Different Application Security Testing Tools: Major Classification

 Static Application Security Testing (SAST)

SAST tools can be thought of as white-hat or white-box testing, where the tester knows information about the system or software being tested, including an architecture diagram, access to source code, etc. SAST tools examine source code (at rest) to detect and report weaknesses that can lead to security vulnerabilities.

Source-code analyzers can run on non-compiled code to check for defects such as numerical errors, input validation, race conditions, path traversals, pointers and references, and more. Binary and byte-code analyzers do the same on built and compiled code. Some tools run on source code only, some on compiled code only, and some on both.

Dynamic Application Security Testing (DAST)

In contrast to SAST tools, DAST tools can be thought of as black-hat or black-box testing, where the tester has no prior knowledge of the system. They detect conditions that indicate a security vulnerability in an application in its running state. DAST tools run on operating code to detect issues with interfaces, requests, responses, scripting (i.e. JavaScript), data injection, sessions, authentication, and more.

DAST tools employ fuzzing too: throwing known invalid and unexpected test cases at an application, often in large volume.

Origin Analysis/Software Composition Analysis (SCA)

Software-governance processes that depend on manual inspection are prone to failure. SCA tools examine software to determine the origins of all components and libraries within the software. These tools are highly effective at identifying and finding vulnerabilities in common and popular components, particularly open-source components. They do not, however, detect vulnerabilities for in-house custom developed components.

SCA tools are most effective in finding common and popular libraries and components, particularly open-source pieces. They work by comparing known modules found in code to a list of known vulnerabilities. The SCA tools find components that have known and documented vulnerabilities and will often advise if components are out of date or have patches available.

Database Security Scanning

The SQL Slammer worm of 2003 exploited a known vulnerability in a database-management system that had a patch released more than one year before the attack. Although databases are not always considered part of an application, application developers often rely heavily on the database, and applications can often heavily affect databases. Database-security-scanning tools check for updated patches and versions, weak passwords, configuration errors, access control list (ACL) issues, and more. Some tools can mine logs looking for irregular patterns or actions, such as excessive administrative actions.

Interactive Application Security Testing (IAST) and Hybrid Tools

Hybrid approaches have been available for a long time, but more recently have been categorized and discussed using the term IAST. IAST tools use a combination of static and dynamic analysis techniques. They can test whether known vulnerabilities in code are actually exploitable in the running application.

IAST tools use knowledge of application flow and data flow to create advanced attack scenarios and use dynamic analysis results recursively: as a dynamic scan is being performed, the tool will learn things about the application based on how it responds to test cases. 

Mobile Application Security Testing (MAST)

MAST Tools are a blend of static, dynamic, and forensics analysis. They perform some of the same functions as traditional static and dynamic analyzers but enable mobile code to be run through many of those analyzers as well. MAST tools have specialized features that focus on issues specific to mobile applications, such as jail-breaking or rooting of the device, spoofed WI-FI connections, handling and validation of certificates, prevention of data leakage, and more.

Application Security Testing as a Service (ASTaaS)

As the name suggests, with ASTaaS, you pay someone to perform security testing on your application. The service will usually be a combination of static and dynamic analysis, penetration testing, testing of application programming interfaces (APIs), risk assessments, and more. ASTaaS can be used on traditional applications, especially mobile and web apps.

Momentum for the use of ASTaaS is coming from use of cloud applications, where resources for testing are easier to marshal.

Correlation Tools

Dealing with false positives is a big issue in application security testing. Correlation tools can help reduce some of the noise by providing a central repository for findings from others AST tools.

Different AST tools will have different findings, so correlation tools correlate and analyze results from different AST tools and help with validation and prioritization of findings, including remediation workflows. Whereas some correlation tools include code scanners, they are useful mainly for importing findings from other tools.

Test-Coverage Analyzers

Test-coverage analyzers measure how much of the total program code has been analyzed. The results can be presented in terms of statement coverage (percentage of lines of code tested) or branch coverage (percentage of available paths tested).

For large applications, acceptable levels of coverage can be determined in advance and then compared to the results produced by test-coverage analyzers to accelerate the testing-and-release process. These tools can also detect if particular lines of code or branches of logic are not actually able to be reached during program execution, which is inefficient and a potential security concern. Some SAST tools incorporate this functionality into their products, but standalone products also exist.

Application Security Testing Orchestration (ASTO)

While the term ASTO is newly coined by Gartner since this is an emerging field, there are tools that have been doing ASTO already, mainly those created by correlation-tool vendors. The idea of ASTO is to have central, coordinated management and reporting of all the different AST tools running in an ecosystem. It is still too early to know if the term and product lines will endure, but as automated testing becomes more ubiquitous, ASTO does fill a need.

Selecting Testing Tool Types

There are many factors to consider when selecting from among these different types of AST tools. If you are wondering how to begin, the biggest decision you will make is to get started by beginning using the tools. According to a 2013 Microsoft security study, 76 percent of U.S. developers use no secure application-program process and more than 40 percent of software developers globally said that security wasn't a top priority for them. Our strongest recommendation is that you exclude yourself from these percentages.

There are factors that will help you to decide which type of AST tools to use and to determine which products within an AST tool class to use. It is important to note, however, that no single tool will solve all problems. As stated above, security is not binary; the goal is to reduce risk and exposure.

Network Security Tools

Though they are not directly the part of Application Security domain, however without these fully implemented and running the application shall be prone to more and more risks. There is a separate post for list or types of network security tools.

Various Social Engineering Threats

Social engineering is the clever manipulation of people to gain access to privileged information. It can occur on the telephone, in person, or via email.

SHOULDER SURFING

Shoulder surfing refers to looking over someone's shoulder to obtain information. Be mindful of people nearby when working with sensitive business information. If you step away from your computer, lock it so that others can’t see or access confidential information.

Use a privacy screen to cover your laptop or tablet screen while in use. If you witness someone hovering, acknowledge the person to see what they need. Bring to your supervisor's attention if you are suspicious of their intentions.

TAILGATING

Tailgating is an unauthorized person attempting to gain access to secure office space. Be mindful of people entering behind you. Do not allow tailgating.

Refer anyone without a company badge to reception or security. If you feel threatened or notice suspicious behavior, report the incident to concerned department in your org. In the event of imminent harm, contact local emergency services.

EAVESDROPPING

Eavesdropping refers to secretly listening in on conversations to capture information. Be mindful of who is around when discussing or conducting company business. Do not discuss company business in hallways, shared building spaces, or public places.

Keep confidential discussions behind closed doors.

VISHING

Vishing (voice phishing) happens when you receive a phone call from someone impersonating a trusted source, like your bank, a client, or an employee. They may say there's a problem with your bank account, or credit card and direct you to a web site or phone number where you will be asked to provide personal or company information to verify your identity or account. Beware! They are trying to steal your money, identity, or gain access to organization systems. If you access the Vishing web site from your workstation or smart device, it's possible for hackers to access anything stored there.

Follow your policies and procedures; do not provide personal or payment information to unsolicited callers. Do not attempt to call the number back. Do not take direction from the caller about navigation or use of your tools and systems.

Do not disclose any information unless you are able to verify them, and they are authorized (e.g., if they state they're an employee try to reach them on IM). If you receive a call or a text you suspect to be vishing or smishing, contact spoof@majftech.com with as much information as is available.

SMISHING

Smishing happens when you receive a text message (SMS = smishing) from someone impersonating a trusted source, and the same threats apply as with Vishing.

Do not text scammers back. If you receive a call or a text you suspect to be vishing or smishing, contact spoof@majftech.com with as much information as is available.

PHISHING

Phishing is a form of social engineering in which a fraudulent message is sent to you with the intent of tricking you into opening an attachment, clicking a link, or responding to the message. Phishing typically occurs over email, but can happen during a phone call, through a chat program, in a text message, or even in-person!

Successful phishing attacks can steal your credentials (passwords), install malware on your computer, trick you into disclosing confidential company data, or convince you to take unauthorized actions that benefit the phisher. It is no surprise, that phishing is one of the most common attacks leading to data breaches you see in the news.cWith all the technological defenses in place to prevent phishing emails from landing in your inbox, it’s still one of our biggest security vulnerabilities! Our best resource in defending against phishing is YOU!

Learn the warning signs of such emails:

• Unexpected sender or content
• Threats, urgency, and secrecy
• Phishing or Spam?
• Promised lottery or super amazing deals

What to do If you think you have received a phishing email:

• DO NOT reply to the message.
• DO NOT click on links or open attachments.
• DO report the email by creating a new email message, attaching the phish email, and sending to spoof@majftech.com.
• DO NOT send or "forward" the phishing email to anyone as this can cause further exposure.
• DO permanently delete the phishing email.
• Does the message push for urgent action?
• Does the message threaten bad things will happen if you don't do what it says?
• Is it unusual to use email as authorization for wire transfer? 

GDPR and PCI DSS Intro - General Data Protection Regulation (GDPR) & Payment Card Industry Data Security Standard

General Data Protection Regulation (GDPR) is a new data privacy and security law in Europe.

When will it go into effect?
May 25, 2018.

What is the primary purpose?
To provide EU citizens with greater control over how their personal data is collected, protected and used.

To whom does this regulation apply to?
GDPR applies to how Company must handle all EU customer and employee data.

Is there a penalty for non-compliance?
Yes, the risks are significant financial penalties and legal exposure. Fines up to 4% of annual worldwide revenue or €20 million are possible.



PCI-DSS (the Payment Card Industry Data Security Standard) mandates specific security safeguards for handling credit card data.

Companies are required to adhere to PCI standards as part of our contractual agreements with banks, partners, and credit card companies. Failing to adhere to these requirements could result in significant fines and possibly termination of Companie's ability to accept credit cards for transactions.

Embedding Privacy and Security Impact Assessments into our various business processes to ensure that privacy and security are consulted throughout the lifecycle of data-related initiatives;

Formalizing processes around Data Subject Rights to ensure that we can respond comprehensively and within the timeframe set out in the GDPR;

Updating our Privacy Policies to ensure they are GDPR compliant;

Developing our Data Retention and Deletion Capabilities;

Updating our Vendor Contract Templates to ensure they are in accordance with GDPR requirements; and

Developing our Privacy Resources and Specialist Training Modules to ensure all teams have the information they need.

Some examples of Cyber Security Firms and what they do

This article is a part of my series 'Security is our duty and we shall deliver it'

Following are some examples of Cyber Security Firms and what they do:

IBM Security: Services include- security intelligence and analytics; identity and access management; application security; advanced fraud protection; data security and privacy; and infrastructure protection.

Symantec Software: World's largest security product vendor, largest antivirus (Norton) and a variety of backup and asset management systems manufacturer

Cisco - Products range from advanced malware protection; next generation firewalls; security management; cloud security; next generation prevention systems; VPN security clients; email security; policy and access; web security; network visibility and enforcement; and router security, to name a few.

BAE Systems - It operates through five segments: the electronic systems; the cyber and intelligence systems; intelligence and security systems; applied intelligence; and the platforms and services.

McAfee - One of the biggest antivirus and anti-malware provider in the world.

Palo Alto Networks - It works on Next-Generation Firewall, Advanced Endpoint Protection and Threat Intelligence Cloud. The company’s Next Generation Security Platform was built for breach prevention with threat information shared across a range of security functions that can operate over mobile networks.

Apart from these, there are hundreds of companies around the globe that manufacture security products or provide their services. We have relations with some of the companies fast emerging in these arena and some having good clientele and reputation in terms of Software security implementations. We are close to building one own Software Security product.



You can read and download the article from:
https://www.slideshare.net/toughjamy/security-is-our-duty-and-we-shall-deliver-it-white-paper

Read on LinkedIn:
https://www.linkedin.com/pulse/security-our-duty-we-shall-deliver-mohd-anwar-jamal-faiz/

Security is our duty and we shall deliver it! - A White Paper For Software Security Organizations

Recently, I wrote a White paper. It is titled as - 'Security is our duty and we shall deliver it!'


This paper could be best described in following words-

Quality Management, Information Security, Threat Hunting and Mitigation Plans for a Software Company or a Technology Start-up engaged in building, deploying or consulting in Software and Internet Applications.


The chief sections of the document would be:

1. Introduction to Enterprise Risk & Cyber Security
2. The technologies we employ in
3. Types of Software testing
4. Some examples of Cyber Security Firms and what they do
5. How we achieve a secure product
6. InfoSec and Managed Security Service Provider
7. Training and development
8. Safeguarding against Phishing and Multi-Factor Authentication
9. Threat hunting, mitigation and Vulnerability Management
10. The denouement

You can read and download the article from:
https://www.slideshare.net/toughjamy/security-is-our-duty-and-we-shall-deliver-it-white-paper

Read on LinkedIn:
https://www.linkedin.com/pulse/security-our-duty-we-shall-deliver-mohd-anwar-jamal-faiz/



Following blog posts are must read for any Software Quality and Security Professional or an organization working in this field:

http://www.w3lc.com/2010/05/veracode-as-new-whitebox-testing-tool.html

http://www.w3lc.com/2012/02/analysis-of-valgrind-still-reachable.html

http://www.w3lc.com/2011/07/stress-testing-what-how-when.html

http://www.w3lc.com/2011/02/types-of-software-testing.html

http://www.w3lc.com/2010/10/dos-and-ddos-clarification-on-hacking.html

http://www.w3lc.com/2010/05/baseline-and-traceability-matrix.html

Cheers my readers.
You are my reason to be motivated.

- M. Anwar Jamal Faiz

Pen drive show empty even when data exists : SOLVED : Hidden files/ Virus Security

This is a common symptom when your computer, hard drive or the PD is infected with a malware. You are 100% sure that the disk contains data but that is not visible in the file explorer.

Now there can be multiple ways ti identify and fix it. They are mentioned as following:

1. Simplest is to check if the files are hidden and your explorer settings do not allow you to view hidden files.
To overcome this go to the file/folder settings View -> And select the 'Show System or Hidden files'

2. You definitely have to eventually scan the disk by Antivirus. Do that and the disk will become clean again

3. There is a short DOS level command that could help you overcome the situation.

Steps:

a. Open the DOS command. For the newbies, its a Black command terminal window
You can start it by goint to Start -> Run ->cmd

b. Change your working drive to the target drive. For eg. if your pendrive or disk is E: drive run the following command on DOS terminal
That is, type the following command and press Enter

E:\>attrib -h -r -s /s /d e:\*.*

Now this magical command will not display anything on the terminal. But your work will be done!

This will recursively make all your files and folder on the target drive as Non-hidden.

So now go to File System explore of Windows and open the drive. Voila! Your items are now visible!

A shabby tailor would not be a gentleman's tailor.

Thats true!!

This thought has occured to me a while before. And, I seriously find this a good phrase in the world of Services and Product companies, institutions, and organisations.

Brief of the letter to a leading Software Company( sent a couple of minutes before.) This also describes my phrase coined today i.e. January 28th, 2013.

Dear Company,

For a company as big as you and one of the biggest seller of softwares, products, SaaS and hosted platform services, you should be very cautious of choice of softwares, and your own security mechanisms. Technically, because a shabby tailor would not be a gentleman's tailor.

Yours sincerely,
Anwar Faiz
Toughjamy@Yahoo.Com

PS: I would not reveal the name of the company and the sort of attack or vulnerabilty pointed in their system. I have already send the details, screenshots, source code lines having mistakes, the degree of threat, and possible resolutions to the concerned authorities in the company.

I am not bound to maintain this secrecy, but I feel its ethical :)

Photos of Anwar Faiz with Ankit Fadia in Adobe

This post is in continuation with my old post Meeting with Ankit Fadia. Similar article is also published at My meetinng detail with Mr. Fadia on MeOnShow Forum++

Strings tool from Sysinternals: String Obfuscation Testing to find Hardcoded Strings in source code

It was in 1996, that Sysinternals website was Created. Mark Russinovich and Bryce Cogswell hosted their advanced system utilities and technical information. The Sysinternals utilities help you manage, troubleshoot and diagnose your Windows systems and applications.

One of these Tools is Strings. Current version is v2.5

At times, DLL, executable, .lib and object files have embedded UNICODE/ Ascii strings that you cannot easily see with a standard ASCII strings or grep programs. Strings is a utility that scans the file you pass it. By default, it searches for strings of length of 3 or more. Wonderful part is that it works on nearly all flavors of Windows including Win 95!

This became such a hit that even Microsoft has given great interest in this project. And, the result is that today you can download this utility directly from Microsoft Website. Yes!! MS holds it now!!
Download from: http://technet.microsoft.com/en-us/sysinternals/bb897439.aspx

Using Strings program:-
1. Open a command prompt
2. Run strings
3. There are multiple options that are described as below:-

usage: strings [-a] [-f offset] [-b bytes] [-n length] [-o] [-q] [-s] [-u]
Strings takes wild-card expressions for file names, and additional command line parameters are defined as follows:
-o Print offset (not of much use)
-n This is the minimum string length (default is 3)
-q Quiet mode
-s Recursive traversal of subdirectories
-a ASCIIonly search [default is Unicode and Ascii]
-b how many Bytes in file to scan
-f File offset from which to start scanning.
-u Unicode-only search (Unicode and Ascii is default)
Happy catching your hardcoded strings. Make your product more secure.

DOS and DDOS: An article on Hacking using Denial of Service Attacks

A very common term in the field of hacking and Security is DoS Attack. Hackers employ a number of techniques to attack and disrupt computer systems and networks. There is an important point here, to understand the two flavors of DOS attacks. Attacks can be of different types depending on the aim and speciality of the attacker. Some just want to disrupt computer systems but there are some hackers who intend to infiltrate the computers and steal sensitive information for drastic and really crazy purposes.

DOS or Denial of Service attack: This is a common way to attack a computer network. The main intention of a DOS attack is to disrupt the activities of the server through overloading it with unwanted requests. The attacker usually sends large number of requests to the server which leads to overloading. When the server gets overloaded, it is unable to answer to normal requests. DOS attacks are usually directed at websites. It is very easy to prevent and stop DOS attacks. In very plain words it should be noted that DOS attack if properly done can bring server on knees. Users and some scripts and functions would be starved of some services. These services may be among some of the crucial ones.

As said on the Symantec Website:
“ DoS is a Denial of Service to a victim trying to access a resource. In many cases it can be safey said that the attack requires a protocol flaw as well as some kind of network amplification.
Denial of Services is also an attack on a computer system or network that causes a loss of service to users, typically the loss of network connectivity and services through the the consumption of bandwidth of the victim network, or the overloading the computational resources of the victim system.
The motivation for DoS attacks is not to break into a system. Instead, it is to deny the legitimate use of the system or network to others who need its services. One can say that this will typically happen through one of the following means:
1. Crashing the system.
2. Deny communication between systems.
3. Bring the network or the system down or have it operate at a reduced speed which affects productivity.
4. Hang the system, which is more dangerous than crashing since there is no automatic reboot. Productivity can be disrupted indefinitely.”


There is yet another but more advanced form of denial of service attack. Here, a large number of zombie computers are used to send requests to the server which is being attacked. This is popularly known as DDOS or Distributed Denial of Service Attack. This attack causes the server to get overburdened within a short span of time. The zombie computers are controlled by hackers by means of malware. Because of the large number of computers involved in the attack, the power of the attacker gets magnified thousands of times. The best way to protect against distributed denial of service attacks is to use a traffic filter. A traffic filter is a device that prevents traffic from the IPs from where the malicious requests are originating.
Again it is worth to mention what Symantec website says about this:
“A Distributed DoS (DDoS) is the combined effort of several machines to bring down victim. In many cases there is a master machine that launches the attack to zombie machines that are part of a bot network, as shown below in Figure 1. Some bot networks contain many thousands of machines used to launch an attack.”

-Mohd Anwar Jamal Faiz
Software Engineer (White Box API and Security) at Leading Software Product Company

Veracode as new WhiteBox Testing Tool

Veracode has launched a Software Security Ratings Service, introducing its new system for use in testing the security of applications. Veracode claims to have unveiled the world's first standards-based system for rating the overall security of software programs before they are put into production mode. Again, from usability point of view, Learnin to use VeraCode needs a little more effort than writing 20 lines on Cow!

Veracode SecurityReview delivers benefits to every enterprise:

Exceptional accuracy—The SecurityReview subscription service is supported by a team of world-class experts who constantly review and refine testing methods to deliver the industry's most accurate software security review.
Faster production—SecurityReview accelerates secure application development by providing an application security review that can fit into any development cycle. Because Veracode's solution can handle large volumes of code and return actionable results within 24 to 72 hours, development teams can more easily manage schedules and meet deadlines while ensuring higher security for the enterprise.
Reduced expense—With secure software testing available on an as-needed basis, companies pay only for the services they require.
Complete review—Veracode testing includes tests for malicious code as well as lack of security functionality. It can test both internally and externally developed applications, and can perform dynamic as well as static application security testing. It is simply the most comprehensive software review available.

While many software product have begun using source code analysis tools to look for potential vulnerabilities in their applications, Veracode aims to take the process one step further by offering businesses and ISVs the ability to scan binary code of their programs for problems.

Undoubtedly, there are some constraints on type of build you post to VeraCode for scanning and analysis. There are 5-6 checks as told by VeraCode guideline document. But the, the pre-Scan of VeraCode also helps you a lot if in case you missout something, or forget some symbol files (.pdb files)

Testing binary code allows developers to scan an entire application before it is taken into production, thus increasing their likelihood of finding errors they might have missed along the way, and eliminating the need to pursue code that ends up getting cut from a program before it approaches its final state, Veracode officials said.

The approach also benefits efforts to develop software using the increasingly popular SOA approach by allowing workers to test code being drawn from multiple programs in their final, integrated state, the company maintains. With its great UI, using VeraCode is easy and so helpful!