Why is application security so important for enterprises in today's business environment?

Gone are the days when security breaches could be pushed aside and dealt with behind closed doors. Security breaches of all flavors have made front-page news since the beginning of 2005--several of which can be blamed on the insecure applications rolled out by organizations to enable online activities for customers and end-users.

Organizations are building more complex applications to run their online businesses, while consumers continue to entrust organization with very sensitive data. Here are the questions your company needs to ask when designing, or even using, application software:

Who should be concerned with application security?

Architects, developers, and project managers developing third-party applications should place emphasis on application security principles. However, vulnerabilities within custom in-house applications are more common and pose significant risk to sensitive information, such as consumers' personal financial information.

What are the inherent security risks in the application design process?

Developers need to build in secure coding techniques, such as encryption, authentication, and passwords. Until recently, many of these techniques have not been taught in college classes for software developers. Therefore, many software engineers writing code are not educated about these techniques and are not aware of potential problems. For example, there are standard pieces of the C/C++ programming language that are insecure and should be used with great caution, or omitted from the process altogether.

What are some of the most common vulnerabilities in enterprise applications?

Common vulnerabilities can include authorization bypass, SQL injection vulnerabilities, buffer overflow, and information leaks and can affect both commercial and custom applications. Authorization bypass occurs when a normal user is able to access information from a Website or other application that was meant for an administrator or select group of individuals.

SQL injection is used for exploiting Web applications that use client-supplied data in SQL queries without removing potentially harmful characters first. There are quite a few systems connected to the Internet that are vulnerable to this type of attack. In this situation, data provided by a user, such as account number and username, is used to look up additional data on the SQL database. A knowledgeable attacker can provide SQL commands which get passed to the database and executed. The attacker can then inject commands and manipulate the database to do what it wants, such as providing user account information and details.

Buffer overflow is another example of a vulnerability that has plagued the commercial software industry and can also appear in custom applications. A buffer overflow occurs when a program or process tries to store more data on a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to hold a limited amount of information, the extra data can spill over into adjacent buffers, corrupting and deleting the valid data held in them.

When do vulnerabilities find their way into the application design process?

Vulnerabilities typically find their way into applications during two phases of development--application design and application implementation. It is best to identify vulnerabilities during the design, rather than discovering issues during implementation and going back to re-design pieces of the application.

How can developers address security from the beginning of application development and design?

A holistic approach to building security into the development lifecycle will save time and money. Problems identified early in the process and addressed at each step are much easier to solve. Security practices should be in place during requirements planning, design time, implementation, and testing time in order to catch the majority of problems as early in the cycle as possible.

It is less expensive and less disruptive to discover design-level vulnerabilities during the design than it is during implementation or testing. For example, if proper authentication of administrators is not built into the program from the beginning, it is much more time consuming and risky to fix during the final quality assurance (QA) phase.

What is involved in the testing phase for vulnerability identification?

Application testing should be conducted by QA people who understand the importance of testing security as well as functionality. QA should apply security testing processes that test that the security features are working properly. Additionally, they should perform negative testing to determine how the application handles unexpected data such as long strings, special characters, and error conditions.

QA should use a problem tracking system to prioritize security issues alongside other program defects so that security issues can be fixed just like any other program flaw. Common methods to test applications include load testing tools and tools that will generate input data for cross-site scripting, SQL injection, and buffer overflows testing.

What are other threats and countermeasures for mitigating application security risks?

Threat modeling and countermeasures are important steps in the secure development lifecycle, ideally done when the application's design is near completion. Threat modeling is an exercise in which developers identify the assets or pieces of sensitive information that the application houses which need protecting.

Countermeasures can be used to test the application to ensure it does not leave private information vulnerable to potential attackers. Input filtering--one example of a countermeasure--is a technique used by programmers to protect an application from attack by limiting the size and format of input to exactly what the application is expecting.

For example, if an application is designed to accept a username that is all alphabet characters and a maximum length of eight characters, the application should reject all input that is longer than eight characters. This will help protect the application from performing unintended operations from unexpected input. Developers should also closely examine bandwidth, CPU time, and disk space in order to mitigate denial of service risks.

Developers should employ a thought process in which they imagine themselves as an attacker who knows everything about what the application can do. Then they should enumerate and categorize those threats to come up with ways to mitigate the risks. If there aren't ways to mitigate the threats, the design should be changed and re-implemented.

What are common information leaks and how can hackers use information for malicious purposes?

Information leaks can also pose a threat to applications. A single information leak is often not a serious problem, but has the potential to provide an attacker with access to more serious vulnerabilities.

For example, if a user enters a long string of text, rather than an eight-digit account number, a vulnerable application will come back with a string of information about what came back from the SQL server, often providing information to the attacker about what version of SQL is being used and how the system is constructed.

What are some best practices for application development?

All software developers should be educated on the fundamentals of secure application development. Developers should also take a more holistic approach to application development, building countermeasures into the design process, as well as rigorous QA testing. While there is not one silver bullet for building secure applications, developers can employ multiple processes that examine vulnerabilities in different ways to ensure application security before production.

Do organizations need third-party validation for security of applications?

Some organizations need to comply with regulatory requirements, particularly in the financial services industry. If regulatory compliance is an issue, organizations should consider enlisting a third party for a penetration test, which will provide validation of the application's security.

Chris Wysopal is director of development for Symantec Security Response.