Denim Group, Ltd.

Favorite Recent Blog Posts

By Dan Cornell

I've been quite the blog-post-slacker lately, but I have at least been halfway keeping up on my blog and news reading.  Here are some of my favorite posts from the last week or so:

• Gazza on the Software Security Market - Interesting post from Mark Curphey with some updated numbers about the software security market.  Very cool to see how the focus is shifting from pen testing to source code review.
• Are You a Builder or a Breaker - Another great post from Mark Curphey that echoes a problem we have had with the security market for far too long.  This is the focus on breaking unsecure systems rather than building secure ones.  The longer the industry focused on the "cool guy" process of breaking systems and making people look bad rather than the "actual solution" approach of designing security into systems from the ground up, the slower progress will be.
• SDL Press Tour Announcements - Blog post from Steve Lipner talking about some of the things Microsoft is doing to promote their Secure Development Lifecycle (SDL) beyond Microsoft's walls.  Microsoft pushing SDL to a wider audience is pretty exciting stuff so keep an eye out for more information.

--Dan
dan _at_ denimgroup.com

IBM Rational Software Development Conference (RSDC) Slide Deck Online

By Dan Cornell

A couple of weeks ago I was at the IBM Rational Software Development Conference (RSDC) and I gave a presentation on static analysis, dynamic analysis and how to use them together.  My slide deck is online here.

--Dan
dan _at_ denimgroup.com

Static Analysis Talk at Texas A&M University

By Dan Cornell

May 14th I gave a talk to the Texas A&M IT Forum about Static Analysis.  They were kind enough to record the presentation and put it online.

There are a couple of things to note:

• The volume is kind of low so you have to turn it up and listen.
• I saw issues with browsers switching from the "Welcome and Introduction" clip to the "Dan Cornell speaks on Application Security" clip.  In order to bypass this I clicked on "Dan Cornell speaks on Application Security" just below the video clip.

Thanks again to all the folks at Texas A&M University for giving me the opportunity to speak.

--Dan
dan _at_ denimgroup.com

ROOTS Conference Wrap Up

By Dan Cornell

I made it back to the States after the ROOTS conference and wanted to post some comments.  It was a great conference with a lot of interesting folks and I was thrilled to have the opportunity to present.

On Tuesday, Andre Klingsheim and Lars-Helge Netland gave a great talk on Architectural Risk Analysis.  They ran us through a fantastic exercise where we had to work with folks at our tables and rank the most common causes of death in the USA.  My partner and I did all right - we got all the right causes of death but had some of them in the wrong order.  That was useful for examining perceived versus actual risk.  They also discussed the traditional Risk = Probability x Impact formula for quantitative risk analysis and why it is challenging to apply consistently across practitioners and projects so we also looked at qualitative risk analysis.  This is great material for software developers to cover and having more conversations in this area can do nothing but help increase the awareness of software security issues across the industry.

Martin Knobloch and Marinus Kuivenhoven gave a fantastic Application Security Workshop on Wednesday.  They went through an introduction to OWASP tools like WebScarab and WebGoat and then walked through the OWASP Top 10 2007 with examples.  I have been over this material a number of times, but I got a lot of benefit out of a number of the examples and case studies they talked about.  Again - presentations like this can only help to get the software development community more interested in the security implications of the applications they are producing.

Thanks again to the ROOTS committee and all the attendees.

--Dan
dan _at_ denimgroup.com

(The picture is of an extremely well-dressed stick figure crossing the street in Bergen, Norway)

ROOTS Slide Deck Online

By Dan Cornell

The slide deck from my talk at ROOTS 2008 is now up online.  That talk covered security testing with static analysis tools and dynamic analysis tools, looked at strengths and weaknesses of both approaches and then discussed how to us them together.

This has been a great conference and I hope to post some more details shortly.

--Dan
dan _at_ denimgroup.com

(Photo is of a statue of Henrik Ibsen here in Bergen, Norway)

OWASP AppSec 2007 San Jose: Day 1

By Dan Cornell

As mentioned before, John Dickson and I are up at the OWASP AppSec 2007 San Jose conference this week.  I had a chance to attend some great sessions and talk witha  bunch of great folks today.  Here are some notes:

• The keynote speakers were Dave Cullinane and Michael Barrett from eBay and PayPal.  Michael had to run off to catch a plane, but Dave gave a great overview of the scale of the problem eBay faces trying to build a trusted platform for commerce.
• Chris Wysopal's talk about finding backdoors in software was fantastic.  It had some great analysis of backdoors discovered in software in the past and great discussion of possible signatures for static analysis tools that can help identify potential backdoors.  It is hard enough to find security vulnerabilities introduced into software accidentally - looking for backdoors intentionally crafted and inserted is just that much harder.
• Eric Sheridan's talk about Cross Site Request Forgery was very informative and I am looking forward to trying out his two new CSRF tools.
• I caught up with IBM Watchfire's Ory Segal. He gave me a demo of some of the new AppScan 7.7 features.  I have been slacking off but I finally got a copy of the beta and will be looking at it through the end of this week.  So far it looks to be pretty impressive.  I'm looking forward to the new "state inducer" feature that allows you to record more complicated workflows to get an application into a state where you can actually test it.  Think of an application with a three step process - you need to go through steps one and two before you can test the functionality at step three.  This has been a problem with scanners we have used in the past when we are testing more complicated web applications implementing multi-step processes.
• Amichai Shulman's talk about defeating Web 2.0 vulnerabilities was basically a web application firewall commercial - but I suppose that is to be expected.  He did have an excellent point that given the number of CSRF vulnerabilities that exist in existing code it is a daunting task to try to eliminate them all in code.  From that standpoint WAFs certainly do have a place in any serious application security infrastructure.
• I caught the tail-end of Robert "RSnake" Hansen's talk about browser insecurities.  OWASP is launching a Working Group to deal with browser insecurity issues and I look forward to seeing what the come up with.
• The "Building and Effective Application Security Assurance Program" panel did a good job of laying out what does and does not work when creating such programs.  Hint: don't pick a tool and think that your problems are solved.
• The OWASP Leaders meeting was a good chance to put some names with faces.  It also made me realize that the Texas chapters - San Antonio, Austin, Houston - need to do a better job of attending the OWASP national conferences.
• As always the OWASP Dinner was a great chance to relax after an day packed with great information.

So that is a wrap up of Day 1.  More info to come on Day 2.

--Dan
dan _at_ denimgroup.com

Webinar Series: Threat Modeling for the Masses

By Dan Cornell

Denim Group's John Dickson will be presenting a two-part webinar series titled "Threat Modeling for the Masses."  This series will introduce the concepts of Threat Modeling and will put it in a context so that these techniques can be used by more people involved in the system creation process.  Previously Threat Modeling was typically done by developers and software architects – this webinar series pushes these capabilities down to IT security personnel, project managers and other interested parties.

Also, you can check out John's previous webinar on the purchase of SPI Dynamics and Watchfire here.

--Dan

dan _at_denimgroup.com

Webinar Online: Top Two Web Application Scanner Companies Acquired

By Dan Cornell

Recently Denim Group's John Dickson did a webinar with some commentary about the acquisition of Watchfire and SPI Dynamics by IBM and HP respectively.  It is now available online for download.

Keep an eye on this space for John's upcoming webinar series on Threat Modeling.

--Dan
dan _at_ denimgroup.com

IBM Acquires Watchfire

By Dan Cornell

Today IBM announced that they will be purchasing Watchfire.  Press release is here.  It was interesting to see that Watchfire's tools were slated to find a home with the Rational development tools rather than the business unit that was formerly ISS.  Personally I think that is a great idea because it give the application security tools to the application developers.

--Dan
dan _at_ denimgroup.com

Watchfire Blogs

By Dan Cornell

I heard from Watchfire's Ory Segal today that they have rolled out a new blogging site.  I especially like the post on Man vs. Machine because it offers a new perspective on the differences between technical and logical vulnerabilities.

--Dan
dan _at_ denimgroup.com