Updated OWASP Top 10 for 2021

Leave a reply

OWASP has updated its Top 10 list for 2021.

What is OWASP?

The Open Web Application Security Project (OWASP) is a non-profit foundation dedicated to improving the security of software. The Open Web Application Security Project® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. OWASP is a repository of all things web-application-security, backed by the extensive knowledge and experience of its open community contributors.

What is the OWASP Top 10?

OWASP Top 10 is an online document on OWASP’s website that provides ranking of and remediation guidance for the top 10 most critical web application security risks. The report is based on a consensus among security experts from around the world. The risks are ranked and based on the frequency of discovered security defects, the severity of the vulnerabilities, and the magnitude of their potential impacts. The purpose of the report is to offer developers and web application security professionals insight into the most prevalent security risks so that they may incorporate the report’s findings and recommendations into their security practices, thereby minimizing the presence of these known risks in their applications.

Here’s the updated 2021 Top 10 list:

  • A01:2021-Broken Access Control moves up from the fifth position to the category with the most serious web application security risk; the contributed data indicates that on average, 3.81% of applications tested had one or more Common Weakness Enumerations (CWEs) with more than 318k occurrences of CWEs in this risk category. The 34 CWEs mapped to Broken Access Control had more occurrences in applications than any other category.
  • A02:2021-Cryptographic Failures shifts up one position to #2, previously known as A3:2017-Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed name focuses on failures related to cryptography as it has been implicitly before. This category often leads to sensitive data exposure or system compromise.
  • A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection with a max incidence rate of 19%, an average incidence rate of 3.37%, and the 33 CWEs mapped into this category have the second most occurrences in applications with 274k occurrences. Cross-site Scripting is now part of this category in this edition.
  • A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, we need more threat modeling, secure design patterns and principles, and reference architectures. An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks.
  • A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration, with an average incidence rate of 4.5%, and over 208k occurrences of CWEs mapped to this risk category. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for A4:2017-XML External Entities (XXE) is now part of this risk category.
  • A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
  • A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
  • A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. A8:2017-Insecure Deserialization is now a part of this larger category.
  • A09:2021-Security Logging and Monitoring Failures was previously A10:2017-Insufficient Logging & Monitoring and is added from the Top 10 community survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
  • A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.

Sources:

https://owasp.org/Top10/

https://www.synopsys.com/glossary/what-is-owasp-top-10.html

Partnering with the Business to Improve Your Company’s Security

Leave a reply

The string of high profile ransomware attacks on major companies has led executives and boards to take security seriously. In the past, spending money on security is a hard sell and security folks often resort to using the FUD factor (fear, uncertainty and doubt) to implement security projects. Now, they are realizing the importance of security to avoid major disruptions and keep the business going.

For security folks, this is the best time to forge the partnership with the business. You should define strategic directions for both the business and security. Map out a high high-level path to get from current to future objectives as well as identify organizational
roadblocks, standards/policy challenges, and business goals. This is not a one and done thing. Continue to collaborate and have an ongoing discussion to maintain the relationship and to determine if things have changed such as new strategies.

Security folks must understand the business value. Work closely with them to strike the appropriate balance for risk acceptance, and make sure the risk is stated in the context of business objectives.

While you have the attention of the business, do not squander this opportunity.

Securing Your Data on AWS S3

Leave a reply

If you store critical and sensitive data on the cloud, particularly on AWS S3 object storage, it is important that you continually protect and monitor your data. Fortunately, AWS has a lot of tools to help you secure them. AWS built their services with security in mind. However, it is still your responsibility as a data owner to protect your data.

Here are the top ten best practices for securing your data on AWS S3:

  1. Ensure that your S3 buckets are not publicly accessible by using Amazon S3 block public access.
  2. Ensure that your S3 buckets have the correct policies. Use Amazon S3 bucket policy and IAM user policy, as well as the bucket access control list (ACL) to implement effective permissions on the buckets. Make sure to implement least privilege access, granting only minimal rights for users to get their jobs done.
  3. Encrypt data at rest on the server side using Amazon S3 managed keys (SSE-S3), customer master keys stored in AWS Key Management Service (SSE-KMS), or customer-provided keys (SSE-C). You can also encrypt your data on the client side before uploading to AWS S3.
  4. Encrypt data in transit using HTTPS (TLS). You can enforce this by setting it in the Amazon S3 bucket policies.
  5. Enable and require VPC endpoints for AWS S3 access. A VPC endpoint can help prevent traffic from potentially traversing the open internet and being subject to the open internet environment.
  6. Enable versioning to keep multiple versions of a file in the same bucket. With versioning, you can easily recover files from both unintended user actions and application failures.
  7. Use cross-region replication (CRR) to replicate your data to a different AWS region, thereby increasing data resiliency.
  8. Enable multi factor authentication (MFA) Delete and S3 Object Lock feature to prevent malicious or accidental bucket deletions.
  9. Continually monitor and audit your S3 buckets by using AWS tools such as Cloudwatch, Cloudtrail, S3 access logging, and AWS Config.
  10. Use AWS Access Analyzer for S3 to quickly analyze resource policies, continuously monitor and analyze permissions, and resolve findings by updating policies.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html

Disaster Recovery Site vs Cyber Recovery Site

Leave a reply

While the ultimate goal of both Disaster Recovery (DR) and Cyber Recovery(CR) is the same, to bring your IT services back online after an event, DR and CR differ in many ways. DR protects against physical disasters (such as flooding, earthquake, fire, terrorist attacks), user errors, and hardware malfunctions, while CR protects against cyber attacks.

Because of these differences, a DR site may not be able to provide the necessary function for restoring systems after a cyber attack. A Cyber Recovery site is needed to recover your systems from a cyber attack. A CR site is a vaulted site, containing replicated data of critical systems. It is isolated from the network and only connects during replication. A CR site doesn’t have to be in a geographically separate location (unlike a DR site), but it should be physically secured. In fact, it will be beneficial if it’s close to the primary Data Center to take advantage of a fast network connection.

DR usually supports most of the business operations (since disasters are usually bigger in magnitude), whereas CR supports only the most critical systems for operational recovery.

While IT admins have access to a DR site, a CR site should be restricted to a few select security folks.

Usually a DR site is also dormant, but a CR site will always have monitoring and analytics tool – checking for security breaches.

Many companies with mature IT infrastructure typically have a DR site. They also conduct regular DR tests. But most do not have a Cyber Recovery site yet. With the prevalence of cyber security attacks, it is high time for companies to install Cyber Recovery sites and conduct regular cyber recovery tests.

Checklist for a Secure Backup Infrastructure

Leave a reply

Ramsomware attacks are running rampant these days. The ability to restore your servers, data and applications after an attack is critical to minimize costly disruption and bring your business back in service.

A secure backup infrastructure is key to this. Here’s a checklist on how to keep your backup systems robust and secure:

  1. Backup and retain data for several weeks. For critical systems, you will know right away if they have been compromised. But some may take days or weeks before you know you have been attacked or get a demand for payment from attackers. It’s better to have retained good copies of backup to restore.
  2. Replicate backup to an offsite location.
  3. Conduct regular file recovery and bare metal recovery tests.
  4. Perform regular patching and upgrade of backup devices. You also need to work with your device vendor to discuss vulnerabilities, monitor security advisories and apply critical security patches as soon as possible.
  5. Harden your backup infrastructure, for instance by replacing default passwords and turning off unneeded services.
  6. Implement data-at-rest and data-in-flight encryption.
  7. Monitor and send alerts for unusual activities such as privileged user multiple login attempts as well as backup deletion attempts. You can integrate with Splunk, CyberSense or other security analytics applications that have advance AI technology to easily monitor, detect, and analyze security breaches.
  8. Recertify user accounts on your backup devices periodically.
  9. Use security tool to store and encrypt local and service accounts passwords on the devices.
  10. Use two factor authentication.
  11. Implement Retention Lock.
  12. Implement backup vault by isolating the second copies of the backup. This can be done by using tapes or air gapping the backup storage.

Safeguarding Against Ransomware

Leave a reply

The latest ransomware attack on Colonial Pipeline that resulted in the company shutting down its gas pipeline and causing fuel shortages throughout the southeastern United States underscored the importance of securing and protecting your IT infrastructure. Hackers are increasingly attacking critical infrastructure, hospitals, local government, school systems, industrial companies, etc. and and these attacks are becoming a national security, public, and safety threat. Most of these companies are ill prepared for cyber attacks. Last month, the Massachusetts vehicle inspection system was down for a couple of weeks due to ransomware attack.

Ransomware infects your system by encrypting your important files, and the attackers then ask for ransom to decrypt your data in order to become operational again. Sometimes they also threaten to release hacked documents to the public unless the ransom is paid.

Ransomware has been around for the past several years, but the explosion of cryptocurrencies, in which transactions are difficult to trace, is the main reason for the increasing ransomware attacks. Moreover, these cyber extortionists are usually from other countries which is hard for governments to prosecute.

To protect your systems, you must have a comprehensive cyber security program. You should always employ a defense-in-depth approach in which defensive mechanisms are layered to protect your systems, data and applications. If one mechanism fails, another protection layer may thwart the attack. The following basic security measures should also be in place:

  1. Requiring multifactor authentication (MFA) for employees logging onto systems. Users are usually the weakest link as they are easily tricked or socially engineered to give information or click on a malware site enabling the ransomware to penetrate the system. MFA may thwart attackers who got a hold of your credentials by using a second method of authentication.
  2. Patching vulnerabilities promptly on your network devices, servers, appliances, databases and applications, especially the critical ones. You should also work closely with your IT vendor or service provider in regularly reviewing vulnerabilities on their software or services.
  3. Hardening your devices, operating systems and software such as replacing default passwords and turning off unneeded services. If your company also develops programs in-house, you should also enable secure software development.
  4. Segmenting networks by erecting firewalls between them and only allowing traffic that are really necessary.
  5. Keeping backups of your servers and data, and sending a second backup copy off line (using tapes), or via air-gapped second copy (see my blog on data backup security)
  6. Testing your disaster recovery or cybersecurity plan periodically to that ensure they work.

Having a comprehensive cybersecurity plan is necessary for your business to withstand attack in order to stay in business.

Effective Incident Response and Management

Leave a reply

Cyber attacks are all too common these days. They are getting faster, more frequent and more sophisticated. Companies should be prepared when these inevitable attacks occur. One of the critical security controls to mitigate and lower this risk is to have an effective incident response and management program.

The goal of the incident response and management program is to successfully detect, understand, manage, investigate, and recover from the breach in the shortest amount of time possible. Not having an effective program:

  • may damage company reputation, lose money, customers, and competitive advantage, or incur hefty fines
  • may take several weeks or months to detect the breach
  • maybe too late for the company to develop procedures, data collection, legal protocols, and communications strategy when a breach occurs
  • may lead to panic mode leading to more damage, infecting more systems and losing more data.

An effective incident management plan should:

  • determine and document the scope of the breach (such as systems and data impacted, department impacted, magnitude of impact, and severity)
  • collect forensic evidence from log data, security tools, disk images, security video, etc.
  • perform root cause analysis (RCA)
  • return to secure state by remediation or mitigation
  • gather threat intelligence to improve defense, deploy security solutions, and detect malicious behaviors

There are several processes for an effective incident response: Preparation Process -> Detection Process -> Analysis Process -> Notification Process -> Remediation or Mitigation Process

What to do in the preparation process:

  1. Understand your environment and the threats to it
  2. Define roles and responsibilities and contact information
  3. Gather third-party contact information to be used to report a security incident, such as Law Enforcement, relevant government departments, vendors, etc.
  4. Plan how to respond and identify key partners, data sources and technologies
  5. Practice just like a Disaster Recovery (DR) test
  6. Continually review and refine the plan as the environment changes

What to do during detection process:

  1. Assess threats by gaining visibility to any active threats
  2. Define reporting outlet and encourage end user reporting
  3. Use technology to detect attack
  4. Contain damages by stopping the attack and recovering the affected endpoints

What to do during analysis process:

  1. Determine the impact and scope of the breach
  2. Protect and preserve the forensic evidence for investigation and root cause analysis
  3. Perform any remediation

What to do during notification process:

  1. Communicate diligently to upper management, internal stakeholders, or end users
  2. If the breach has to be communicated externally (e.g. to customers, law enforcement, etc.), involve the legal team and use your defined communication strategy.

What to do during remediation or mitigation process:

  1. Implement temporary measures
  2. Coordinate with stakeholders
  3. Document changes
  4. Secure defenses

An effective incident response program is a well documented plan (consisting of people, processes, and technologies) that is up to date and highly tailored to the need of the company.

IoT Security

Leave a reply

The Internet of Things, or IoT, refers to the billions of physical devices around the world that are now connected to the Internet. These include surveillance cameras, lightbulbs, medical devices, pacemakers, smartphones, home routers, thermostats, printers, control systems and pretty much any device that is connected to the Internet, all collecting and sharing data. They have sensors that detect states or movement of equipment or materials and the data acquired by the sensors are transmitted over the network to a server. Location information can be derived as well.

The explosion of IoT devices has also increased cyberattacks on them. Hackers probe and access them via http, ftp or telnet ports to check what kind of devices they are. They also check for backdoor ports. Then they gain access by logging in via telnet (the common one, although they may also use other vulnerable ports) using default or weak username and password, and sometimes using dictionary attack. Once they gain access, they will install malware. Once malware is installed, the device will be under control of the hacker’s server, and is then used for further cyberattacks.

Hackers usually control hundreds of thousands of IoT devices all around the world that are used for DDoS (Distributed Denial-of-Service) attacks. These DDoS attacks can cause significant impact to companies being targeted.

IoT devices are specially vulnerable because they are usually online 24/7, they don’t have security or anti-virus protection, they have weak/default login password and they have global IP addresses. Security is an afterthought of the manufacturers of these devices.

To mitigate IoT security vulnerabilities, there should be an active monitoring and alerting system that notify users when their IoT devices are vulnerable, so they can take appropriate action. Technology solutions must be established to remotely detoxify IoT malware while the original IoT functions can continue to operate. There should also be a way to remotely disable IoT device.

Companies should have a strict security controls for connecting IoT devices in their network.

Finally, the industry should develop IoT security guidelines for IoT device maker/developer, IoT service provider, and IoT device user, as well as promote international standardization.

The Need for Using MFA in IT Infrastructure Devices

Leave a reply

Multi Factor Authentication or MFA should be understood by now (hopefully) and should be widely used and implemented.

What is MFA? MFA is a simple best practice that adds an extra layer of protection on top of your user name and password. With MFA, when you sign in to a website or device, you will be prompted for your user name and password (the first factor — what you know), as well as for an authentication response from your MFA device (the second factor — what you have) such as a text message to your mobile device, or a string of numbers from an authenticator app (such as Google Authenticator). Taken together, these multiple factors provide increased security for your account settings and resources.

Most financial sites and apps, for instance, have been using MFA for years to protect your money.

In corporate settings, many breaches and cyberattacks are due to hackers gaining unauthorized access using accounts that are not properly protected. These accounts use simple and guessable passwords (Pasword123), factory default passwords, passwords written on sticky notes, passwords derived from social media profile (such as birthday or pet name), and passwords derived from social engineering and phishing attacks. Using multi factor authentication will lessen the risk of hackers gaining access to your corporate network.

However a lot of IT infrastructure devices do not use MFA. Privileged accounts on network routers, switches, application servers, database servers, hypervisors, storage and backup devices, etc. should use MFA to strengthen their security. Manufacturers should make it easy to configure MFA on these devices.

Creating a Cybersecurity Culture for your Organization

Leave a reply

As more and more organizations are becoming digital, accelerated by the Covid-19 pandemic, it is imperative for businesses to build a culture of cybersecurity. This enables them to be more resilient in the face of growing cyber attacks.

Many of these organizations, especially in the manufacturing sectors, have developed a robust safety culture where every employee is trained, knowledgable, and constantly reminded of ways to stay safe and decrease the chance of accidents. But when it comes to cybersecurity, most organizations do not have a similar culture of security.

Just like building a safety culture, building a cybersecurity culture is a big undertaking and usually takes time. It involves transforming processes, changing mindset, getting support from leadership all the way to the top, and changing the way every employee works.

Many companies think that technology alone will solve cybersecurity problems. They rely on the IT department and in some cases on the security office – if one exists – to mitigate security issues. But the goal of every orgainization should be that everyone must feel personally responsible for keeping the company secure.

Building a culture of cybersecurity involves everyone’s attitudes, beliefs and values that will drive behaviors that will lead to better actions such as not clicking a link on a phishing email or not visiting an unknown website. At the heart of a culture of cybersecurity is getting every employee to execute their day-to-day activities in ways that keep the organization as secure as possible.

For more information on this topic and to gain insights on how to build a culture of cybersecurity, visit the MIT CAMS website at https://cams.mit.edu/research/