moving forward: the knowns and unknowns

We know security of websites must improve, heck it can’t get much worse. One major challenge we’re facing is not everyone agrees on what needs to be done. For example, if someone were to ask a mailing list, “what do I need to do to secure my website?”, they’d likely receive 20 different answers and perhaps get asked just as many questions. Conversely, if the same question was asked about a PC, you’d probably get 3 similar answers and maybe a question about why your using Windows (*just kidding*). This inevitably leaves website owners in a state of confusion unsure of what to do. Maybe they’ll do nothing.

I think the reason behind the lack of consensus is due to void of data and/or a means to measure success. We’re essentially flying blind. Let’s rhetorically consider several questions people commonly ask:

“How do I find out how many websites I have?”
“What do they do and how *important* are they?”
“Who’s responsible for them?”

Digging into a single website….

“How large and complex is the code base?”
“What’s the rate of application code change?”

Narrowing down to vulnerabilities…

“What vulnerabilities do I have?”
“Who’s fault is it and how do I prioritize their remediation?”
“What do I do to protect myself in the meantime?”

Finally organizational changes…

“Which should I focus on, developer education or the use of a modern development framework?”
“Which testing process is better, white box or black box or glass box?”

Answering these questions is anything but simple, largely dependent on any number of factors, unknown to any single person, and varies from organization to organization. The point is an organization must be able to understand its current state of affairs. And we as an industry must be able measure if a particular strategy or solution is working and if so how well. This brings us to where I think we are today. Best-practices based upon conventional wisdom held over from other areas of information security, which do not apply here. A harsh reality.

To begin looking at things in fresh and new perspective, I find its helpful to line up the "knowns" and "unknowns" for a particular problem set. From there it’s easier to spot trends, relationships, inconsistencies, and areas that should yield immediate return from investigation.

1. In what would normally be considered the largest, most popular, and “secure” websites, it’s found the vast majority have serious vulnerabilities. We have no idea about the security of the mid and lower end websites which are typically not assessed.
2. Those typically in charge of information security do not have the same level of control over the safety of their websites as they do at the network infrastructure level. Consequently, the responsibility of website security is unassigned or rests among several constituencies.
3. Attacks targeting the web application layer are growing year over year in number, sophistication, and maliciousness. Real would visibility into these attacks are extremely limited.
4. Firewalls, patching, configuration, transmission/database encryption, and strong authentication solutions do not protect against the majority of web applications vulnerabilities.
5. All software has defects and in turn will have vulnerabilities. Security enhancements provided by modern development frameworks help to prevent vulnerabilities, though will not eliminate them altogether. Measured benefit is unknown.
6. Change rate of commerce web applications is relatively rapid updated with incremental revisions. Traditional PC or enterprise software tends to be slower with larger versioned builds. Web applications tend to have a steady and faster flow of vulnerabilities.
7. Developer education in software security and implementing security testing inside the quality assurance phase reduces the number of vulnerabilities, but will not eliminate them. See #5. The overall expected reduction of vulnerabilities as a result is unknown.
8. It’s impossible to find all vulnerabilities through automation, which requires a significant amount of experienced human time to complete thorough security testing. How much time is required and how close the process will come to finding everything is debatable.
9. Web application security is a new and complex subject for which there is a limited population of experienced practitioners relative to the amount of workload.
10. Web browser security is largely and fundamentally broken leaving unable to protect users against modern attacks. The situation hasn’t significantly improved with Firefox 2.0 or Internet Explorer 7.0. and it’s unclear it future releases will attempt to address the problem.

What does this tell us? A lot of things actually. First and foremost, there is a lot of work to do *like we didn’t know that already*. Here are a couple of my observations:

• Solutions must come from areas other than "fixing" the code
• We need to invest resources into measuring ROI from various solutions and best-practices
• Create training and perhaps certification programs for web application security professionals
• We need wider visibility into the real-world hacks
• We need to develop and implement new and innovated security designs for modern web browsers

I’d enjoy hearing from others about additional “knows” and “unknowns” and what they can derive from them.