Home page logo
/

webappsec logo WebApp Sec mailing list archives

RE: The Right Approach to Web Developer Education
From: "Cronican, John" <JCronican () sempra com>
Date: Tue, 29 Jun 2004 10:47:16 -0700

I think part of the problem is elsewhere.  Many software teams do not
receive security requirements.  Others software managers, that should
know better to no ask for security requirements.  I hypothesize that all
applications have security requirements.  There is always information
"Integrity" requirements.  My definition of information integrity is:

A characteristic that ensures computer resources operate correctly and
that the data in the data bases are correct. This characteristic
protects against deliberate or inadvertent unauthorized manipulations.
This characteristic is applicable to hardware, software, firmware, and
the data bases used by the system.

John

John G. Cronican, Jr. (BEE, MSSM, CISSP, IAM)
Sr. Infrastructure Technologist
iProtect Sempra Energy
Sempra Energy Corporate Center & Sempra Energy Utilities
10949 Technology Place
San Diego, CA  92127
(858) 613-5738 (Desk)
(619) 787-1906 (Cell)
(619) 978-2493 (Pager)
 
JCronican () sempra com


-----Original Message-----
From: Burke, Charles [mailto:Charles_Burke () HomeDepot com]
Sent: Tuesday, June 29, 2004 9:25 AM
To: webappsec () securityfocus com
Subject: RE: The Right Approach to Web Developer Education


I agree there are lazy programmers but lets face the facts!
1.  Many software teams don't have 'time/money' to design/develop robust
security into code.
2.  We always blame the software engineers but the blame belongs to
management.
3.  As a software engineer I always created two designs.  The 'right'
design that was secure and efficient.  And the 'managements design'
after my design was thrown out!
4.  IDE vendors understand that if they incorporate 'easy to use' and
'inexpensive' components that will 'help' developers build secure
applications 'quickly'. IT WILL SELL!



-----Original Message-----
From: Mark Curphey [mailto:mark () curphey com] 
Sent: Tuesday, June 29, 2004 11:34 AM
To: webappsec () securityfocus com
Subject: The Right Approach to Web Developer Education


Well said. If you want people to do the right thing, you have to make it
easy for them to do the right thing ! 

-----Original Message-----
From: Madsen, Villy [mailto:Villy.Madsen () atcoitek com] 
Sent: Tuesday, June 29, 2004 10:19 AM
To: Mads Rasmussen; Mark Curphey
Cc: webappsec () securityfocus com; Jeff Williams
Subject: RE: Finally - Curphey award 2004 to SPI Dynamics

While I do not advocate that Developers be allowed to get lazy about
security,

I also feel that providing a standard tool that they can use to filter
input is a bad thing.

Way back a couple of decades ago, I was involved in a Telco project to
rewrite an application used by Long Distance Telephone operators to
manage "Time and Charges" calls.   The application was finally shut down
in 2000.

One of the "breakthroughs" that we pioneered was the heavy use of what
was we called Table Driven IO.  All data input or output from the system
was defined by a set of mapping tables, that defined what the data could
look like, how long it was, and where it was mapped to in the
application data schema. 

The "mapping" applications were general purpose, checked for proper type
- performing whatever data conversions where necessary, guarded against
overflows etc etc.

Sounds very similar to me.

I thought it was a great idea then, and I still do...

One application to vet (the mapping routine), and a bunch of tables to
validate.

Easier than validating all of the code snippets that are "accepting
Input" from the external world....


Villy


Villy Madsen ISP GSEC
Information Security
ATCO I-Tek
Bus: (780) 420-5093
Cell: (780) 975-0110
Fax: (780) 420-3916
Mailto:Villy.Madsen () atcoitek com

The information transmitted is intended only for the addressee and may
contain confidential, proprietary and/or privileged material.  Any
unauthorized review, distribution or other use of or the taking of any
action in reliance upon this information is prohibited.  If you received
this in error, please contact the sender and delete or destroy this
message and any copies.


-----Original Message-----
From: Mads Rasmussen [mailto:mads () opencs com br]
Sent: Tuesday, June 29, 2004 5:47 AM
To: Mark Curphey
Cc: webappsec () securityfocus com; Jeff Williams
Subject: Re: Finally - Curphey award 2004 to SPI Dynamics


Mark Curphey wrote:
Here I am, depressed at the prospect of filling in mountains of
expense claims from weeks of traveling and approving mundane mails to 
webappsec about XSS after XSS and along comes a shining light. At last

an "application security" company that gets it ! Hats of to the folks
at SPI and the Curphey Award for 2004 for leading the industry down 
the right path !

http://biz.yahoo.com/prnews/040628/clm006_1.html

Here is another link http://www.eweek.com/article2/0,1759,1617901,00.asp

I don't know about you guys but I have a bad feeling about this. I am 
not sure this is the right path.

The article quotes Caleb Sima, founder and chief technology officer of 
SPI Dynamics saying "It doesn't require developers to learn about 
security," - "You really just need to validate input to eliminate most 
application vulnerabilities."

Shouldn't you at least have a feeling for where the developers makes 
their mistakes to be able to insert the right piece of secure code?

By all means it looks like a cool product, but how much can we trust it?

One of its features is, qoute
"Input Validation objects will check incoming data on web forms to
validate user-supplied input against a set of rules and prevent
parameter manipulation exploits, such as SQL Injection attacks."

Can we trust these "set of rules".
If they opened their technology, the OWASP team could contribute rules 
to such a database and then we just might get somewhere by having a list

of f.ex regular expressions for using the validator classes in .Net or 
input validation in general but that would probably not happen.

I am concerned that products like this just leads to lazy developers.

Jeff what do you think about this? You wanted to start an input 
validation project based on filters, a database like described above 
would be quite handy :o)

Just my two bits

-- 
Mads Rasmussen, M.Sc.
Open Communications Security
www.opencs.com.br
+55 11 3345 2525


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]