User management - the next-gen of authentication meetup 27012022
0 likes49 views
The document discusses the evolving landscape of security in modern applications, emphasizing the importance of self-service, user interface security, and multi-tenancy features. It addresses data protection across the lifecycle, highlighting strategies such as access control, encryption, and compliance obligations to enhance overall data security. Additionally, it reviews the OWASP Top 10 security vulnerabilities, providing insights on prevention methods and best practices.
![A05: What About XXE?
• Attackers can exploit vulnerable XML processors if they can upload XML or include hostile content in an XML
document
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<foo>&xxe;</foo>](https://image.slidesharecdn.com/usermanagement-thenext-genofauthenticationmeetup27012022-220128122157/85/User-management-the-next-gen-of-authentication-meetup-27012022-76-320.jpg)
![const axios = require('axios').default;
const url = 'https://api.attacked-company.com/login';
const commonPasswords = downloadCommonPasswords();
var idx = 0;
while (true) {
try {
const { accessToken } = await axios.post(url, {
email: 'john@doe.com',
password: commonPasswords[idx++]
});
takeoverAccount(accessToken);
} catch (e) {
console.log('could not authentication with that password. Will try
with the next one');
}
}
Hey, What is that
code doing?](https://image.slidesharecdn.com/usermanagement-thenext-genofauthenticationmeetup27012022-220128122157/85/User-management-the-next-gen-of-authentication-meetup-27012022-116-320.jpg)
User management - the next-gen of authentication meetup 27012022
- 2. Inversion of Control: Security as an Interface
- 3. Sagi Rodin ● Developing since I was 15 ● Managed R&D in startups ● Developed a high-scale modern application platform @Check Point ● Founder of Frontegg ● Love smoking beef About Me
- 5. Operation System Level End-user → IT → Vendors (Patches)
- 7. R&D feature requests End-user → IT → Vendors (Features)
- 9. Security is for Enterprise Customers End-user → Tickets → Engineers
- 10. What’s Next?
- 11. What’s Next?
- 12. What’s Next? Security as a User Interface
- 13. More than prefer self-served managed apps * According to Frontegg’s self-service survey, 2021
- 14. How other modern apps are doing it? Security On Profile Level
- 15. How other modern apps are doing it? Workspace Level Team Management
- 16. How other modern apps are doing it? Security Policy
- 17. How other modern apps are doing it? Domain Control
- 18. How other modern apps are doing it? Custom Roles and Permissions
- 19. How other modern apps are doing it? API Key Management
- 20. What’s there to control? Personal Security Settings Organizational Security Policy (Passwords, MFA, Account Lockout) Device Management Enterprise SSO Custom Roles and Permissions API Token Management Webhooks Data privacy management
- 21. The Guidelines
- 22. Support Multi-tenancy by Design Basic - Flat Hierarchy based Granular settings Many-to-many user association Allow hybrid deployments per tenant
- 23. Support Multi-tenancy by Design
- 24. Build Abstract Level Roles Enforcement Enforce permissions not roles Enforce on frontend, backend and data layer Don’t assume you know your customers
- 25. Create an Admin Portal Product Infrastructure Allow teams to deploy configuration screens Allow customization of Admin Portal Allow roles enforcement on Admin Portal For Dev Team Convenience
- 26. What did we have so far? Evolution in Products, Security and the Connection between the two How this is handled within modern apps What do we want to expose The three Rules of building a self-serve ready app
- 27. Thank You Questions? I’m Sagi Ping me sagi@frontegg.com
- 28. © 2021 Pagaya. FOR INTERNAL USE ONLY. Confidential Yaniv Toledano, Global CISO & IT 2022 Data Protection – IaaS, SaaS and in between
- 29. © 2021 Pagaya. FOR INTERNAL USE ONLY. Pagaya is a financial technology company that deploys sophisticated data science, machine learning and AI technology to drive better results. Partners utilize Pagaya’s centralized AI and data network to evaluate their customers’ applications in real time. Pagaya believes this solution measures risk and predicts behavior more accurately than legacy approaches, and Pagaya’s performance continuously improves as more information flows through its network. 29 Bank FinTech Dealership Broker Asset Investors Customers
- 30. © 2021 Pagaya. FOR INTERNAL USE ONLY. Intro 30 • 18+ years of experience in the cyber security world • Experienced cyber security manager cross-wide global enterprises • Provided consultation for a wide range of companies & domains: Comcast (US), T-Mobile (US), Rabobank (NL), Clalit Health Insurance (IL) and others. • 8200 IDF veteran • Holding 3 patents in the risk management and privacy domains. Yaniv Toledano
- 31. © 2021 Pagaya. FOR INTERNAL USE ONLY. 31 World’s Biggest Data Breaches & Hacks (Oct 2021)
- 32. © 2021 Pagaya. FOR INTERNAL USE ONLY. © 2021 Pagaya. CONFIDENTIAL. Data is the new Currency… 32 or the new Oil, Gold.. What ever..
- 33. © 2021 Pagaya. FOR INTERNAL USE ONLY. • Do you know what are your threats?!?? Great start! • Are you able to identify your assets? Really? And what about your data flows? • So.. What now?? Lets run with technology and protect.. Secure.. Control.. and put some DLP alike?!? • How are you partners in the process? Do you have any? (Never walk alone..) • Start Rolling… Starting Point…
- 34. © 2021 Pagaya. FOR INTERNAL USE ONLY. © 2021 Pagaya. CONFIDENTIAL. How to Engage.. Just a thought.. 34
- 35. © 2021 Pagaya. FOR INTERNAL USE ONLY. My suggestion… (Data Lifecycle) Discovery Access Control Prevent Exfiltration Encrypt • Tokenize, anonymize and what ever does the job.. • Encryption of container/storage/bucket is not enough. Step 1 Step 2 Step 4 Step 3 Its not the same as before (http/s, FTP, DLP, USB)… API׳s, Lambda׳s, Serverless computing and more.. • Least Privilege approach • Monitor access • Periodic access review • Not focus on human only • Stale • Learn your eco system • Continuously assess • Map your flows • Classify • Generate hierarchy • Generate accountability Strive for a data security posture management (other words, govern!) What can be really cool?
- 36. © 2021 Pagaya. FOR INTERNAL USE ONLY. © 2021 Pagaya. CONFIDENTIAL. Discovery Stage Points of Reference 36
- 37. © 2021 Pagaya. FOR INTERNAL USE ONLY. 37 5 Focus Points (Partial) Understand compliance / Legal obligations 05 Consult with compliance and relevant teams to learn your obligations for protection, access, audit trail, retention & deletion Data Catalog is a must – build one (excel is a good start) Discover your data assets / objects and use Tech to support you 01 Craft a continuous measure to discover your entire stack, allow to build data types and always know where your data is… 03 Define data owner, Data stewards and what every cool taxonomy you can think of 02 Define data flows and make friends in the way… (Data, Devops, Engineering, Legal) Build a baseline to manage your data! Cause you wont be happy when the customer/audit/regulator will come Document, maintain, be happy No Data Owner = No accountability No Stewards = No real understanding of how data is consumed and how to drive access control No Data Flow = No idea of what needs to be protected & which systems store/run it.. Topic What Should I DO Why? 04
- 38. © 2021 Pagaya. FOR INTERNAL USE ONLY. Data Management – R&R 38
- 39. © 2021 Pagaya. FOR INTERNAL USE ONLY. © 2021 Pagaya. CONFIDENTIAL. Data Security 39
- 40. © 2021 Pagaya. FOR INTERNAL USE ONLY. What Data Security is all About – The Threats & Considerations... Data Exfiltration Insider Threat Secure Posture (Bucket encrypted, asset exposed externally..) Retention violation Data manipulation (by mistake, insider threat) Unmanaged/ungoverned access Unauthorized access Shadow IT Over privileged API׳s DevOps are much faster – scale… Stale data – more damage…
- 41. © 2021 Pagaya. FOR INTERNAL USE ONLY. What Data Security is all About – What Should I Think about.. How do I manage permission and access to data Data leakage prevention on all relevant resources Tokenization, encryption & anonymization.. What ever it takes Data security posture is key Periodic access control review Secure Posture (Bucket encrypted, asset exposed externally..) Do I provision access to my cloud assets via my IDE? Do I allow access to my cloud assets directly? Via VDI? Did I map my API׳s and know what traffic? Is it right? No?!? SSPM to ensure proper access control to SaaS apps Audit trail on SaaS apps CASB or other – detect apps… Stale data scanning 3rd party access to Data… Data transfer
- 42. © 2021 Pagaya. FOR INTERNAL USE ONLY. © 2021 Pagaya. CONFIDENTIAL. From a data lifecycle view… 42
- 43. © 2021 Pagaya. FOR INTERNAL USE ONLY. Data Protection controls must be implemented across the data lifecycle to protect sensitive data as it’s collected, stored, used, shared, and destroyed. Data Protection within the environment through the data lifecycle • Data discovery and catalog data sources. • Inventory of data – generate a comprehensive list of pertinent data elements, where it is located and what type of data it is. • Classification of data based on sensitivity and access, and tag data to identify access levels. • RBAC rules to determine who should have access to data. • Enforcing protection of data in motion using secure protocols (e.g., SFTP, TLS 1.2+) • Encryption of data at rest for on- premise and Cloud instances. • Storage integrity and availability between cloud instances/regions/ availability zones. • Encryption key management (e.g., Vault or external EKM). • Masking/tokenization in non-production environments • Adequacy of network bandwidth • Schedule/Timeframe for data transfer. • Enforcing protection of transfers using secure protocols (e.g., SFTP, TLS 1.2+) • Post-transfer data integrity check (validate no errors or data loss during transfer process.) • Security and integrity measures on Cloud platform, such as key repository, strong encryption. • DLP measures • Determine when source data is redundant or extraneous and can be securely removed • Monitor and security remove files from SFTP transfer zones • Verify data integrity (check for data corruption, repair, restore from backups if necessary) • Verify that data is properly retained, and that no unauthorized data has been inadvertently saved. Data Lifecycle Collection Storage Usage and Sharing Retention and Archival Discover & Classify Data Security Monitor & Enforce Capabilities
- 44. © 2021 Pagaya. FOR INTERNAL USE ONLY. 44 Thank you Q&A
- 45. Michael Furman Security Architect, Tufin OWASP Top 10 - 2021 What's New
- 46. What will we cover today? • Who is OWASP? • What is OWASP Top 10? • OWASP Top 10 – Overview and What's New
- 47. About Me • >14 yr. in application security • >9 yr. with Tufin – Lead Security Architect • www.linkedin.com/in/furmanmichael/ • Blog https://ultimatesecurity.pro/ • Twitter @ultimatesecpro • I like to travel, read books and listen to music
- 48. About ●Market Leader in Security Policy Automation ●Tufin is used by >2000 enterprises To segment networks and connect applications On-prem networks, firewalls, cloud and K8S ●We are the Security Policy Company!
- 49. Who is OWASP? • Worldwide not-for-profit organization • Founded in 2001 • OWASP - Open Web Application Security Project • Mission is to make the software security visible.
- 50. OWASP Top 10 • Most successful OWASP Project https://owasp.org/Top10/ • Ten most critical web application security flaws • De facto application security standard • Released every 3 - 4 years • First released in 2004 • Current - 2021
- 51. OWASP Top 10 - 2021 • A01 Broken Access Control • A02 Cryptographic Failures • A03 Injection • A04 Insecure Design • A05 Security Misconfiguration • A06 Vulnerable and Outdated Components • A07 Identification and Authentication Failures • A08 Software and Data Integrity Failures • A09 Security Logging and Monitoring Failures • A10 Server Side Request Forgery (SSRF)
- 52. OWASP Top 10 - 2017 • A1 Injection • A2 Broken Authentication • A3 Sensitive Data Exposure • A4 XML External Entities • A5 Broken Access Control • A6 Security Misconfiguration • A7 Cross-Site Scripting (XSS) • A8 Insecure Deserialization • A9 Using Components with Known Vulnerabilities • A10 Insufficient Logging & Monitoring
- 53. What happened to …? • Broken Access Control • Cross-Site Scripting (XSS) • XML External Entities (XXE) • Insecure Deserialization
- 54. They are still here • A03 Injection • Cross-Site Scripting (XSS) • A05 Security Misconfiguration • XML External Entities • A08 Software and Data Integrity Failures • Insecure Deserialization
- 55. And even more … • A03 Injection • Cross-Site Scripting (XSS) • A04 Insecure Design • A05 Security Misconfiguration • XML External Entities • A08 Software and Data Integrity Failures • Insecure Deserialization • A10 Server Side Request Forgery (SSRF)
- 57. What can I do?
- 58. A01: Broken Access Control • Moved up from fifth position • Elevation of privilege or Privilege Escalation • Acting as an admin when logged in as a user • Acting as a user without being logged in • Viewing or editing someone else's account • IDOR - Insecure Direct Object References • Cross-Origin Resource Sharing (CORS) misconfiguration • Allows API access from unauthorized/untrusted origins
- 59. A01: Example 1 • Application provides the service: • Attacker browses to target URLs: https://example.com/app/getappInfo https://example.com/app/admin_getappInfo https://example.com/app/getadminappInfo
- 60. A01: Example 2 • Unverified parameters to access: • Attacker modifies the parameter: pstmt.setString(1, request.getParameter(“account")); ResultSet results = pstmt.executeQuery( ); https://example.com/app/accountInfo?account=notmyaccount
- 61. A01: How to Prevent • Default behavior: deny access to resources – Except for public resources • Implement access control mechanisms – On the server side – All requests • Minimize CORS usage
- 62. A01: Example 1 • Validate access on each request and prevent access for unauthorized users. • Annotation example: // implementation of getadminappInfo if (“a user has admin access”) { // return admin app Info } else { // authorization error } @PreAuthorize("hasPermision(‘admin’)") // implementation of getadminappInfo { // return admin app Info }
- 63. A01: Example 2 • Verify ownership / access: pstmt.setString(1, request.getParameter("account")); if (“a user has access to account”) { ResultSet results = pstmt.executeQuery( ); } else { // authorization error }
- 64. A02: Cryptographic Failures • Previously known as “A3 Sensitive Data Exposure” – a broad symptom rather than a root cause • Sensitive data is transmitted or stored in clear text • Deprecated or weak cryptographic algorithms in use • Default crypto keys in use – proper key management or rotation missing
- 65. A02: How to Prevent • Encrypt all sensitive data at rest • Encrypt all data in transit • Use TLS 1.2 or above • Use HTTP Strict Transport Security (HSTS) • Use up-to-date and strong standard algorithms and protocols • Use proper key management
- 66. A03: Injection • Slid down from first position • Was the first one since OWASP Top Ten - 2010 • User input is not validated, filtered, or sanitized by the application • User input is directly used or concatenated • SQL injection • OS Command Injection
- 67. A03: Example • User input is directly used in the SQL call: String query = "SELECT * FROM accounts WHERE custID=‘” + request.getParameter("id") + "'";
- 68. A03: How to Prevent • Do not pass user input directly to executable statements • Prepared Statements • Parameterized Queries • Hibernate
- 69. A03: Example • Use PreparedStatement: String id = request.getParameter("id"); String query = "SELECT * FROM accounts WHERE custID = ? "; PreparedStatement pstmt = connection.prepareStatement( id ); pstmt.setInt( 1, id); ResultSet results = pstmt.executeQuery( );
- 70. A03: Don’t Forget About XSS • Attackers can execute scripts in a victim’s browser
- 71. A03: How to Prevent XSS • Input validation for user input • Whitelist patterns • Encode output
- 72. A04: Insecure Design • A new category • Pushing "shift-left“ approach • A secure design can still have insecure implementation • An insecure design cannot be fixed by an implementation Implementation Requirements Design Verification Release
- 73. A04: How to Implement • Threat modeling • Threat Modeling Manifesto https://www.threatmodelingmanifesto.org/ • Secure Development Lifecycle (SDL) https://ultimatesecurity.pro/post/sdl-meetup/
- 74. A05: Security Misconfiguration • Missing security hardening • Unnecessary features are enabled or installed • Unnecessary ports • Services • Accounts • Default accounts • Default passwords
- 75. A05: How to Prevent • Apply security hardening • CIS Benchmarks https://www.cisecurity.org/cis-benchmarks/ • Close unnecessary ports • Disable unnecessary services • Remove default accounts • Change default passwords
- 76. A05: What About XXE? • Attackers can exploit vulnerable XML processors if they can upload XML or include hostile content in an XML document <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///etc/passwd" >]> <foo>&xxe;</foo>
- 77. A05: How to Prevent XXE • Disable XML external entity and DTD processing in all XML parsers in the application, as per the OWASP Cheat Sheet 'XXE Prevention’. https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet • For additional details see the presentation: https://ultimatesecurity.pro/post/xxe-meetup/
- 78. A06: Vulnerable and Outdated Components • Software is vulnerable, unsupported, or out of date • Apache Log4j (Log4Shell) Vulnerabilities
- 79. A06: How to Prevent • Update software periodically • Use Software Composition Analysis (SCA) tools • Free or commercial tools • OWASP Dependency-Check free tool https://owasp.org/www-project-dependency-check/
- 80. A07: Identification and Authentication Failures • Slid down from the second position • Previously known as Broken Authentication • Missing brute force protection • Missing multi-factor authentication • Using default, weak, or well-known passwords • Password1 or "admin/admin" • Reusing session identifier after successful login • Exposing session identifier in the URL
- 81. A07: How to Prevent • Implement brute force protection • Implement multi-factor authentication • Change default credentials • Implement password complexity • Rotate Session IDs after successful login
- 82. A08: Software and Data Integrity Failures • New category • Software and data integrity failures that does not protect against integrity violations • SolarWinds 2020 Attack
- 83. A08: How to Prevent • Use digital signatures to verify software • Ensure you consume trusted repositories
- 84. A08: Remember Insecure Deserialization? • Serialization is the process of translating data structures or object state into a format that can be stored or transmitted and reconstructed later (deserialization) • Insecure Deserialization - an attacker changes the object between serialization and deserialization
- 85. A08: How to Prevent Insecure Deserialization • Don't accept serialized objects from untrusted sources
- 86. A09: Security Logging and Monitoring Failures • Insufficient logging • Logins • Failed logins • High-value transactions • Logs are only stored locally
- 87. A09: How to Prevent • Log important events with sufficient user context • Username • Client IP • Time
- 88. A10: Server Side Request Forgery (SSRF) • New category • A web application is fetching a remote resource without validating the user-supplied URL http://host/getImage?url=http://10.0.0.1 http://10.0.0.1 Response Response from http://10.0.0.1
- 89. A10: Example 1 • Application provides the getImage service: // getImage implementation String imageUrl = request.getParameter(“url")); URL URL = new URL(imageUrl); InputStream is = url.openStream(); OutputStream os = response.getOutputStream(); // copy is to os and return a response
- 90. A10: SSRF CVEs • CVE-2021-44224 • High Severity Apache HTTP Server CVE • CVE-2021-26715 • Critical Severity MITREid OpenID Connect Server CVE
- 91. A10: How to Prevent • Sanitize and validate all client-supplied input data • Validate URL Components • URL schema, port, and destination • Do not send raw responses to clients
- 92. A10: Example 1 • Validate URL Components: // getImage implementation String imageUrl = request.getParameter(“url")); URL url = new URL(imageUrl); // validate URL schema, port, and destination
- 93. Take always • Understand OWASP Top Ten • Implement the recommendations
- 94. Thank you! • Contact me – www.linkedin.com/in/furmanmichael/ – https://ultimatesecurity.pro/ – @ultimatesecpro Questions?
- 95. API access is broken this is how you fix it
- 96. About Me Tuba player Obsessed over football Listening to Classical music and metal (depends on code he is writing)
- 99. The 3 questions every API developer should ask
- 100. Who am I?
- 101. Where do I belong?
- 102. What can you do?
- 103. What’s an API access made of?
- 104. “Is the act of proving an assertion, such as the identity of a computer system user. In contrast with identification, the act of indicating a person or thing's identity, authentication is the process of verifying that identity.It might involve validating personal identity documents, verifying the authenticity of a website with a digital certificate, determining the age of an artifact by carbon dating, or ensuring that a product or document is not counterfeit.” What is authentication wikipedia
- 105. Let me know who you are first! Trying to access a resource?
- 106. Let’s fix some stuff
- 107. Broken: API Authentication WHO ARE YOU?
- 108. Broken: session management Exposes session identifier in the URL. Reuse session identifier after successful login. Does not correctly invalidate Session IDs.
- 109. Hey, What’s wrong here? Your session is floating on URLS!
- 110. Fixing session management Use a server-side, secure, built-in session manager Session identifier should not be in the URL, be securely stored, Invalidate sessions after logout, idle, and absolute timeouts
- 112. Thinking of re-inventing the wheel???
- 116. const axios = require('axios').default; const url = 'https://api.attacked-company.com/login'; const commonPasswords = downloadCommonPasswords(); var idx = 0; while (true) { try { const { accessToken } = await axios.post(url, { email: 'john@doe.com', password: commonPasswords[idx++] }); takeoverAccount(accessToken); } catch (e) { console.log('could not authentication with that password. Will try with the next one'); } } Hey, What is that code doing?
- 118. Fixing automated attacks Public APIS (Login, Signup, Reset password ETC) - Recaptcha (v3) - DDOS protected with IP based filtering Authenticated APIs should be rate limited - Limit or increasingly delay failed login - Log failures and alerts - Prepare to block sessions
- 119. Fixing automated attacks Rate limits based on API type
- 120. Fixing automated attacks LOG EVERYTHING !!!
- 121. Log everything - What are we looking for? IP addresses / Forwarded Origin / Referer Headers / Cookies User agents
- 122. Fixing automated attacks Failed logins? This is what you should do - Implement user lockout mechanisms - Start delaying failed attempts - be careful not to create a denial of service scenario Log all failures and alert administrators when credential stuffing, brute force, or other attacks are detected.
- 123. Verify your users identity (JWT vs Session tokens)
- 127. Verify your users identity (JWT vs Session tokens)
- 128. Bottom line? Building a modern application? Use JWT (hybrid modes works as well)
- 129. Don’t leave your users behind... Authentication has evolved. Your APIs should support this as well
- 131. Fixing broken basic authentication Switch to passwordless MFA everywhere SSO whenever possible Require Re-authentication for Sensitive Features¶
- 132. Broken: API context
- 135. Broken API context Bypassing access control checks by modifying the URL (parameter tampering or force browsing), internal application state, or the HTML page, or by using an attack tool modifying API requests. Permitting viewing or editing someone else's account, by providing its unique identifier (insecure direct object references)
- 139. Fixing broken API context Pass context from JWT to microservices via Reverse Proxy headers
- 140. Fixing broken API context DON’T forget to remove incoming headers before proxying to remove the risk of header tampering
- 141. Fixing broken API context Try to avoid query/route params for REST API If you are using query/route params for REST API: - Use guards (!)
- 144. API context fixed!
- 146. Common issues Elevation of privilege - Acting as a user without being logged in - Acting as an admin when logged in as a user
- 147. Accessing non-privileged entities Accessing a private Github repository Accessing repository of a different team on the same organization Accessing hidden features Accessing features out of my subscription plan
- 148. Elevation of privilege - Common Techniques Technique 1: Access Token Manipulation. Technique 2: Non authenticated access Technique 3: Access Token Manipulation. Technique 4: Account Manipulation
- 150. Fixing API authorization Except for public resources, deny by default. Implement access control mechanisms once and re-use them throughout the application, including minimizing Cross-Origin Resource Sharing (CORS) usage. Model access controls should enforce record ownership rather than accepting that the user can create, read, update, or delete any record. Unique application business limit requirements should be enforced by domain models.
- 151. The old way
- 152. Put the data on the JWT Enforce on the server side Decode and validate on the frontend side
- 153. But what happens with entities? How do you handle hierarchical entities? How do you handle Feature Flags?
- 154. Can’t we put them on the JWT as well?
- 157. The Policy As Code way
- 159. Summarizing
- 160. Questions
- 161. Thank You Questions?
- 162. • Thank You! • Questions? • To be continued… Join Us: https://www.linkedin.com/company/ap plication-security-virtual-meetups