former) McDonnell Douglas military aircraft contractor.
JUST SOME OF THE F.I.R.M.* CONTENT *Foundation Immersion Reinforcement Mastery
Security Firm Program - Corporate College
Why Care About Secure Web Applications? • 7 out of 10 web applications were vulnerable to the use of a hyperlink with malicious (malware) code embedded in it. • 1 in 3 web apps aided attackers through information leakage: when a website unintentionally or unknowingly reveals sensitive information such as error messages or developer comments. • 1 in 4 was susceptible to content spoofing: technique used to trick a user into believing that certain content appearing on a web site is legitimate. (AKA: „Phishing‟) • 1 in 6 fell prey to SQL injection: an attack technique used to exploit web sites by altering program statements. • 1 in 6 employed insufficient authentication: occurs when a website permits an attacker to access sensitive content or functionality without having to properly authenticate. • 1 in 6 used insufficient authorization: when a website permits access to sensitive content or functionality that should require increased access control restrictions. • 1 in 7 allowed abuse of functionality: uses a website's own features and functionality to consume, defraud, or circumvent access controls mechanisms. Source: Web Application Security Consortium 2008
So, What is the Issue? •“With Web 2.0 technologies and other development platforms, applications are becoming increasingly powerful and complex. •With complexity comes a growing risk that security vulnerabilities will be introduced into applications. •These vulnerabilities lie within the code and can be exploited by anyone who gains access to your website or your software. •Developers are trained (if at all) to build complex and feature-rich applications, not safe and secure sites. •Increasingly, the software applications that millions of people and businesses depend on every day are being exposed to escalating risks in the form of sophisticated attacks and other threats. •Carnegie Mellon University‟s CERT (Computer Emergency Response Team) tabulates comprehensive data on the number of software vulnerabilities reported each year. Between 1995 and 2007, the data CERT collected and analyzed from numerous sources showed that the number of reported security vulnerabilities increased an average of 37 percent every year.” Source: The Case for Business Software Assurance, Fortify 2008
The New Security Frontier •The hacking community has shifted its efforts toward the application layer. •The hacking community is now heavily funded and supported by countries around the world. •With companies spending millions of dollars securing the perimeter with network firewalls, intrusion prevent systems, and other devices, hackers have realized the lowest hanging fruit lies in the applications themselves. •Vulnerabilities that exist in the code are being exploited to steal private data, conduct phishing attacks, deface web sites, and run any range of online scams. •Vulnerabilities have lead to breaches exposing over 212 million records over the last 3 years.
Come on, is it really that bad? • Gartner reports that 75% of breaches are caused by security flaws in software. • National Institute of Standards and Technology (NIST), reporting that 92% of vulnerabilities are in software. • The United States Air Force reports that the percentage of attacks directed at their applications (versus their networks) grew from 2 % to 36 % between 2004 and 2006. •InformationWeek reported that the number of hackers attacking banks jumped by 81% between 2005 and 2006, according to figures released at the Black Hat security conference in July, 2007. This increase is due to the increased availability of hacking toolkits and malware in the online underground. •Underground sites, such as http://www.xssed.com/, give attackers a blueprint of how to break into enterprise applications. •So, yeah, it‟s bad. Source: The Case for Business Software Assurance, Fortify 2008
What to do? • Establish a baseline where the greatest risk lies in the organization. •aka: Risk Assessment. • Define roles and assign responsibility for each task. • Educate developers on secure coding. • Identify automated solutions that can speed the process of securing applications. • Track metrics to gauge the success of each activity. ATTEND What: Secure Web Apps Development Training When: April 7* & 8**, 2009; 8:00 AM – 4:30 PM Where: Corporate College East (CCE) 4400 Richmond Rd., Warrensville Hts., OH 44128 http://corporatecollege.com/FacilitiesLocations.aspx *$299.00/person **$399.00 for both days Includes lunch, materials, ongoing access to the Security F.I.R.M. Micro-site Registration Information: william.mcclung@tri-c.edu Or Call Bill @ 216-987-2971 Limited Seating Completion Certificate Available

More Related Content

Security Firm Program - Corporate College

  • 1. The Security F.I.R.M. Program < From TSI @ Corporate College® >
  • 2. Lead Instructor: David J. Kennedy Principal - Profiling and e.Discovery CISSP, GSEC, MCSE 2003 As the Practice Lead for Profiling & e.Discovery, Dave provides security solutions to companies and organizations worldwide. His team focuses on the technical side of security, performing penetration tests, source code review, web application security, data forensics, electronic discovery and wireless assessments. Before joining SecureState, Dave spent over five years working with elite security groups and the National Security Agency. He was also in the United States Marine Corp’s Intelligence Agency, where he worked with the National Security Agency to combat terrorism and eventually became an instructor for wireless security and data forensics. Your Host: Chuck Mackey, HISP Executive Director, TSI /Security F.I.R.M. Program As the Technology Solutions Institute’s (TSI) Executive Director, Chuck provides IT and Security program direction for Corporate College, a division of Cuyahoga Community College (Tri-C). He is the College’s former CISO where he created the Office of Safe and Secure Computing (OSSC). Chuck holds and MBA in Systems Management and carries the Holistic Information Security Practitioner (HISP) certification. Prior to joining Tri-C, he worked at Deloitte Consulting, Ernst & Young LLP, and Boeing’s (former) McDonnell Douglas military aircraft contractor.
  • 3. JUST SOME OF THE F.I.R.M.* CONTENT *Foundation Immersion Reinforcement Mastery
  • 5. Why Care About Secure Web Applications? • 7 out of 10 web applications were vulnerable to the use of a hyperlink with malicious (malware) code embedded in it. • 1 in 3 web apps aided attackers through information leakage: when a website unintentionally or unknowingly reveals sensitive information such as error messages or developer comments. • 1 in 4 was susceptible to content spoofing: technique used to trick a user into believing that certain content appearing on a web site is legitimate. (AKA: „Phishing‟) • 1 in 6 fell prey to SQL injection: an attack technique used to exploit web sites by altering program statements. • 1 in 6 employed insufficient authentication: occurs when a website permits an attacker to access sensitive content or functionality without having to properly authenticate. • 1 in 6 used insufficient authorization: when a website permits access to sensitive content or functionality that should require increased access control restrictions. • 1 in 7 allowed abuse of functionality: uses a website's own features and functionality to consume, defraud, or circumvent access controls mechanisms. Source: Web Application Security Consortium 2008
  • 6. So, What is the Issue? •“With Web 2.0 technologies and other development platforms, applications are becoming increasingly powerful and complex. •With complexity comes a growing risk that security vulnerabilities will be introduced into applications. •These vulnerabilities lie within the code and can be exploited by anyone who gains access to your website or your software. •Developers are trained (if at all) to build complex and feature-rich applications, not safe and secure sites. •Increasingly, the software applications that millions of people and businesses depend on every day are being exposed to escalating risks in the form of sophisticated attacks and other threats. •Carnegie Mellon University‟s CERT (Computer Emergency Response Team) tabulates comprehensive data on the number of software vulnerabilities reported each year. Between 1995 and 2007, the data CERT collected and analyzed from numerous sources showed that the number of reported security vulnerabilities increased an average of 37 percent every year.” Source: The Case for Business Software Assurance, Fortify 2008
  • 7. The New Security Frontier •The hacking community has shifted its efforts toward the application layer. •The hacking community is now heavily funded and supported by countries around the world. •With companies spending millions of dollars securing the perimeter with network firewalls, intrusion prevent systems, and other devices, hackers have realized the lowest hanging fruit lies in the applications themselves. •Vulnerabilities that exist in the code are being exploited to steal private data, conduct phishing attacks, deface web sites, and run any range of online scams. •Vulnerabilities have lead to breaches exposing over 212 million records over the last 3 years.
  • 8. Come on, is it really that bad? • Gartner reports that 75% of breaches are caused by security flaws in software. • National Institute of Standards and Technology (NIST), reporting that 92% of vulnerabilities are in software. • The United States Air Force reports that the percentage of attacks directed at their applications (versus their networks) grew from 2 % to 36 % between 2004 and 2006. •InformationWeek reported that the number of hackers attacking banks jumped by 81% between 2005 and 2006, according to figures released at the Black Hat security conference in July, 2007. This increase is due to the increased availability of hacking toolkits and malware in the online underground. •Underground sites, such as http://www.xssed.com/, give attackers a blueprint of how to break into enterprise applications. •So, yeah, it‟s bad. Source: The Case for Business Software Assurance, Fortify 2008
  • 9. What to do? • Establish a baseline where the greatest risk lies in the organization. •aka: Risk Assessment. • Define roles and assign responsibility for each task. • Educate developers on secure coding. • Identify automated solutions that can speed the process of securing applications. • Track metrics to gauge the success of each activity. ATTEND What: Secure Web Apps Development Training When: April 7* & 8**, 2009; 8:00 AM – 4:30 PM Where: Corporate College East (CCE) 4400 Richmond Rd., Warrensville Hts., OH 44128 http://corporatecollege.com/FacilitiesLocations.aspx *$299.00/person **$399.00 for both days Includes lunch, materials, ongoing access to the Security F.I.R.M. Micro-site Registration Information: william.mcclung@tri-c.edu Or Call Bill @ 216-987-2971 Limited Seating Completion Certificate Available