Application Lecurity Lectures by professor
- 1. AHMET KEMAL AYGIN ahmetkemal.aygin@uskudar.edu.tr CYS504- Application Security Lesson Four Security Tests
- 2. Scope of Lesson • Vulnerability Assessments And Penetration Testing • Degree Of Knowledge • Vulnerability Scannıng • Attack Methodology • Testing Guidelines • Penetration Testing Considerations • Rules Of Engagement • Types Of Penetration Tests • Approaches To Testing • OWASP • OWASP TOP 10
- 3. • Vulnerability Assessment • Physical / Administrative/ Logical • Identify weaknesses • Penetration Testing • Ethical hacking to validate discovered weaknesses • Red Teams (Attack)/Blue Teams (Defend) • NIST SP 800-115 Guideline on Security Testing Vulnerability Assessments And Penetration Testing
- 4. • Zero Knowledge (Black Box Testing): Team has no knowledge of the target and must start with only information that is publically available. This simulates an external attack • •Partial Knowledge(Gray box): The team has limited knowledge of the organization • •Full Knowledge(White box): This simulates an internal attack. The team has full knowledge of network operations Degree Of Knowledge
- 5. Vulnerability Scanning identifies: • Active hosts on network • Active and vulnerable services (ports) on hosts • Applications • Operating systems • Vulnerabilities associated with discovered OS & applications • Misconfigured settings • Testing compliance with host application usage/security policies • Establishing a foundation for penetration testing Vulnerability Scanning
- 6. Test Attacks 1.Reconnaissance • Who Is Database, Company Website, Job Search Engines, Social Networking 2. Footprinting • Mapping the network (Nmap) • ICMP ping sweeps • DNS zone transfers 3. Fingerprinting • Identifying host information • Port scanning 4. Vulnerability assessment • Identifying weaknesses in system configurations • Discovering unpatched software Attack Methodology
- 7. 5. The “attack” • Penetration • Privilege escalation • Run As, SU • Root kits • Collection of tools to allow continued access. Includes • Back Door software • Can update the kernel of the operating system • Very difficult to detect • Cover tracks • Trojaned Programs: The Attacker replaces default utilities with ones that masquerade as system utilities that provide normal services, with the exception of helping identify the backdoor software • Log Scrubbers Attack Methodology
- 8. Why Test? • Risk analysis • Certification • Accreditation • Security architectures • Policy development Develop a cohesive, well-planned, and operational security testing program Testing Guidelines
- 9. Three basic requirements: • Meet with Senior management to determine the goal of the Assessment • Document Rules of Engagement • Get sign off from Senior Management Issue: it could disrupt productivity and systems • Overall purpose is to determine subject’s ability to withstand an attack and determine effectiveness of current security measures • Tester should determine effectiveness of safeguards and identify areas of improvement. Penetration Testing Considerations
- 10. • Specific IP addresses/ranges to be tested • Any restricted hosts • A list of acceptable testing techniques • Times when testing is to be conducted • Points of contact for the penetration testing team, the targeted systems, and the networks • Measures to prevent law enforcement being called with false alarms • Handling of information collected by penetration testing team Rules of Engagement
- 11. Physical Security • Access into building or department • Wiring closets, locked file cabinets, offices, server room, sensitive areas • Remove materials from building • Administrative Security • Help desk giving out sensitive information, data on disposed disks • Logical Security • Attacks on systems, networks, communication Types Of Penetration Tests
- 12. • Do not rely on single method of attack • Get creative • Path of least resistance • Start with users—social engineering is often the easiest way to gain access • Break the rules • Even if a company follows its own policy, standards and procedures, it does not mean that there are not vulnerabilities • Attempt things not expected Approaches To Testing
- 13. • Do not rely exclusively on high-tech tools • Dumpster diving • Stealth methods may be required • Do not damage systems or data • Do not overlook small weakness in search for the big ones • Have a toolkit of techniques Approaches To Testing
- 14. List of all active hosts • Network services: • ICMP • UDP & TCP • Port scanner: • Nmap • Finger Printing • Banner Grabbing Network Scanning
- 15. Goal is to identify weak passwords • Passwords are generally stored and transmitted in an encrypted form called a hash • Password cracking requires captured password hashes • Hashes can be intercepted • Can be retrieved from the targeted system Password Cracking
- 16. • Dictionary attack • Brute force • Hybrid attack • LanMan password hashes • Theoretically all passwords are “crackable” • Rainbow tables Password Cracking Techniques
- 17. • The Open Web Application Security Project® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. OWASP
- 18. • A01:2021 – Broken Access Control • A02:2021 – Cryptographic Failures • A03:2021 – Injection • A04:2021 – Insecure Design • A05:2021 – Security Misconfiguration • A06:2021 – Vulnerable and Outdated Components • A07:2021 – Identification and Authentication Failures • A08:2021 – Software and Data Integrity Failures • A09:2021 – Security Logging and Monitoring Failures • A10:2021 – Server-Side Request Forgery (SSRF) OWASP Top 10 - 2021
- 19. • Vulnerability Assessments And Penetration Testing • Degree Of Knowledge • Vulnerability Scannıng • Attack Methodology • Testıng Guidelines • Penetratıon Testing Considerations • Rules Of Engagement • Types Of Penetration Tests • Approaches To Testing • OWASP • OWASP TOP 10 What we learned Today?
- 20. Thanx