OWASP SAMM v1.5 Release

According to recent research published by SANS: 23% of respondents said that applications were the source of actual breach, data loss and attacks on others and only 25% of the respondents believe they have a mature application security program.

The OWASP Software Assurance Maturity Model (SAMM) enables organizations to formulate and implement a strategy for software security that is tailored to organization-specific risks. With SAMM, organizations can accurately evaluate their existing software security practices and steadily improve their security posture over time in well defined iterations designed to meet their unique needs. The SAMM scoring model also helps demonstrate concrete improvements to security related activities throughout an organization. SAMM is one of the very few mature and open resources available to assist organizations measure and build software security programs.

Example SAMM Scorecard

 The new additions to OWASP SAMM are a direct response to the relentless occurrence of security breaches where vulnerable software allowed attackers to gain access to private, corporate data. Bart De Win, co-project leader of OWASP SAMM, says "Our main goal for version 1.5 was to support our large user community by incorporating their feedback and improving the measurement system of the model."

Anyone who has filled out a SAMM assessment has had a discussion on whether to mark an answer “yes” or “no”, when the answer is honestly something in between. By replacing the Yes/No answers with four graduated steps, SAMM v1.5 improves the granularity of scoring, allowing partial credit for achieving maturity benchmarks.This coupled with the matching scoring system, makes it easy to see maturity improvements from projects and initiatives on a dashboard. One of the main benefits of the updated scoring model is that you can visibly see improvement to your maturity score on the dashboard as initiatives are completed. This can go a long way in building support for your Application Security Program.

Example Worksheet

SAMM v1.5 has enhanced explanations of the maturity model with worksheets and guidance containing example case studies which allows organizations not only understand where they are, but to understand what has worked (and hasn't) for others in similar scenarios. This is a continuing effort with more improvements expected in v2.0. Implementing SAMM is easier with a new Quick Start guide and Tool Box that includes interview forms and the ability to generate road maps, charts, and graphs.

For more information you can visit https://www.owasp.org/index.php/SAMM, watch the SAMM v1.5 Webinar on YouTube, or download the slide deck on SlideShare.

Follow OWASP SAMM on twitter. For additional info email owasp.foundation@owasp.org

Combating the Vulnerability Chaos with OWASP DefectDojo

Four short years ago, I spent 35% of my time actually hacking on products and 65% of my time writing reports and recording metrics. Our team tried a multitude of tools to make our lives easier, but it seemed to only increase our turnover rates. The landscape of security has never been harder to manage with the numerous hoops engineers and penetration testers have to jump through to actually do their job.To alleviate our frustration and lack of options we created DefectDojo, a free and open-source vulnerability management tool.

Home Screen:  Here is what you will see when you first login to DefectDojo.
It provides a quick overview of the state of your security program.

DefectDojo is a tool that not only stores findings, but also helps to streamline your entire application security program. It simplifies vulnerability management by offering templating, report generation, metrics, finding deduplication, and baseline self-service tools to allow security engineers and penetration testers to spend their time on their actual expertise, hacking. Comprehensive details on all of DefectDojo’s features can be found on our official docs.

Templating: DefectDojo's templating system saves time on reporting
 by allowing users to recycle previous entries on similar issues.

Report Generation: DefectDojo includes a multitude of options to generate custom reports including
 filtering for a specific engagement or test-type. For an example report see the link below.

Sample Report

Self-Service Tools: DefectDojo includes self-service tools that allow teams to schedule
their own scans and store the results back into DefectDojo.

Scanner Integration: DefectDojo allows you to import scan data from multiple commercial and open-source security tools.

Every code change is checked for quality and security with continuous testing using Travis CI.  We do this to ensure that future updates do not break the current build.  We also run the same series of tests against any contributed code.  Speaking of contributions, we’re happy to take your pull requests, feature requests or donations to keep DefectDojo moving forward.  We’ve had several pull requests from new contributors, including a recent one that added file uploads to the REST API.  

Continuous Integration: Every code change is run against a series of of tests to ensure stable updates.

It is easy to make Dojo your own.  You can install DefectDojo using a single command on all Linux systems and OS X. There is also an option for Docker. The project is written with Python/Django. If you wanted to add or alter any features or displays to personalize your instance, only three files need to be changed (models.py, views.py, and templates).

DefectDojo is currently used by multiple large enterprises and has core contributors from five different organizations including Rackspace, Rapid7, Pearson, Cengage, and the OWASP Foundation.

DefectDojo works at scale. For example, Pearson uses DefectDojo to manage application security engagements for 2,000+ applications written by 5,000+ developers with operations on every continent.

If you’re curious about DefectDojo, there is a live demo.

You can log in as an administrator like so:

You can also log in as a product owner / non-staff user:

Please direct all inquires to greg.anderson@owasp.org

AppSec USA 2014 Offers World-Class Training Sessions

“Something that looks like a protocol but does not accomplish a task is not a protocol—it’s a waste of time.” 
― Bruce Schneier, Applied Cryptography

You won’t want to miss Bruce Scheier’s keynote at the AppSec USA 2014 conference September 16-19 in Denver.  But you also can’t afford to miss AppSec USA’s two full days of training sessions featuring top experts collaborating with you and your peers on the latest application security challenges and industry trends.

Register today for AppSec USA and the training sessions at http://2014.appsecusa.org/

Below are the brief overviews of AppSec USA’s 2014 training sessions. Click the links to learn more about the session and presenters.

Advanced Web Penetration Testing (2 Days)  

Presented by Secure Ideas

The advanced web penetration testing course is designed to be a hands-on course that will expand both internal and external security personnel testing knowledge.

Cryptography for the Modern Develop (1 Day)  

Presented by Blindspot Security LLC

This course is designed to provide attendees with the core concepts required to make informed decisions about what cryptographic primitives and APIs are safest to use in practice. The content will include approximately 50% lecture and 50% labs or other exercises to reinforce the concepts presented.

Malware Analysis Crash Course (2 days)

Presented by Mandiant, a FireEye Company

This course provides a rapid introduction to the tools and methodologies used to perform malware analysis on executables found on Windows systems using a practical, hands-on approach. 

Managing Web & Application Security – OWASP for Senior Management (1 day)

Presented by Tobias Gondrom

Managing and improving your global information security organization; Leverage OWASP and common best practices to improve your security programs and organization; Achieving cost-effective application security; Bringing it all together on the management level.

OWASP Top 10 – Exploitation and Effective Safeguard (2 Days)

Presented by Albero Solutions

This course aims at providing all web developers deep hands-on knowledge on the OWASP Top 10 web application vulnerabilities list.

Ruby on Rails – Auditing & Exploiting the Popular Web Framework (2 days)

Presented by Recurity Labs

After the training the participants will be able to assess, audit and exploit Ruby on Rails applications. This includes knowledge about the inner workings of the framework itself as well as a set of decent payloads for practical demonstration of vulnerabilities.

Securing Mobile Devices and Applications (2 Days) 

Presented by Aspect Security

This hands-on course enables students to understand how easily mobile devices and applications can be attacked. They will learn how to identify, avoid and remediate common vulnerabilities by walking through a threat analysis and learning critical security areas such as those identified in the OWASP Top Ten Mobile Risks and Controls.

OWASP + TrustyCON + BSidesSF / IATC

********BEGIN TRANSMISSION******

Technology should not only be Secure, it should be Trustworthy.
Raise Visibility for the community: https://www.thunderclap.it/projects/8350-the-cavalry-isn-t-coming

If you follow the OWASP Top 10  A2, A4, A5, A6, A9 is why you should join the discussion with your peers -- read on 

o()xxxx[{:::::::::::::::::::::>

OWASP  ** BSIDESSF ** TrustyCON

Background
As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA

 
News Report
http://www.reuters.com/article/2013/12/20/us-usa-security-rsa-idUSBRE9BJ1C220131220

Technical primer
http://arstechnica.com/security/2014/01/how-the-nsa-may-have-put-a-backdoor-in-rsas-cryptography-a-technical-primer/

The Cavalry Isn't Coming  It falls to us. Be a voice of reason. Drive cyber security for public good and public safety - have the discussion and learn about the impact.

o()xxxx[{:::::::::::::::::::::>

TrustyCON
Join us for the first Trustworthy Technology Conference, to be held on 27 February 2014 at the AMC Metreon Theatre in San Francisco, California. We welcome all security researchers, practitioners and citizens who are interested in discussing the technical, legal and ethical underpinnings of a stronger social contract between users and technology.

https://trustycon.org/

o()xxxx[{:::::::::::::::::::::>

BSIDESSF

BSides are about extending conversations in an open environment, not imposing a single point of view on anyone

This year's conference season has begun with controversy; we encourage everyone to speak, attend, and participate in events as they feel personally appropriate.
When: Sunday and Monday, February 23-24, 2014 Where: DNA Lounge (375 Eleventh Street, San Francisco, CA 94103) Times: 9am - 6pm

http://www.securitybsides.com/w/page/70849271/BSidesSF2014

o()xxxx[{:::::::::::::::::::::>

OWASP

The Open Web Application Security Project (OWASP), the premier global not-for-profit devoted to improving software security, is hosting a special security boot camp open to the public for FREE

WHAT:
The course will introduce and demonstrate application assessment techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code and understand fixes.

WHEN:
Monday, Feb. 24, 2014 2pm-5pm

WHERE:
Jillian's Billiards Club of San Francisco
175 Fourth Street, San Francisco, CA 94103

(Across the street from Moscone Center where the RSA Conference is being held.) The boot camp will be followed by an open Happy Hour sponsored by the Bay Area OWASP Chapter from 5pm-7pm, also at Jillian's.

COST:
The training is a FREE service of OWASP, open to anyone interested in securing their code.

Pre-registration is recommended to guarantee a spot in the training, but we will accept walk-ins based on available space. The Happy Hour is open to the public and no registration is required. To register for training, visit: http://www.eventbrite.com/e/free-owasp-training-tickets-10302967453

About OWASP Foundation

The Open Web Application Security Project (OWASP) is dedicated to making application security visible by empowering individuals and organizations to make informed decisions about true software security risks. As a 501(c)(3) not-for-profit worldwide charitable organization, OWASP does not endorse or recommend commercial products or services. Instead, we allow our community to remain vendor-neutral with the collective wisdom of the best individual minds in software security worldwide.


https://www.owasp.org/index.php/OWASP_Statement_on_the_Security_of_the_Internet_2014


o()xxxx[{:::::::::::::::::::::>

The Cavalry Isn't Coming
It falls to us.
Be a voice of reason.
Drive cyber security for public good and public safety.
http://www.iamthecavalry.org/

Technology should not only be Secure, it should be Trustworthy.
Raise Visibility for the community https://www.thunderclap.it/projects/8350-the-cavalry-isn-t-coming

***END TRANSMISSION*********

12 Days of Christmas w/ Hacker Claus

Ok builders, breakers and defenders.... gather around the FIREwire and sing with me;

On the 1st day of Christmas a malicious hacker faxed to Johnny <pause> poof of SQLi in his production website (database using SELECT * FROM members WHERE username = 'admin'--' AND password = 'password') with a username list

On the 2nd of Christmas the hackers gave to Johnny Cross Site Scripting vuln in his high risk web application <IMG SRC="javascript:alert('XSS');"> that his automated scanner missed and a link to OWASP Cheat Sheets and Core Rule Set  suggestions for monitoring and potentially blocking the input, output, or system service calls. 

On the 3rd day of Christmas the hackers gave to Johnny Insecure Direct Object Reference on a critical system that provided full admin access to the application because....  Johnny made a mistake and forget to add a rule to deny any to a obscure management port  http://yourwebsite.com/secret/adminconsole:8050

On the 4th day of Christmas the hackers gave to Johnny.... A FREE .PDF Book on how to find application security flaws and the NEW video series from AppSecUSA 2013 (43) Videos and 32 hrs of content

On the 5th day of Christmas the malicious hackers parked in front of Johnnies favorite coffee shop and conducted a man-in-the-middle hot-spot honeypot -- then proved to Johnny that "Password1" is not a good password and how quickly a hash can be cracked

On the 6th day of Christmas the hackers gave to Johnny code snips of critical system code on the new secret internal project that they picked up from PasteBin

On the 7th day of Christmas a hacker breached Johnnies door using a "9999" cut bump key on door #1, a shim on the padlock that secured important information and placed a "boom" sign inside my top right desk draw that was locked to prove a point about my lame physical security... --- seems they also drank his 18 year old scotch too!

On the 8th day of Christmas the hackers returned to Johnny a bag of dumpster diving treasure to point out lack of cross-cut shreder  that included bills from trusted vendors with account info, credit card carbons, internal printed emails, customer data and more...

On the 9th day of Christmas hackers hacked Johnny via an email aimed at his wife concerning a refund of a holiday purchase with targeted malware using a custom packer that bypassed my installed and updated corporate AV investment.  After getting a remote shell they then popped Johnnies work laptop that was also connected to my home network that was unpatched due to the holiday freeze then exported the cert on the VPN client installed a keystroke logger on the computer that I use for business to capture the password....  ouch..

On the 10th day of Christmas the hackers gave to Johnnie a FREE audio blog to help educate him

On the 11th day of Christmas the hackers knocked down my e-commerce website during the busy online shopping season with a Denial of Service Tool 

On the 12th day of Christmas hackers mailed a link... Johnny noticed his company was on the list of incidents involving the breach of personally identifying information (PII) and his information may have been in a dump of over 2M users due to his machine was infected with malware from Day #1

...... as a result he reached out to the LOCAL OWASP Chapter and started to ask questions, review the OWASP Foundation website and intresting projects including the  Enterprise Security API (ESAPI), Free Videos, Guidance on Mobile Security, Jobs Postings from around the world and over 100+ other projects: https://www.owasp.org/index.php/Category:OWASP_Project

May all your Christmases be #FFFFFF