Presented by Rajesh Nair at Institution of Engineers on Dec 3 2014

1. The OWASP Foundation
http://www.owasp.org
Security of the
Internet
Kerala 2014
Rajesh P
Board Member OWASP Kerala
Copyright © The OWASP Foundation
Permission is granted to copy, distribute and/or modify the document under the terms of the OWASP License

2. The OWASP Foundation
http://www.owasp.org
Computer Security Day
Observed on November 30th
Started in 1988
Help raise awareness of computer
related security issues
2

3. The OWASP Foundation
http://www.owasp.org
Computer Security
Day Activities
• Change your password
• Update anti-virus and Check for viruses
• Cleanup up your computer and surroundings
• Back-up your data
• Verify your inventory of computer utilities
and packaged software
• Monitor Event Logs
• Register and pay for all commercial software
that is used on your computer
3

4. The OWASP Foundation
http://www.owasp.org
- Large-scale intelligence activities targeting
Internet communication
- Attempts to undermine cryptographic
algorithms
- People, companies and governments
intentionally introduce defects or
vulnerabilities (or secret back-doors)
compromising the security, trust and
integrity of software and applications
Trends related to Security in
Internet
4

5. The OWASP Foundation
http://www.owasp.org
- Deep Web
- Firmware
- Ransomware
- POS Malware
- Steganography
Trends related to Security in
Internet
5
Age of Application
Security
Age of Network
Security
Age of Anti-
Virus
• 3 out of 4 web sites are vulnerable to
attacks (Source: Gartner)
• 75% of Attacks at the Application Layer
(Source: Gartner)
• Important % of sales via the Web
(Services, Shop On Line, Self-care)

6. The OWASP Foundation
http://www.owasp.orgThe Numbers
Cyber Crime:
“Second cause of economic crime experienced by the financial
services sector” – PwC
“Globally, every second, 18 adults become victims of
cybercrime” - Norton
US - $20.7 billion – (direct losses)
Globally 2012 - $110,000,000,000 – direct losses
“556 million adults across the world have first-hand experience of cybercrime --
more than the entire population of the European Union.”
6

7. The OWASP Foundation
http://www.owasp.org
Target's December 19 disclosure 100+ million payment cards
LoyaltyBuild November disclosure 1.5 million + records
Snapchat: 4.6 million
user records
7

8. The OWASP Foundation
http://www.owasp.org
Two weeks of ethical
hacking
Ten man-years of
development
An inconvenient truth
8

9. The OWASP Foundation
http://www.owasp.org
Make this more difficult: Lets change the application code once a month.
9

10. The OWASP Foundation
http://www.owasp.org
Application
Code
COTS
(Commercial off
the shelf
Outsourced
development
Sub-
Contractors
Bespoke
outsourced
development
Bespoke Internal
development
Third Party
API’s
Third Party
Components
& Systems
Degrees of trust
You may not let some of the people who have developed your code into your offices!!
More LESS
10

11. The OWASP Foundation
http://www.owasp.org
2012/13 Study of 31 popular open source
libraries
- 19.8 million (26%) of the library
downloads have known vulnerabilities
- Today's applications may use up to 30 or
more libraries - 80% of the codebase
Dependencies
11

12. The OWASP Foundation
http://www.owasp.org
The Open Web Application Security Project (OWASP) is dedicated to
finding and fighting the causes of insecure software. The OWASP
Foundation is a 501c3 not-for-profit charitable organization that
ensures the on going availability and support for our work.
Participation in OWASP is free and open to all.
Everything here is free and open source and vendor neutral.
Main objectives: producing tools, standards and documentations
related to Web Application Security.
Thousands active members, hundreds of local chapters in the world
12

13. The OWASP Foundation
http://www.owasp.org
13
OWASP Mission
To make application security
"visible," so that people and
organizations can make
informed decisions about
application security risks

14. The OWASP Foundation
http://www.owasp.org
Making Security Visible , through…
Documentation
Top Ten, Dev. Guide, Design Guide, Testing Guide, …
Tools
WebGoat, WebScarab, ESAPI, CSRF Guard, Zed Attack Proxy (ZAP), …
Working Groups
Browser Security, Industry Sectors, Education, Mobile Phone Security,
Preventive Security, OWASP Governance
Security Community and Awareness
Local Chapters, Conferences, Mailing Lists
14
PROTECT
DETECT
LIFE CYCLE

15. The OWASP Foundation
http://www.owasp.org
Body of
Knowledge
Core Application
Security
Knowledge Base
Acquiring and
Building
Secure
Applications
Verifying
Application
Security
Managing
Application
Security
Application
Security
Tools
AppSec
Education and
CBT
Research to
Secure New
Technologies
Principles
Threat Agents,
Attacks,
Vulnerabilities,
Impacts, and
Countermeasures
OWASP Foundation 501c3
OWASP Community Platform
(wiki, forums, mailing lists)
Projects
Chapters
AppSecConferences
Guide to Building
Secure Web
Applications and Web
Services
Guide to Application
Security Testing and
Guide to Application
Security Code Review
Tools for Scanning,
Testing, Simulating,
and Reporting Web
Application Security
Issues
Web Based Learning
Environment and
Guide for Learning
Application Security
Guidance and Tools
for Measuring and
Managing Application
Security
Research Projects to
Figure Out How to
Secure the Use of
New Technologies
(like Ajax)
15

16. The OWASP Foundation
http://www.owasp.org
The OWASP Enterprise
Security API
Custom Enterprise Web Application
Enterprise Security API
Authenticator
User
AccessController
AccessReferenceMap
Validator
Encoder
HTTPUtilities
Encryptor
EncryptedProperties
Randomizer
ExceptionHandling
Logger
IntrusionDetector
SecurityConfiguration
Existing Enterprise Security Services/Libraries
16

17. The OWASP Foundation
http://www.owasp.org
17

18. The OWASP Foundation
http://www.owasp.org
Please Help
OWASP Grow
Push us to do better!
Be an active contributor
Stub articles – wiki contributions
New technologies to analyze
Be an OWASP member
Corporate Members
Individual Members
Please join us and share what you know!
18
9%
41%
50%
OWASP Projects
Code
Tools
Documentation

19. The OWASP Foundation
http://www.owasp.org
Thank you!
rajesh.nair@owasp.or
g
https://www.facebook.com/OWASPKerala
https://www.twitter.com/owasp_kerala