"Certified" apps, are they really secure? Break them or fix them, your choice!

In today's world of regulations and compliance, IT has to manage and carry the burden of compliance. Most vendor claim their applications are secure and are "Whatever regulation" certified. Learn what tools we have available to achieve real security in an operational scenario with "certified" apps. Find where are the vulnerabilities and how to mitigate them or break them, make your developers/contractors solutions secure.

1. “Certified” apps: Are they really secure? Jose L. Quiñones, BS MCSA, RHCSA, CEH, CPEH, CM2I, GCIH, GPEN

2. About me UPR School of Medicine – IT Director Technical Instructor – CompTIA, Micro$oft , EC Council, Mile2 Obsidis Consortia, Inc. – President Security BSides Puerto Rico – Organizer Init6 - InfoSecurity User Group – Founder & Mentor

3. What is OC, Inc ? Obsidis Consortia, Inc. [OC, Inc.] is a non-profit organization that promotes security awareness in the community and supports professional development of security professionals, students and enthusiasts in Puerto Rico.   OC, Inc. has develop and is supporting initiatives like the Init6 Security User Group, Professional Training & Workshops, Network and Security Systems Simulation Scenarios, Community Outreach Program and Security B Sides Puerto Rico Conference.

4. Security B Sides Puerto Rico October 6 th , 2016 PR Convention Center San Juan, PR http://bsidespr.org/2016 / # BsidesPR @ bsidespr

5. Disclaimer I am NOT a developer, I only dabble in scripting and my point of view is biased toward IT operations. I am NOT an auditor, nor I care much about compliance for the sake of it. I am NOT an expert in regulations but like many I have no choice in the matter. I DO care a bout information security, privacy and making systems secure. My experience with IT is mainly in the Healthcare, Education and SMB Industries. I am not an “expert” nor pretend to be one. this presentation is based on my own personal experience with developers, deployments and the implementation of such systems. #nightmares

6. Dataloss http://breachlevelindex.com/

7. These are not he hackers you are looking for!

8. Today’s price is the Data

9. What’s the surface area of an application? Client ( FrontEnd ) UX/UI Web, Mobile, OS Binaries Application/Business Logic DB Engine API Calls Tasks Data/Infrastructure Caching DB File System

10. Application Vulnerabilities Affects home-brew, customized and packaged applications all the same Usually have vulnerabilities as a result of poor coding, QA , deployment and administration All apps are NOT created equal. Each application provides unique methods of attack it.

11. Common Errors Buffer overflows Weak authentication and/or crypto Poor data validation Written errors or poor error checking Bad configurations

12. What can go wrong?

13. File Permissions many (poorly written) applications will break inheritance when saving files Modify contains every right that full control does, except for Change Permission and Take Ownership . Giving excessive permissions can give access to users

14. Network Access Case: Dr. Alice & Patient Bob No special hardware was used , only a stock iPhone No special tools were used , only App Store applicacions Because of bad access confguration , Bob had access directly the Alice’s DB files

15. Temp Files Temp files from editing, configuration and installation tools can leave interesting information behind. Even if deleted these file scan be recovered.

16. Config Files

17. Powershell

18. PII/PHI exposed !

19. Password hashes exposed!

20. Encryption

21. GPU cryptanalysis

22. What about web/ mobile Apps? https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

23. What can we do? Enforce a strong password policy Use strong encryption with up to date encryption standards Use strong, salted hashing algorythms Secure messaging (encrypt & tunnel) Secure data at rest (whole disk encryption, file encryption and obfuscation) Stored procedures and parameterized queries for DB access Input Validation, Use fuzzers and automatic code review tools . Use restrictions, triggers and alerts on your DB Enable audit trails and l og everything (success / failure) Use monitoring tools ( Sysmon , Regmon , Windows ADK , ZAP) to learn how to application works

24. What else? DevOps! Integrate IT operations into the development cycle.

25. THE PHOENIX PROJECT: A NOVEL ABOUT IT, DEVOPS, AND HELPING YOUR BUSINESS WIN http://itrevolution.com/books/phoenix-project-devops-book/

26. Thanks! https://codefidelio.org [email protected] @ josequinones