Best of Application Security (Friday, Sep. 25)

Ten of Application Security industry's coolest, most interesting, important, and entertaining links from the past week -- in no particular order. Regularly released until year end. Then the Best of Application Security 2009 will be selected!

• Strict Transport Security
• ForceHTTPS: Protecting High-Security Web Sites from Network Attacks
• Strict Transport Security in NoScript
• Email-stealing worm slithers across LiveJournal
• CSRF attacks and forensic analysis
• Basic Flaw Reveals Source Code to 3,300 Popular Websites
• New Free Web Application Firewall 'Lives' In The App
• Using Microsoft's AntiXSS Library 3.1
• SQL/JavaScript Hybrid Worms As Two-stage Quines
• Study Shows Open-source Code Quality Improving

Best of Application Security (Friday, Sep. 18)

Ten of Application Security industry's coolest, most interesting, important, and entertaining links from the past week -- in no particular order. Regularly released until year end. Then the Best of Application Security 2009 will be selected!

• SANS The Top Cyber Security Risks
• Mozilla catches half of Firefox users running insecure Flash
• Fortify hands-on demo/session at forthcoming OWASP Northern Virginia Chapter
• Bruce Schneier: The Future of the Security Industry: IT is Rapidly Becoming a Commodity
• Two New Security Tools for your SDL tool belt (Bonus: a “7-easy-steps” whitepaper)
• Tool: New Version Of BeEF Released!
• Whitepaper: Analysis of an unknown malicious JavaScript
• 671% increase of malicious Web sites
• PHPIDS 0.6.2 ready to use
• A Nice Big FriendFeed Bug: Impersonate Anyone!

Best of Application Security (Friday, Sep. 11)

Ten of Application Security industry's coolest, most interesting, important, and entertaining links from the past week -- in no particular order. Regularly released until year end. Then the Best of Application Security 2009 will be selected!

• Disclosure standards and why they're critical
• ReDoS (Regular Expression Denial of Service) Revisited
• Binging - Footprinting and Discovery Tool
• RBS WordPay hacked, full database access
• Obfuscating your IP using a Burp/Tor/Prixoy combination
• Identifying Anomalous Behavior
• The Security Implications Of Google Native Client
• SSL Threat Model
• Cross Widget DOM Spying
• New Book "Hacking: The Next Generation"

Best of Application Security (Friday, Sep. 4)

Ten of Application Security industry's coolest, most interesting, important, and entertaining links from the past week -- in no particular order. Regularly released until year end. Then the Best of Application Security 2009 will be selected!

• Cross-protocol XSS with non-standard service ports
• Flash Cookie Forensics
• apache.org incident report for 8/28/2009
• Microsoft IIS 5/6 FTP 0Day released
• UK Parliament website hack exposes shoddy passwords
• Outsourcing and Top-Line Security Budget Justification
• Production-Safe Website Scanning Questionnaire
• Revealing Facebook Application XSS Holes
• Flaw In Sears Website Left Database Open To Attack
• Pwning Opera Unite with Inferno’s Eleven

Outsourcing and Top-Line Security Budget Justification

Very often security budgets are justified through risk management, closely related to loss avoidance or boosting the bottom-line (income after expenses). A security manager might say to the CIO, "If we spend $X on Y, we’ll reduce risk of loss of $A by B%, resulting in an estimated $C financial upside for our organization."

There are indeed a number of things that could negatively impact the bottom-line should an incident occur. Fraud, fines, lawsuits, incident response costs, and downtime are the most common. Heartland for example, the organization at the center of the largest card data breach in U.S. history, said the event has cost the company $32 million so far in 2009.

For the last several years, data compromise has been a key driver for many companies to take Web application security seriously. More hacks translates into an increased security budget. "We must spend $X on Y so that Z never happens again, which would save us an estimated $C in incident related loss." I guess we can thank the mass SQL injection worms for demonstrating why being proactive is important if nothing else.

Recently though, I’m witnessing a shift, perhaps the start of a trend. A shift in which security spending is justified because it directly affects the top-line (income before expenses). "If we spend $X on Y, we’ll make customers happy, which has an estimated financial upside of $C for our organization." Let’s back up and examine this further.

A big part of my job is speaking with WhiteHat Sentinel customers, many of whom are in the business of providing Software-as-a-Service (SaaS) solutions for IT outsourcing -- a fast-growing market as organizations look to cut costs. I’m hearing more stories of their prospective enterprise customers, concerned for the safety of their data, putting these vendors under the security microscope. Enterprises understand it is their butt on the line should anything go wrong, even if the vendor is to blame.

To manage the risks of outsourcing, enterprises are requiring the SaaS vendor to pass a Web application assessment before they sign up. If the vendor already has a reputable third-party firm providing such assessments, such as a WhiteHat Security, then more often than not the reports will satisfy the prospective client, provided the findings are clean. If not, then the enterprise will engage an internal team or third-party (again like WhiteHat) at their expense, which is when things get really interesting.

If serious issues are identified, which is fairly common, the best-case scenario is the sales cycle slows down until the vulnerabilities are fixed. This could easily take weeks of time if not more. More than that it could also initiate disruptive fire drills in which developers are pulled from projects creating new features and instead instructed to resolve vulnerabilities NOW for the sake of winning near-term business. The consequences are real and potentially devastating to a business. On one hand, the account could be lost entirely because a loss of the customer’s confidence. And worse still, if word gets around that your security is subpar, then the ramifications are clear. When sales are lost like this, especially in the current economy, security budgets based on increasing the top-line become really attractive.

For this reason it seems the move to “the cloud” is incentivizing organizations to make a substantive investment in Web application security or risk losing business from savvy customers. Even more amazing is that after vendors put a program in place, the investment can be used as a competitive advantage. They’ll hype the fact to customers by volunteering their security reports and program details upfront. As enterprises shop SaaS payment processors, e-commerce hosting, financial applications, etc. they will expect to receive the same from others companies, who may not be in a position to deliver.

If you are a security manager, take the time to ask the sales department how often “security” is a part of the buying criteria for customer. If it is, that could be an excellent opportunity to align yourself with the business.

Anyone else seeing this trend?