This PDF Is Provided Solely As a Reader Service. It Is Not Intended for Reproduction Or Public Distribution
Total Page：16
File Type：pdf, Size：1020Kb
Copyright (c) 2007, CMP Media LLC. Important note: This PDF is provided solely as a reader service. It is not intended for reproduction or public distribution. For more information on obtaining a Reprint, please contact a Reprint Services Rep at 516.562.7026 or visit www.cmpreprints.com/faxback.jhtml CODEF SCANNERS A LL S E { Sense of Security? } AS MORE CUSTOM-BUILT SOFTWARE MAKES ITS WAY INTO YOUR APP INFRASTRUCTURE, THE THREAT LANDSCAPE IS SHIFTING. CAN AN AUTOMATED CODE SCANNER SECURE YOUR BUSINESS, OR WILL IT SIMPLY LULL THE IT STAFF WHILE CRIMINALS by Justin Schuh Illustration by Ryan Etter PROWL? REMEMBER WHEN ATTACKERS WERE JUST OUT FOR FAME AND requirements. Purpose-built apps provide the frame- glory, and application security was someone else’s prob- work for a huge range of business processes, from lem? Big targets like Microsoft and Oracle drew the fire. dynamic Web sites, SOA (service-oriented architecture) All enterprise IT had to do was apply patches regularly and e-commerce to business process automation and and keep a properly configured firewall. administration. They also provide a target-rich environ- Those days are gone. Cracking corporate networks is ment for would be attackers. no longer a kid’s game, it’s a lucrative criminal growth In response to this escalating threat, major compliance industry. The attackers who stole 45.6 million credit- standards like HIPAA and PCI DSS (Payment Card Industry and debit-card numbers Data Security Standard) are incorporating—or at least STRATEGIC from TJX Companies were implying the necessity of—application security processes. {}Security professional enough to Of course, where there’s a regulation, there’s a mar- remain undetected for at keting op. In this case, makers of automated source- least 10 months. Meanwhile, major software vendors, code analysis tools are shifting their focus from com- including Microsoft, have improved their security prac- mercial software vendors to enterprises. They say tices, which puts niche and in-house-developed software adopting their tools will let your developers build more and Web applications squarely in the bad guys’ sights. secure software and meet the compliance burden. It seems enterprise IT is finally grasping the liability But are they up to the job? insecure coding practices represent. Data protection and To find out, we brought three popular static source- application-software security were chosen as the most code analyzers into our Chicago Neohapsis partner lab: critical issues through 2008 in the 2006 CSI/FBI Comput- Fortify SCA (Source Code Analysis) 4.0, Klocwork K7.5 er Crime and Security Survey, above policy and regulatory and Ounce Labs’ Ounce 4.1. We also asked Coverity to compliance, and identity theft/data-leakage prevention. send its Prevent analyzer, but the company declined, If you think your network’s not at risk, consider that citing insufficient resources. most software isn’t built for commercial distribution; Each product has strengths and weaknesses, but any it’s developed in-house or on contract for specific would be a useful addition to a mature security process. IMPACT ASSESSMENT: SOURCE-CODE SEC URITY ANALYZERS BENEFIT RISK Source-code scanners can simplify Deploying an analyzer without the process of developing secure a security-focused SDLC (software software, a vital function given the IT Organization development lifecycle) will only number of custom applications exacerbate poor development deployed today—and the number practices. of attackers targeting them. Source-code scanners help establish Business users must accept that Business a trackable, repeatable process for a secure SDLC takes time. If devel- Organization producing secure software that will opers become overly dependent on serve the business, without making analyzers, they could eclipse other you a target. best practices. Business More secure software reduces When used incorrectly, scanners Competitiveness the chances of publicly reported provide a false sense of security vulnerabilities and compromises. and hinder genuine security efforts. Source-code scanners provide an additional tool for producing more secure software and preventing a major vulnerability from compromising data. BOTTOM LINE But they’re no panacea—as part of a security-focused SDLC, they can help. But code analysis alone will not keep attackers, or the compliance XXXXXXXXXpolice, at bay. Copyright (c) 2007, CMP Media LLC. Important note: This PDF is provided solely as a reader service. It is not intended for reproduction or public distribution. For more information on obtaining a Reprint, please contact a Reprint Services Rep at 516.562.7026 or visit www.cmpreprints.com/faxback.jhtml And therein lies our most important point: A code scan- ner, no matter how effective, is only part of the answer. TECHNIQUES TO EVALUATE Without adequate developer training and an SDLC (soft- EFFECTIVENESS OF SECURITY ware development lifecycle) that makes security a priority, Security audits no tool will protect your network. Sound familiar? 82%82% by internal sta We’ve long advocated a defense-in-depth strategy that recognizes that there is no perimeter. Security groups have Penetration testing 66%66% implemented technologies like host intrusion prevention, NAC and database-extrusion prevention that seek to Automated tools 66% thwart attackers who have infiltrated outer lines of Security audits by 662%2% defense before they gain access to sensitive information. external organization E-mail monitoring But that’s no longer enough. It’s time for enterprise 61%61% soware IT to partner with in-house and contract developers to Web activity 58%58% make security Job 1. The application development group monitoring soware and the security group all sit under the CIO, so even though security pros typically have had a different None 5% world view from developers, who are mainly concerned SSourcource: CompCompututeerr SecuritySecurity Institute with providing the functionality requested by the busi- ness, political issues can be overcome. for developers and software-security pros. Claiming an IT generalist can operate a source-code scanner is akin A CHILD CAN USE IT. REALLY. to saying a person can use a spell checker on a foreign- Along with most every other IT vendor, makers of applica- language document when he understands neither the tion-security scanners are piling on the compliance gravy language nor the subject matter. These tools do provide train, claiming that everyone from QA managers to project defect-tracking features that are useful at many levels, leads will find their wares provide valuable insight. but all that is contingent on results first being reviewed This is marketing spin, not reality. These are tools by a security-knowledgeable developer. Ultimately, you can’t automate your way to secure THE COMPLIANCE software—any combination of analysis tools is only as PERSPECTIVE effective as the security knowledge of the user. As Michael Howard, co-author of Writing Secure Code (Microsoft Press, 2002) and one of the lead architects of SINCE 2000, regulatory compliance actions have Microsoft’s current security posture, put it in his blog: targeted companies for data spills linked to applica- “Not-so-knowledgeable-developer + great tools = mar- tion vulnerabilities. Currently, the Federal Trade ginally more secure code.” Producing applications that Commission Web site lists settlements made with can withstand attack mandates that developers make Guidance Software, DSW Inc. and a real estate fundamental adjustments to the SDLC. We recommend services company, Nations Holding Co. Could an taking advantage of documented processes, including automated scanning tool have helped these organ- Microsoft’s SDL (Security Development Lifecycle), The izations escape compliance liability? Open Web Application Security Project’s CLASP (Com- Not on their own, no. Merely remediating vali- prehensive Lightweight Application Security Process) dated hits from an automated code scanner doesn’t and general techniques available at the National Cyber constitute “reasonable” or “appropriate” applica- Security Division’s “Build Security In” portal. tion security measures. Think of it this way: If you Analysis technology is advancing rapidly as well, with don’t own a calculator, buying one may help you do every vendor constantly trying to leapfrog rivals. That’s your taxes, but it’s a stretch to point to your calcu- good for customers, but it makes for a dynamic market. lator during an audit. By the same token, if scan- This is one technology that absolutely requires a pilot ning alone fails to find large and obvious classes of test to ensure a specific automated source-code analyzer vulnerabilities—including the most critical ones— is the right choice for your applications and development then remediating based on the results of scanning environment. In “Code Scanners Run the Gauntlet” (find alone falls far short of compliance. For more, see it at nwcreports.com), we discuss breadth of languages, “Weak Application Security Equals Noncompliance,” platforms and development environments supported. at nwc.com/go/0416infoweek. —Dave Stampley, Think of an analysis tool as a multiplier: In the hands Neohapsis general council of security-conscious developers, and with appropriate supporting process, a good code analyzer can help your company produce much more secure software. However, Copyright (c) 2007, CMP Media LLC. Important note: This PDF is provided solely as a reader service. It is not intended for reproduction