Denim Group, Ltd.

Work Hard, Play Hard, and e-Learn

We have our share of characters here at Denim Group – brilliant folks who like to work hard and play hard.  Lately we have been putting a lot of work into the upcoming quarterly update of our ThreadStrong application security e-Learning product.  This is a pretty major revision with audio, demonstrations and interactive exercises.  I got a kick out of this email exchange and thought I would post it online.

-----Original Message-----

From: Michael

Sent: ...

To: ...

Subject: e-Learning - Meeting notes - storyboard planning

 

> All:

>

> Here is what we came up with during our storyboard meeting:

>

> -New order for the sections will be:

> 1. Breaches

> 2. Attack demonstration

> 3. What/Why

> 4. SQL injection

> 5. HTTP Basics

> 6. XSS

> 7. Quiz

>

I believe that covers it. I took this picture from the meeting.

-----Original Message-----

From: Bryan

Sent: ...

To: ...

Subject: e-Learning - Meeting notes - storyboard planning

Wow, you know, I'd noticed during today's meeting that we had a lot more productive and intelligent discussion. I was looking back at notes from the last meeting and I think I figured out what our problem was.

Like I said – a real cast of characters.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

Denim Group Launches ThreadStrong

By Dan Cornell

This has been in the works for quite a while, but the actual public release came out today - Denim Group has released our new application security e-Learning program called ThreadStrong.

We have a brief video online here:

ThreadStrong is a great way for organizations to provide a base-level of application security knowledge for developers and other personnel involved in the software development process.  A number of organizations have also used it to address aspects of compliance requirements such as PCI.

The available courses include:

• Introduction to Application Security Concepts (1 hour, for Developers, QA, Managers and Security Professionals)
• Application Security for Java (4 hours, for Developers)
• Application Security for .NET (4 hours, for Developers
• Threat Modeling (1 hour, for Security Professionals and Developers)

Give us a call or drop us an email if you'd like a demo.

--Dan
dan _at_ denimgroup.com

Denim Group Teams with Rackspace Hosting

By Dan Cornell

I'm thrilled to announce Denim Group working with Rackspace Hosting (NYSE: RAX) customers to help them secure their applications via conducting code reviews, delivering secure software development training, and evaluating software development strategies for Rackspace clients.  We've known folks at Rackspace for years and had the opportunity to work with them in a variety of capacities so this is pretty exciting for us: BusinessWire release: Denim Group Teams with Rackspace Hosting

Whether you're hosting your applications in "the cloud" or on good old-fashioned servers, they're still targets for attack.  We're glad to have the opportunity to work with Rackspace and their clients to help reduce their risks.

John put together a brief video about the release:

This has also been picked up by a bunch of other folks:

• Yahoo Finance
• BusinessWire
• AOL Money
• Reuters
• MSN MoneyCentral

--Dan
dan _at_ denimgroup.com
Twitter: @danielcornell

Why Do Vulnerable Applications Take So Long To Fix? - Webinar Follow-Up

By Dan Cornell

I realize I did a crappy job of promoting this webinar via the blog (most promotion was done via Twitter - follow me @danielcornell), but I wanted to get links to the recording and associated resources up online.

I recently did a webinar with Jeremiah Grossman from WhiteHat Security titled "Vulnerable Applications - Why Do They Take So Long To Fix?"  Online resources for the webinar are available here:

• The webinar recording is available: Vulnerable Applications - Why Do They Take So Long To Fix?
• My Denim Group slides are available: Vulnerable Applications - Why Do They Take So Long To Fix? - Denim Group Slides
• Jeremiah Grossman from WhiteHat Security's slides are available: Vulnerable Applications - Why Do They Take So Long To Fix? - WhiteHat Slides

Also, we discussed several other online resources during the webinar:

• Verizon 2009 Data Breach Report
• Verizon 2009 Data Breach Report (press release)
• Web Hacking Incidents Database (original site)
• Web Hacking Incidents Database (new site)

And here is something we neglected to mention during the webinar, but is worth a glance:

• Data Loss Database

We had great attendance, great questions and a lot of great follow-up after the webinar.  Hopefully these resources are useful to folks trying to spur their organizations to take action against application security vulnerabilities.

--Dan
dan _at_ denimgroup.com

Denim Group Mention in InformIT Article on Software Security Industry Trends

By Dan Cornell

Denim Group was mentioned in a recent article on the Software Security industry trends by Gary McGraw.  It highlights how we grew last year - even in a tough economy.

We see similar trends to those mentioned in the article in organizations we work with - penetration testing is still important, but many groups are also starting to put material resources toward source code analysis.  Now that most folks have been through the first rounds of assessments or penetration tests folks are putting more thought into the organizational changes they need to make in order to address software security risks.  Overall this is very healthy as we move into the post-scanner world.

--Dan
dan _at_ denimgroup.com

John Dickson at RSA: What You Don’t Know Can Hurt You: Security Professionals and Custom Apps

By Dan Cornell

John Dickson will be presenting at RSA this year about "What You Don’t Know Can Hurt You: Security Professionals and Custom Apps"  The abstract for the talk is:

Security managers rarely have software backgrounds. However, they get the blame when unsecure software is exploited and a breach occurs. This session will help security managers better characterize different software development approaches and identify risks associated with building custom applications. Software assessment strategies and secure SDLC improvements will be discussed in depth.

The session is PROF-402 and the talk is scheduled for:

Friday, April 24 10:10 AM Purple 3

More info can be found on the RSA 2009 conference website.  Also - follow John on Twitter @johnbdickson for updates about RSA and more.

--Dan
dan _at_ denimgroup.com

Dan Cornell at RSA: Building an Organizational Application Security Competency

By Dan Cornell

I will be presenting at RSA this year about "Building an Organizational Application Security Competency"

We have a video abstract online:

The talk is scheduled to be held:

Friday, April 24 09:00 AM
Purple 305

And the session code is: PROF-401

Hope to see folks there!  I'll be in San Francisco and at RSA all week.  Follow me on Twitter @danielcornell for more updates.  If you are going to be in San Francisco and/or at RSA I'd love to meet up.

--Dan
dan _at_ denimgroup.com

OWASP EU Summit in Portugal: Thursday

By Dan Cornell

I must admit - by Thursday I was feeling a little rough.  Mostly because of the two evening soccer (football?) games.  That's far too much running in too short a period of time for me.  Regardless, Thursday shaped up to be another great day with some great project presentations and working groups.  Projects I saw Thursday included:

• James Walden - Source Code Review Project - The Open Review Project (ORPRO) has been working with James Walden and his folks to get all OWASP projects run through at least an automated security source code review.  James presented on his work over the summer getting workflows set up and working with the automated review platform.
• Stephan Evans - Securing WebGoat with mod_security - This was a very interesting presentation on how to address the security vulnerabilities in WebGoat using mod_security rules.  It was cool to see how Lua scripting can be used to address issues that go beyond the typical technical vulnerabilities like SQL injection and cross site scripting (XSS).
• Arturo Busleiman - Enigform and mod_OpenPGP Project - This is an interesting approach to securing web communications that leverages the PGP infrastructure rather than relying on SSL.
• Marcin Wielgoszewski - AntiSamy.NET Project - This is a port of the AntiSamy project to work for .NET environments.

Working groups I attended were:

• Intra-Government Working Group - Lots of great ideas here in two areas.  First - how to get OWASP involved with governmental standards bodies so that we can act as a resource as well as influence standards and practices.  Second - how to better communicate with government consumers on how to best use OWASP resources to make their infrastructures safer.
• OWASP Strategic Planning -  Too many topics to mention here - the results should be coming out in a press release and a summary of the event.
• Chapter Leaders Working Group - It was great to have an opportunity to interact with chapter leaders running chapters in a variety of state of maturity.  Certainly lots of good suggestions that I can bring back to use for the San Antonio chapter.

Mercifully, the Chapter Leaders session ran all the way until our late dinner time so we couldn't play another game of soccer.

--Dan
dan _at_ denimgroup.com

OWASP EU Summit in Portugal: Wednesday

By Dan Cornell

Wednesday was another day packed full of project presentations and working group sessions.  The project presentations I attended included:

• Eduardo Neves - Positive Security Project - Many security programs are focused solely on the negative - what should not be done and so on.  This project is intended to create awareness of the "good" activities teams can perform to build security in.
• Martin Knobloch - Education Project - This goal of this project is to organize OWASP materials so that they can be used in programs to educate developers about application security.  So far they have put together two full training classes with slide decks.
• Juan Carlos Calderon - Internationalization - This project aims to get OWASP materials translated into a variety of languages to as to better distribute them to the developers that need them.
• Lucilla Mancini - PASSWD - The PASSWD project aims to use modeling to predict the security state of applications.
• Me (Dan Cornell) - Open Review Project (ORPRO) - This is a project I have been working with Mario deBoer and the folks from Fortify with for the past couple of months.  The goal is to make security code review services - both automated and manual - available to open source projects.  We are currently working with the folks from Moodle and will be looking to expand that involvement to other projects in the future.  (We're always looking for volunteers, so if you are interesting in performing security reviews for open source code please let me know!)

The working group I attended was:

• Education Project Working Group - Lots of great discussions in this group including how to best structure the courses of instruction as well as thoughts about using the LiveCD Project as a distribution mechanism for courseware.

--Dan
dan _at_ denimgroup.com

OWASP EU Summit in Portugal: Tuesday

By Dan Cornell

[Running a little behind, as usual.  Over the course of today I'll be putting up a series of posts to finish out my OWASP EU Summit notes.]

First of all, my favorite part of Tuesday was that I won a t-shirt at the Sensepost training class on offensive web application hacking.  H4x0r skillz!

 

In addition to that, Tuesday was a really productive day.  I had the opportunity to attend a number of sessions where folks presented their Summer of Code projects and OWASP projects in general:

• Jason Li - JSP Testing Tool - This tools tests JSP tag libraries to determine which attributes are properly escaped when they are written out to the HTML stream.  It does this by generating a large number of JSP/HTML examples with various payloads placed into the tags' attributes.  When the page renders, unescaped payloads change colors of parts of the DOM so you can see which attributes are "dangerous"  This is a very cool approach and it would be interesting to see how it applied to ASP.NET web controls as well.
• Paolo Perego - Orizon - Orizon is a framework for code analysis that can apply various rules to look for security defects.  It currently supports Java and there are plans to make it support .NET.  Source code files are broken down into a number of XML representations and then those XML representations are run through a rules engine to identify potential security issues.
• Alex Smolen - ESAPI.NET - This is the .NET version of the ESAPI.  Currently it is basically a word-for-word port of the Java ESAPI into C#, but the plan is to update the .NET version to accomodate existing security capabilities of the .NET platform such as the Membership API and the AntiXSS library.

I also had an opportunity to attend a number of working groups:

• Tools Working Group
• ESAPI Working Group

The energy and enthusiasm at this event was incredible.  As you'll see from the following posts we covered a lot of ground during the week and a lot got accomplished.

--Dan
dan _at_ denimgroup.com