DOCSLIB.ORG

Cybersecurity Strategy: a Primer for Policy Makers and Those on the Front Line

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Cybersecurity Strategy: a Primer for Policy Makers and Those on the Front Line Cybersecurity Strategy: A Primer for Policy Makers and Those on the Front Line Steven R. Chabinsky* THE PROBLEM The Internet seems to offer the promise of everything to everyone. For global and local business, it lowers costs while increasing innovation, invention, effectiveness, and efficiencies. For wealthy and poor economies alike, the Internet greatly expands markets for products and services. For peoples free and repressed, it provides an inlet and an outlet of expression. For large and small communities, whether living in urban centers or outlying regions, the Internet enables control over critical power, transportation, water, and sewerage systems. Lest we forget, for sophisticated criminals, terrorists, warmongers, and spies, the Internet also offers the chance of a lifetime to cheat, steal, and strike from afar with little money, covered tracks, and enormous real world impact. While the ability to use the same technology for positive or destructive ends is neither new nor momentous, it is necessary to consider whether the rapid adoption of the Internet has provided so considerable an asymmetric advantage to our adversaries that it can change the course of American history. In this regard, when we consider the intent and capabilities of our enemies, we cannot underestimate them or, as the 9/11 Commission found in a different context, suffer from failures in imagination, policy, capabilities, or management. Thus our future remains uncertain. Based on our increasing reliance on networks to drive our economy and support our health, welfare, communications, and security, certain questions loom large. For example, can our enemies control whether, how, and when our systems operate and our vital services get delivered? Are our personal and business records, corporate intellectual property, and state secrets routinely exposed or imperceptibly altered?1 Unfortunately, the answers to these questions not only remain unknown, they perhaps are unknowable. Therefore, it is difficult to provide our nation’s government leaders, corporate executives, shareholders, and citizens with reasonable assurance that our computer systems have not been * Deputy Assistant Director, Federal Bureau of Investigation. 1. Especially worrisome are the cyber attacks that would hijack systems with false information in order to discredit the systems or do lasting physical damage. At a corporate level, attacks of this kind have the potential to create liabilities and losses large enough to bankrupt most companies. At a national level, such attacks directed at critical infrastructure industries have the potential to cause thousands of deaths and hundreds of billions of dollars worth of damage. See U.S. Cyber Consequences Unit (US-CCU), http://www.usccu.us/# Key_Features_ of_the_US-CCU’s_Research (an independent, nonprofit research institute). 27 28 JOURNAL OF NATIONAL SECURITY LAW & POLICY [Vol. 4:27 penetrated, that our software has not been adulterated, and that our hardware does not contain implants. Similarly, it is difficult to state with confidence that over time our mission-critical data and systems – which underlie our economic prosperity, national security, and public health – will remain accurate and available when needed.2 We do know that cyberexploitation is occurring at an unprecedented rate by a growing array of state and nonstate actors against a wide range of targets,3 and that the threat will continue to grow as our society becomes increasingly reliant on information systems.4 For these reasons, just over four months into his Presidency, Barack Obama announced that “our digital infrastructure – the networks and computers we depend on every day – will 2. A glimpse into the full scope of this problem is reflected in the SANS Institute’s expert consensus ranking of the top ten cyber threats: 1. Increasingly Sophisticated Web Site Attacks That Exploit Browser Vulnerabilities – Especially on “Trusted” Web Sites. 2. Increasing Sophistication and Effectiveness in Botnets. 3. Cyber Espionage Efforts by Well Resourced Organizations Looking to Extract Large Amounts of Data – Particularly Using Targeted Phishing. 4. Mobile Phone Threats, Especially Against iPhones and Android-Based Phones; Plus VOIP. 5. Insider Attacks. 6. Advanced Identity Theft from Persistent Bots. 7. Increasingly Malicious Spyware. 8. Web Application Security Exploits. 9. Increasingly Sophisticated Social Engineering Including Blending Phishing with VOIP and Event Phishing. 10. Supply Chain Attacks Infecting Consumer Devices (USB Thumb Drives, GPS Systems, Photo Frames, etc.) Distributed by Trusted Organizations. See SANS Institute, Top Ten Cyber Security Menaces of 2008, http://www.sans.org/press/ top10menaces08.php. 3. The full dimension of the cybersecurity problem includes not only risks to the confidentiality, integrity, and availability of sensitive data, but also substantial risks to the command and control of important physical assets such as electric power grids, water supply, and other critical infrastructure. See, e.g., DEPARTMENT OF HOMELAND SECURITY, PRIMER CONTROL SYSTEMS CYBER SECURITY FRAMEWORK AND TECHNICAL METRICS (2009), available at http://www.us-cert.gov/controlsystems/pdf/Metrics_primer_v9_7-13-09_FINA L.pdf. “Electronic control systems that operate much of the Nation’s critical infrastructure are increasingly connected to public networks, including the Internet. Consequently, control systems and the associated critical infrastructure are at greater risk than before from externally initiated cyber attacks.” Id. at 1. 4. Intelligence Community and Annual Threat Assessment: Hearing Before the Sen. Armed Serv. Comm., 111th Cong. 38 (2009) (statement of Dennis C. Blair, Dir. of Nat’l Intell.), available at http://www.dni.gov/testimonies/20090310_testimony.pdf (“As govern- ment, private sector, and personal activities continue to move to networked operations, as our digital systems add ever more capabilities, as wireless systems become even more ubiquitous, and as the design, manufacture, and service of information technology have moved overseas, the threat will continue to grow.”). 2010] A PRIMER ON CYBERSECURITY STRATEGY 29 be treated as they should be: as a strategic national asset,” to be protected as “a national security priority.”5 To be sure, numerous academic and professional fields have developed around cybersecurity and risk management. All is not lost. Most certainly, there is a corresponding need to guard against an overreaction to these problems that would lead to total risk avoidance at all times for all things. Yet, how many people have the data necessary to assess their vulnerabilities, the threats against them, and the harm they are facing in the event of a successful attack? Each data point is essential to establishing an accurate risk profile and, in turn, making informed decisions about how we prioritize and protect our resources. Similarly, how many directors, officers, and government leaders understand who within and outside their organization affect their risk posture? Is the systems administrator or the chief information security officer in charge? Or, as tends to be the case far too often, is the company put at risk when an employee shows up at work one morning with a thumb drive that he plugs into his desktop’s USB slot? Regrettably, we have brought these vulnerabilities upon ourselves, having first invented the Internet and then having eagerly embraced the ensuing Digital Revolution without establishing a corresponding viable security structure. This point has not been lost on FBI Director Robert Mueller, who likened our predicament to that of Ancient Rome. In 2007, Mueller said: There is an old saying that all roads lead to Rome. In the days of the Roman Empire, roads radiated out from the capital city, spanning more than 52,000 miles. The Romans built these roads to access the vast areas they had conquered. But, in the end, these same roads led to Rome's downfall, for they allowed the invaders to 6 march right up to the city gates. I. FRAMING A CYBERSECURITY STRATEGY It is difficult to develop a national strategy for a subject as vast as cybersecurity. Where do we start and, perhaps equally perplexing, how do we know when to stop and move on toward implementation? From a federal government perspective, these questions were presented not long ago to the National Cyber Study Group (NCSG). The NCSG was formed by the Office of the Director of National Intelligence and began to meet 5. Remarks by the President on Securing Our Nation’s Cyber Infrastructure (May 29, 2009), available at http://www.whitehouse.gov/the_press_office/Remarks-by-the-President- on-Securing-Our-Nations-Cyber-Infrastructure/. 6. Robert S. Mueller, III, Dir., FBI, Address at Penn State Forum Speaker Series (Nov. 6, 2007), available at http://www.fbi.gov/pressrel/speeches/mueller110607.htm. 30 JOURNAL OF NATIONAL SECURITY LAW & POLICY [Vol. 4:27 weekly in May of 2007.7 Under the skillful leadership of Melissa Hathaway,8 the NCSG developed in less than a year the cyber strategy that would later be adopted by the White House as the Comprehensive National Cybersecurity Initiative (CNCI).9 The CNCI is contained within National Security Presidential Directive 54, which is cross-designated as Homeland Security Presidential Directive 23. That document remains classified and therefore unavailable to the public, although the White House has released an unclassified summary.10 Nevertheless, for purposes of this article, knowing the entirety of the policy is less important
Load more

Recommended publications
  • Threat Vector (Thorndike Perss Large Print Basic) by Tom Clancy
    Threat Vector (Thorndike Perss Large Print Basic) by Tom Clancy Ebook Threat Vector (Thorndike Perss Large Print Basic) currently available for review only, if you need complete ebook Threat Vector (Thorndike Perss Large Print Basic) please fill out registration form to access in our databases Download here >> Series:::: Thorndike Perss Large Print Basic+++Paperback:::: 960 pages+++Publisher:::: Large Print Press; Large Print edition (December 3, 2013)+++Language:::: English+++ISBN-10:::: 1594136688+++ISBN-13:::: 978-1594136689+++Product Dimensions::::5.5 x 1 x 8.5 inches++++++ ISBN10 1594136688 ISBN13 978-1594136 Download here >> Description: As China plans to invade Taiwan, and launches a cyber attack on the U.S., President Jack Ryan, his son and the team at the Campus have to act fast if they are going to stop the increasingly rogue nation. (suspense). THREAT VECTOR is a Tom Clancy novel with Jack Ryan written by Mark Greaney. The fact that it’s a Jack Ryan novel makes the story appealing. The book’s relevance to today’s (2016) real world crises with China and Russia makes it even more enticing. As in most Clancy/Greaney novels the first 20 percent of the book is filled with superfluous and boring background narration. If you can wind your way through this early part you will be rewarded. Most of the action takes place in China and the South China Sea. The book is full of exciting, action- packed scenarios. There’s even a couple of good air-to-air battles thrown in to indulge the flyboys among us. President Ryan and Jack Junior play key roles in these scenarios.
    [Show full text]
  • A Study of Android Application Security
    A Study of Android Application Security William Enck, Damien Octeau, Patrick McDaniel, and Swarat Chaudhuri Systems and Internet Infrastructure Security Laboratory Department of Computer Science and Engineering The Pennsylvania State University enck, octeau, mcdaniel, swarat @cse.psu.edu { } Abstract ingly desire it, markets are not in a position to provide security in more than a superficial way [30]. The lack of The fluidity of application markets complicate smart- a common definition for security and the volume of ap- phone security. Although recent efforts have shed light plications ensures that some malicious, questionable, and on particular security issues, there remains little insight vulnerable applications will find their way to market. into broader security characteristics of smartphone ap- In this paper, we broadly characterize the security of plications. This paper seeks to better understand smart- applications in the Android Market. In contrast to past phone application security by studying 1,100 popular studies with narrower foci, e.g., [14, 12], we consider a free Android applications. We introduce the ded decom- breadth of concerns including both dangerous functional- piler, which recovers Android application source code ity and vulnerabilities, and apply a wide range of analysis directly from its installation image. We design and exe- techniques. In this, we make two primary contributions: cute a horizontal study of smartphone applications based on static analysis of 21 million lines of recovered code. We design and implement a Dalvik decompilier, • Our analysis uncovered pervasive use/misuse of person- ded. ded recovers an application’s Java source al/phone identifiers, and deep penetration of advertising solely from its installation image by inferring lost and analytics networks.
    [Show full text]
  • Opentext Product Security Assurance Program
    The Information Company ™ Product Security Assurance Program Contents Objective 03 Scope 03 Sources 03 Introduction 03 Concept and design 04 Development 05 Testing and quality assurance 07 Maintain and support 09 Partnership and responsibility 10 Privavy and Security Policy 11 Product Security Assurance Program 2/11 Objective The goals of the OpenText Product Security Assurance Program (PSAP) are to help ensure that all products, solutions, and services are designed, developed, and maintained with security in mind, and to provide OpenText customers with the assurance that their important assets and information are protected at all times. This document provides a general, public overview of the key aspects and components of the PSAP program. Scope The scope of the PSAP includes all software solutions designed and developed by OpenText and its subsidiaries. All OpenText employees are responsible to uphold and participate in this program. Sources The source of this overview document is the PSAP Standard Operating Procedure (SOP). This SOP is highly confidential in nature, for internal OpenText consumption only. This overview document represents the aspects that are able to be shared with OpenText customers and partners. Introduction OpenText is committed to the confidentiality, integrity, and availability of its customer information. OpenText believes that the foundation of a highly secure system is that the security is built in to the software from the initial stages of its concept, design, development, deployment, and beyond. In this respect,
    [Show full text]
  • The OWASP Application Security Program Quick Start Guide
    Quick Start Guide The OWASP Application Security Program Quick Start Guide Five Days to Setting Up an Application Security Program Quickstart Guide About this Guide This guide is intended to be a short, straightforward introductory guide to standing-up or improving an Application Security Program1. The intended goal of the AppSec program is to implement measures throughout the code’s life- cycle to prevent gaps in the application security policy or the underlying system through flaws in the design, development, deployment, upgrade, or maintenance of the application. The application security program should effectively manage the security of its application systems, protecting information from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality and availability. A fundamental component of this improved application security management is the ability to demonstrate acceptable levels of risk based on defined KPIs, including but limited to: 1. The number of vulnerabilities present in an application 2. The time to fix vulnerabilities 3. The remediation rate of vulnerabilities 4. The time vulnerabilities remain open The application security program deliverables include a holistic view of the state of security for each application, identifying the risks associated with the application and the countermeasures implemented to mitigate those risks, explaining how security is implemented, planning for system downtimes and emergencies, and providing a formal plan to improve the security in one or more of these areas. Audience The intended audience of this document is anyone from security engineers, developers, program managers, senior managers or a senior executive. This guide should be considered the start of a comprehensive approach, it is intended to give the basic questions and answers that should be asked by those who are in charge of the application security program in your organization, this includes those responsible for managing the risk of the entire organization.
    [Show full text]
  • Read Book > Tom Clancy Locked on and Threat Vector
    AXIP4PC16STW ^ PDF ^ Tom Clancy Locked on and Threat Vector (2-In-1 Collection) Tom Clancy Locked on and Th reat V ector (2-In-1 Collection) Filesize: 3.31 MB Reviews Comprehensive guideline! Its such a good read through. It is actually writter in basic words and not confusing. I am just easily could possibly get a enjoyment of reading a composed book. (Lonzo Wilderman) DISCLAIMER | DMCA KQP66MYYB4CV Book < Tom Clancy Locked on and Threat Vector (2-In-1 Collection) TOM CLANCY LOCKED ON AND THREAT VECTOR (2-IN-1 COLLECTION) To save Tom Clancy Locked on and Threat Vector (2-In-1 Collection) PDF, you should click the web link beneath and download the file or have accessibility to other information which are have conjunction with TOM CLANCY LOCKED ON AND THREAT VECTOR (2-IN-1 COLLECTION) book. BRILLIANCE AUDIO, United States, 2015. CD-Audio. Book Condition: New. Unabridged. 170 x 135 mm. Language: English . Brand New. Two Tom Clancy novels in one collection. Locked On Although his father had been reluctant to become a field operative, Jack Ryan Jr. wants nothing more. Privately training with a seasoned Special Forces drill instructor, he s honing his skills to transition his work within The Campus from intelligence analysis to hunting down and eliminating terrorists wherever he can even as Jack Ryan Sr. campaigns for re-election as President of the United States. But what neither father nor son knows is that the political and the personal have just become equally dangerous. A devout enemy of Jack Sr. launches a privately funded vendetta to discredit him by connecting the presidential candidate to a mysterious killing in the past by John Clark, his longtime ally.
    [Show full text]
  • Post 9/11 Maritime Security Measures : Global Maritime Security Versus Facilitation of Global Maritime Trade Norhasliza Mat Salleh World Maritime University
    World Maritime University The Maritime Commons: Digital Repository of the World Maritime University World Maritime University Dissertations Dissertations 2006 Post 9/11 maritime security measures : global maritime security versus facilitation of global maritime trade Norhasliza Mat Salleh World Maritime University Follow this and additional works at: http://commons.wmu.se/all_dissertations Part of the Defense and Security Studies Commons Recommended Citation Mat Salleh, Norhasliza, "Post 9/11 maritime security measures : global maritime security versus facilitation of global maritime trade" (2006). World Maritime University Dissertations. 98. http://commons.wmu.se/all_dissertations/98 This Dissertation is brought to you courtesy of Maritime Commons. Open Access items may be downloaded for non-commercial, fair use academic purposes. No items may be hosted on another server or web site without express written permission from the World Maritime University. For more information, please contact [email protected]. WORLD MARITIME UNIVERSITY Malmö, Sweden POST 9/11 MARITIME SECURITY MEASURES: Global Maritime Security versus the Facilitation of Global Maritime Trade By NORHASLIZA MAT SALLEH Malaysia A dissertation submitted to the World Maritime University in partial fulfilment of the requirements for the award of the degree of MASTERS OF SCIENCE in MARITIME AFFAIRS (MARITIME ADMINISTRATION) 2006 © Copyright Norhasliza MAT SALLEH, 2006 DECLARATION I certify that all material in this dissertation that is not my own work has been identified, and that no material is included for which a degree has previously been conferred on me. The content of this dissertation reflect my own personal views, and are not necessarily endorsed by the University. Signature : …………………………… Date : ……………………………. Supervised by: Cdr.
    [Show full text]
  • Cybersecurity in a Digital Era.Pdf
    Digital McKinsey and Global Risk Practice Cybersecurity in a Digital Era June 2020 Introduction Even before the advent of a global pandemic, executive teams faced a challenging and dynamic environ- ment as they sought to protect their institutions from cyberattack, without degrading their ability to innovate and extract value from technology investments. CISOs and their partners in business and IT functions have had to think through how to protect increasingly valuable digital assets, how to assess threats related to an increasingly fraught geopolitical environment, how to meet increasingly stringent customer and regulatory expectations and how to navigate disruptions to existing cybersecurity models as companies adopt agile development and cloud computing. We believe there are five areas for CIOs, CISOs, CROs and other business leaders to address in particular: 1. Get a strategy in place that will activate the organization. Even more than in the past cybersecurity is a business issue – and cybersecurity effectiveness means action not only from the CISO organiza- tion, but also from application development, infrastructure, product development, customer care, finance, human resources, procurement and risk. A successful cybersecurity strategy supports the business, highlights the actions required from across the enterprise – and perhaps most importantly captures the imagination of the executive in how it can manage risk and also enable business innovation. 2. Create granular, analytic risk management capabilities. There will always be more vulnerabilities to address and more protections you can consider than you will have capacity to implement. Even companies with large and increasing cybersecurity budgets face constraints in how much change the organization can absorb.
    [Show full text]
  • Digital Finance and Data Security
    Digital Finance and Data Security How Private and Secure Is Data Used in Digital Finance? September 2018 AUTHOR Patrick Traynor Acknowledgements Introduction 1 We gratefully acknowledge the Data Privacy and Security Issues in Online Lending 1 generous support provided by the Digital Finance Providers Evaluated 3 Center for Financial Inclusion at Accion, without which this work 1. Privacy Analysis 5 would not have been possible. We Methodology 5 would particularly like to thank Sonja Results 7 Kelly, Director of Research, and Pablo Antón Díaz, Research Manager, for not Conclusions 10 only helping us to work productively with security stakeholders around 2. Security Analysis 11 the world, but also for their tireless Methodology 11 efforts to ensure that these issues are Results 17 prioritized and addressed. Conclusions 25 We also wish to thank Jasmine Bowers, Kevin Butler, and Imani 26 Sherman of the University of Florida, 3. Terms of Service Analysis all of whom made significant contributions to the successful 4. Conclusions and Recommendations 28 completion of this work. Annex A Word Count vs. Average Reading Grade Level of Privacy Policies 30 Annex B Digital Lenders Evaluated and Analyses Performed 32 Notes 33 Introduction Data Privacy and Security Issues Amounts and loan maturities vary from very in Online Lending short-term “nano” loans of a few dollars to Mobile phones and networks are transforming medium-term small business loans of a few the world of finance, creating opportunities hundred or some thousands of dollars. Some for widespread financial inclusion, especially companies have grown to substantial — even among neglected regions and groups.
    [Show full text]
  • Threats to the US Research Enterprise: China's Talent Recruitment
    United States Senate PERMANENT SUBCOMMITTEE ON INVESTIGATIONS Committee on Homeland Security and Governmental Affairs Rob Portman, Chairman Tom Carper, Ranking Member Threats to the U.S. Research Enterprise: China’s Talent Recruitment Plans STAFF REPORT PERMANENT SUBCOMMITTEE ON INVESTIGATIONS UNITED STATES SENATE Threats to the U.S. Research Enterprise: China’s Talent Recruitment Plans TABLE OF CONTENTS I. EXECUTIVE SUMMARY .................................................................................. 1 II. FINDINGS OF FACT AND RECOMMENDATIONS ................................... 7 III. BACKGROUND ................................................................................................ 14 A. China’s Goal to be the Science and Technology Leader by 2050 .................. 14 1. From Brain Drain to Brain Gain .............................................................. 15 2. China’s Systematic Targeting of Critical Technologies ........................... 17 3. China’s Military-Civilian Fusion Strategy .............................................. 18 4. China’s Strategic Plan for Talent Recruitment ....................................... 20 B. Congressional Testimony on Chinese Talent Recruitment Plans ................ 30 C. China Deletes References to the Thousand Talents Plan ............................. 32 D. After Implementation of Talent Recruitment Plans, More Chinese Students, Researchers, and Scientists are Returning to China .................................... 35 IV. EFFORTS TO SECURE U.S. RESEARCH .................................................
    [Show full text]
  • NIST SP 800-163 Rev.1
    NIST Special Publication 800-163 Revision 1 Vetting the Security of Mobile Applications Michael Ogata Josh Franklin Jeffrey Voas Vincent Sritapan Stephen Quirolgico This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-163r1 C O M P U T E R S E C U R I T Y NIST Special Publication 800-163 Revision 1 Vetting the Security of Mobile Applications Michael Ogata Vincent Sritapan Software and Systems Division Office of Science and Technology Information Technology Laboratory U.S. Department of Homeland Security Josh Franklin* Stephen Quirolgico Applied Cybersecurity Division Office of the Chief Information Officer Information Technology Laboratory U.S. Department of Homeland Security Jeffrey Voas *Former employee; all work for this Computer Security Division publication was done while at NIST Information Technology Laboratory This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-163r1 April 2019 U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems.
    [Show full text]
  • The Ten Most Critical API Security Risks TOC Table of Contents
    The Ten Most Critical API Security Risks TOC Table of Contents Table of Contents About OWASP TOC Table of Contents...............................................2 The Open Web Application Security Project FW Foreword.............................................................3 (OWASP) is an open community dedicated to I Introduction..............................................................4 enabling organizations to develop, purchase, and RN Release Notes.......................................................5 maintain applications and APIs that can be trusted. RISK API Security Risk.............................................6 At OWASP, you'll find free and open: T10 OWASP API Security Top 10 - 2019..................7 API1:2019 Broken Object Level Authorization.........8 • Application security tools and standards. API2:2019 Broken User Authentication...................10 • Complete books on application security API3:2019 Excessive Data Exposure.......................12 testing, secure code development, and secure API4:2019 Lack of Resources & Rate Limiting......14 code review. API5:2019 Broken Function Level Authorization...16 • Presentations and videos. API6:2019 Mass Assignment...................................18 • Cheat sheets on many common topics. API7:2019 Security Misconfiguration.....................20 • Standard security controls and libraries. API8:2019 Injection.................................................22 • Local chapters worldwide . API9:2019 Improper Assets Management................24 • Cutting edge research.
    [Show full text]
  • Best Practices: Use of Web Application Firewalls
    OWASP Papers Program Best Practice: Use of Web Application Firewalls Best Practices: Use of Web Application Firewalls Version 1.0.5, March 2008, English translation 25. May 2008 Author: OWASP German Chapter with collaboration from: Maximilian Dermann Mirko Dziadzka Boris Hemkemeier Achim Hoffmann Alexander Meisel Matthias Rohr Thomas Schreiber OWASP Papers Program Best Practice: Use of Web Application Firewalls Abstract Web applications of all kinds, whether online shops or partner portals, have in recent years increasingly become the target of hacker attacks. The attackers are using methods which are specifically aimed at exploiting potential weak spots in the web application software itself – and this is why they are not detected, or are not detected with sufficient accuracy, by traditional IT security systems such as network firewalls or IDS/IPS systems. OWASP develops tools and best practices to support developers, project managers and security testers in the development and operation of secure web applications. Additional protection against attacks, in particular for already productive web applications, is offered by what is still a emerging category of IT security systems, known as Web Application Firewalls (hereinafter referred to simply as WAF), often also called Web Application Shields or Web Application Security Filters. One of the criteria for meeting the security standard of the credit card industry currently in force (PCI DSS - Payment Card Industry Data Security Standard v.1.1) for example, is either a regular source code review or the use of a WAF. The document is aimed primarily at technical decision-makers, especially those responsible for operations and security as well as application owners (specialist department, technical application managers) evaluating the use of a WAF.
    [Show full text]