Tag Archives: application security

5 Practical Strategies for SMBs to Tackle CIS CSC Control 16

Posted on by
Reply

Today we’re diving into the world of application software security. Specifically, we’re talking about implementing CIS CSC Version 8, Control 16 for small to mid-sized businesses. Now, I know what you’re thinking – “Brent, that sounds like a handful!” But don’t worry, I’ve got your back. Let’s break this down into bite-sized, actionable steps that won’t break the bank or overwhelm your team.

1. Build a Rock-Solid Vulnerability Response Process

First things first, folks. You need a game plan for when (not if) vulnerabilities pop up. This doesn’t have to be fancy – start with the basics:

  • Designate a vulnerability response team (even if it’s just one person to start)
  • Set up clear reporting channels
  • Establish a communication plan for affected parties

By nailing this down, you’re not just putting out fires – you’re learning where they start. This intel is gold for prioritizing your next moves in the Control 16 implementation.

2. Embrace the Power of Open Source

Listen up, because this is where it gets good. You don’t need to shell out big bucks for fancy tools. There’s a treasure trove of open-source solutions out there that can help you secure your code and scan for vulnerabilities. Tools like OWASP Dependency-Check and Snyk are your new best friends. They’ll help you keep tabs on those sneaky third-party components without breaking a sweat.

3. Get a Grip on Third-Party Code

Speaking of third-party components, let’s talk about managing that external code. I know, I know – it’s tempting to just plug and play. But trust me, a little due diligence goes a long way. Start simple:

  • Create an inventory of your third-party software (yes, a spreadsheet works)
  • Regularly check for updates and vulnerabilities
  • Develop a basic process for vetting new components

Remember, you’re only as strong as your weakest link. Don’t let that link be some outdated library you forgot about.

4. Bake Security into Your Development Process

Here’s where the rubber meets the road, folks. The earlier you bring security into your development lifecycle, the less headache you’ll have down the line. Encourage your devs to:

  • Use linters for code quality
  • Implement static application security testing (SAST)
  • Conduct threat modeling during design phases

It might feel like extra work now, but trust me – it’s a lot easier than trying to bolt security onto a finished product.

5. Keep Your Team in the Know

Last but not least, let’s talk about your most valuable asset – your people. Security isn’t a one-and-done deal; it’s an ongoing process. Keep your team sharp with:

  • Regular training sessions (they don’t have to be boring!)
  • Security awareness programs
  • Informal discussions about recent incidents and lessons learned

You don’t need a big budget for this. There are tons of free resources out there. Heck, you’re reading one right now!

Wrapping It Up

Remember, implementing Control 16 isn’t about perfection – it’s about progress. Start small, learn as you go, and keep improving. Before you know it, you’ll have a robust application security program that punches way above its weight class.

But hey, if you’re feeling overwhelmed or just want some expert guidance, that’s where we come in. At MicroSolved, we’ve been in the trenches with businesses of all sizes, helping them navigate the complex world of cybersecurity. We know the challenges SMBs face, and we’re here to help.

Need a hand implementing Control 16 or just want to bounce some ideas around? Don’t hesitate to reach out to us at MicroSolved (info@microsolved.com ; 614.351.1237). We’re always happy to chat security and help you build a tailored strategy that works for your business. Let’s make your software – and your business – more secure together.

Stay safe out there!

 

* AI tools were used as a research assistant for this content.

Improving Enterprise Security Posture with MachineTruth: Global Configuration Assessment

Posted on by
Reply

 

In today’s complex IT environments, ensuring proper and consistent device and application configurations across an entire enterprise is a major challenge. Misconfigurations and unpatched vulnerabilities open the door to cyberattacks and data breaches. Organizations need an efficient way to assess their configurations at scale against best practices and quickly identify issues. This is where MicroSolved’s MachineTruth: Global Configuration Assessment comes in.

MTSOC

MachineTruth is a proprietary analytics and machine learning platform that enables organizations to review their device and application configurations en masse. It compares these configs against industry standards, known vulnerabilities, and common misconfigurations to surface potential issues and ensure consistency of controls across the enterprise. Let’s take a closer look at the key features and benefits of this powerful assessment.

Comprehensive Config Analysis at Scale

One of the core capabilities of MachineTruth is its ability to ingest and analyze a huge volume of textual configuration files from an organization’s devices and systems. This allows it to provide a comprehensive assessment of the security posture across the entire IT environment.

Rather than having to manually check each individual device, MachineTruth can review thousands of configurations simultaneously using advanced analytics and machine learning models. It understands the formats and semantics of various config file types to extract the relevant security settings.

Not only does this drastically reduce the time and effort required for such a wide-ranging assessment, but it also ensures that the review is exhaustive and consistent. No device is overlooked and the same benchmarks are applied across the board.

Comparison to Standards and Best Practices

MachineTruth doesn’t just parse the configuration files, it intelligently compares them to industry standards, vendor hardening guidelines, and established best practices for security. It checks for things like:

  • Insecure default settings that should be changed
  • Missing patches or outdated software versions with known vulnerabilities
  • Inconsistent security controls and policies across devices
  • Configurations that violate the organization’s own standards and requirements

By analyzing configurations through the lens of these guidelines, MachineTruth can identify deviations and gaps that introduce risk. It augments the automated analytics with manual reviews by experienced security engineers using custom-built tools. This combination of machine intelligence and human expertise ensures a thorough assessment.

Actionable Reports and Remediation Guidance

The findings from the assessment are compiled into clear, actionable reports for different audiences. An executive summary provides a high-level overview for leadership and less technical stakeholders. A detailed technical report gives security and IT managers the information they need to understand and prioritize the issues.

Crucially, MachineTruth also provides mitigation recommendations for each finding. It includes a spreadsheet of all identified misconfigurations and vulnerabilities, sorted by severity, with a suggested remediation step for each. This enables the IT team to immediately get to work on fixing the issues.

For even easier remediation, device-specific reports can be generated listing the problems found on each individual machine. These are immensely useful for the personnel who will be implementing the changes and closing the gaps.

By providing this clear guidance on what needs to be fixed and how, MicroSolved helps organizations quickly translate the assessment results into meaningful corrective actions to reduce their cyber risk.

Flexible Engagement Model

MicroSolved offers flexible options for engaging with the MachineTruth assessment to match different organizations’ needs and capabilities. The typical process takes 4-8 weeks from when the configuration files are provided to the generation of the final reports.

Customers can gather the necessary configuration files from their devices on their own or with assistance from MicroSolved’s team as needed. The files are securely transferred to MicroSolved for analysis via an online portal or designated server. The assessment team keeps the customer informed throughout the process of any significant issues or signs of compromise discovered.

For organizations that want an ongoing program to maintain proper configurations over time, multi-year engagements are available. This continuity enables MicroSolved to provide enhanced features like:

  • Tracking reporting preferences to streamline assessments
  • Showing trends over time to measure improvement
  • Storing customer-defined policies and standards for reference
  • Tuning findings based on accepted risks and false positives

These value-added services optimize the assessment process, accelerate remediation work, and help demonstrate the security program’s progress to both technical personnel and executive leadership.

Focus on Outcomes Over Rote Auditing

With MachineTruth, the focus is on identifying and mitigating real issues and risks, not just rotely comparing settings to a checklist. While it leverages standards and best practices, it goes beyond them to surface relevant problems given each organization’s unique environment and requirements.

The assessment process includes validation steps and quality checks, with peer reviews of findings before they are finalized. The reporting phase involves dialogue with the customer to make sure the results are accurate, understandable, and suited to their needs. Workshops and presentations help various stakeholders understand the outcomes and key mitigation steps.

By emphasizing communication, practical guidance, and alignment with the organization’s goals, MicroSolved ensures the assessment delivers meaningful results and measurable security improvements. It’s not just an audit report to stick on a shelf, but an action plan to strengthen the organization’s defenses.

Conclusion

Proper configuration of devices and applications is a fundamental part of any organization’s security program, but one that is increasingly difficult to get right given the scale and complexity of modern IT environments. MicroSolved’s MachineTruth: Global Configuration Assessment harnesses the power of machine learning and data analytics to verify configurations en masse against standards and best practices.

This innovative assessment enables organizations to efficiently identify and remediate misconfigurations, vulnerabilities, and inconsistent controls across their IT infrastructure. With clear, actionable reports and a flexible engagement model, MicroSolved makes it easier to strengthen security posture and concretely mitigate risks.

As cyber threats continue to escalate, organizations need next-generation assessment capabilities like MachineTruth to meet the challenge. It marries the subject matter expertise of world-class security professionals with the speed and scalability of artificial intelligence to deliver a truly enterprise-grade solution for configuration security.

More Information

To learn more about MicroSolved’s MachineTruth: Global Configuration Assessment and how it can help improve your organization’s security posture, contact us today. Our team of experienced security professionals is ready to discuss your specific needs and provide a tailored solution. Don’t wait until it’s too late; take proactive steps to strengthen your defenses and mitigate risks. Contact MicroSolved now and empower your organization with advanced configuration security capabilities. (Email info@microsolved.com or call us at +1.614.351.1237 to speak to our expert team)

 

* AI tools were used as a research assistant for this content.

 

Getting Smart with Mobile App GeoLocation to Fight Fraud

Posted on by
4

If your mobile application includes purchases with credit cards, and a pickup of the merchandise, then you should pay attention to this.

Recently, in our testing lab and during an intelligence engagement, we identified a fraud mechanism where stolen credit cards were being used via the mobile app in question, to fraudulently purchase goods. In fact, the attackers were selling the purchase of the goods as a service on auction and market sites on the dark web.

The scam works like this. The bad guys have stolen credit cards (track data, likely from dumps), which they use to make a purchase for their client remotely. The bad guys use their stolen track data as a card not present transaction, which is standard for mobile apps. The bad guys have access to huge numbers of stolen cards, so they can burn them at a substantial rate without impacting their inventory to a large extent. The bad guy’s customer spends $25 in bitcoins to get up to $100 in merchandise. The bad guy takes the order from the dark net, uses the mobile app to place the order, and then delivers the receipt and/or pickup information to the bad guys customer. The customer then walks into the retailer and shows the receipt for their mobile order, picking up the merchandise and leaving.

The bad guy gets paid via the bitcoins. For them, this is an extremely low risk way to convert stolen credit card info to cash. It is significantly less risky for them than doing physical card replication, ATM use or other conversion methods that have a requirement for physical interaction.

The bad guy’s customer gets paid by picking up the merchandise. They get up to $100 value for a cost of $25. They take on some risk, but if performed properly, the scam is low risk to them, or so they believe. In the odd event, they simply leave the store after making their demands for satisfaction. There is little risk of arrest or prosecution, it would seem, especially at the low rate of $100 – or at least that was how the bad guy was pitching it to their prospective customers…

The credit card issuer or the merchant gets stuck. They are out the merchandise and/or the money, depending on their location in the world, and the merchant agreement/charge back/PCI compliance issues they face.

Understanding the fraud and motivations of the bad guys is critical for securing the systems in play. Organizations could up their validation techniques and vigilance for mobile orders. They could add additional fraudulent transaction heuristics to their capability. They could also implement geo-location on the mobile apps as a control – i.e.. If the order is being physically placed on a device in Ukraine, and pick up is in New York, there is a higher level of risk associated with that transaction. Identifying ways  to leverage the sensors and data points from a mobile device, and rolling it into fraud detection heuristics and machine learning analytics is the next wave of security for some of these applications. We are pleased to be helping clients get there…

To hear more about modern fraud techniques, application security testing or targeted threat intelligence like what we discussed above, drop us a line (info at microsolved dot com) or via Twitter (@lbhuston). We look forward to discussing it with your team.

State Of Security Podcast Episode 3 is Now Available

Posted on by
Reply

Episode 3 of the podcast is now available!

In this edition, I sit down with Bill @Sempf to discuss application security, working with development teams and how to get security and dev folks on the same page. Bill goes so far as to recommend a simple 2 step process that you simply have to hear!

Check it out:

And give us feedback on Twitter (@lbhuston) about this and all other episodes or ideas you have about what you would like us to cover. Thanks for listening!  

Quick PHP Malware vs AV Update

Posted on by
Reply

It’s been a while since I checked on the status of PHP malware versus anti-virus. So, here is a quick catch up post. (I’ve been talking about this for a while now. Here is an old example.)

I took a randomly selected piece of PHP malware from the HITME and checked it out this afternoon. Much to my surprise, the malware detection via AV has gotten better.

The malware I grabbed for the test turned out to be a multi-stage PHP backdoor. The scanner thought it was exploiting a vulnerable WordPress installation. 

I unpacked the malware parts into plain text and presented both the original packed version from the log and the unpacked version to VirusTotal for detection testing. As you know, in the past, detection of malware PHP was sub single digits in many cases. That, at least to some extent has changed. For those interested, here are the links to see what was tripped.

Decoded to plain text vs Encoded, as received

As you can see, decoded to plain text scored a detection of 44% (19/43), which is significantly improved from a year or so ago. Additionally, excitingly, undecoded, the attack in raw form triggered a detection rate of 30% (13/44)! The undecoded result is HUGE, given that the same test a year or so ago often yielded 0-2% detection rates. So, it’s getting better, just SLOWLY.

Sadly though, even with the improvements, we are still well below half (50%) detection rates and many of the AV solutions that fail to catch the PHP malware are big name vendors with commercial products that organizations running PHP in commercial environments would likely be depending on. Is your AV in the missing zone? If so, you might want to consider other forms of more nuanced detection. 

Now, obviously, organizations aren’t just depending on AV alone for detection of web malware. But, many may be. In fact, a quick search for the dropped backdoor file on Google showed 58,800 systems with the dropped page name (a semi-unique indicator of compromise). With that many targets already victim to this single variant of PHP backdoors, it might be worth checking into if you are a corporate PHP user.

Until next time, take a look around for PHP in your organization. It is a commonly missed item in the patch and update cycles. It also has a pretty wide security posture with a long list of known attack tools and common vulnerabilities in the coding patterns used by many popular products. Give any PHP servers you have a deeper inspection and consider adding more detection capability around them. As always, thanks for reading and stay safe out there! 

Which Application Testing is Right for Your Organization?

Posted on by
2

Millions of people worldwide bank, shop, buy airline tickets, and perform research using the World Wide Web. Each transaction usually includes sharing private information such as names, addresses, phone numbers, credit card numbers, and passwords. They’re routinely transferred and stored in a variety of locations. Billions of dollars and millions of personal identities are at stake every day. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough to protect websites from hackers. Today, we know better.

Whatever your industry — you should have a consistent testing schedule completed by a security team. Scalable technology allows them to quickly and effectively identify your critical vulnerabilities and their root causes in nearly any type of system, application, device or implementation.

At MSI, our reporting presents clear, concise, action-oriented mitigation strategies that allows your organization to address the identified risks at the technical, management and executive levels.

There are several ways to strengthen your security posture. These strategies can help: application scanning, application security assessments, application penetration testing, and risk assessments.

Application scanning can provide an excellent and affordable way for organizations to meet the requirements of due diligence; especially for secondary, internal, well-controlled or non-critical applications.

Application security assessments can identify security problems, catalog their exposures, measure risk, and develop mitigation strategies that strengthen your applications for your customers. This is a more complete solution than a scan since it goes deeper into the architecture.

Application penetration testing uses tools and scripts to mine your systems for data and examine underlying session management and cryptography. Risk assessments include all policies and processes associated with the specific application, and will be reviewed depending on the complexity of your organization.

In order to protect your organization against security breaches (which are only increasing in frequency), consider conducting an application scan, application  assessment, application penetration test, or risk assessment on a regular basis. If you need help deciding which choice is best for you, let us know. We’re here to help!

Smartphones and Banking Applications

Posted on by
Reply

Mobile banking users are predicted to reach 400 million by 2013, according to a study by Juniper Research.

The report author, Howard Wilcox, says that transactional or “push” mobile banking is being offered increasingly by banks via downloadable applications or the mobile web, complementing existing SMS messaging services for balance and simple information enquiries.

“For the user it’s about three things: convenience, convenience and convenience,” Mr. Wilcox said. “The mobile device is almost always with you, and if you organize your life with your mobile, then why not your finances too?

“For example, people can receive account alerts and reminders straight away and take action immediately if necessary – say to top up an account or pay a bill,” he said. “With apps, the whole process is made so much simpler too.”

We know consumers want to make their lives easier — and using applications on their mobile phones seems to promise that, but how can you secure those applications?
Here are some of the steps you can take to start making your mobile applications secure:

  • Security controls: One of the main issues with smartphone applications is access control. These apps are usually used in the most vulnerable locations: public settings such as airports, restaurants, and lobbies. All mobile devices must have a protective mechanism that allows it to be accessed by authorized persons only. A few ways to monitor control would be: install anti-virus software, file encryption, session encryption, device registration, and password complexity rules.
  • User authentication: Access privileges are limited to those who use the smartphone device. Personal identification numbers are generally an acceptable means of authentication because they reside on the device only and are never transmitted.
  • Data Encryption: A powerful defense tool, encryption prevents anyone but the most savvy attacker to access important information. Ensure that the process is automatic and transparent to the user and protects all stored data. Systems that require user involvement to encrypt specific files in specific places cannot provide the “provable” security regime needed by organizations. Encryption is effective only if authorized people control the decryption key, so there needs to be a connection between encryption and user authentication. Access control, user authentication and encryption are the three elements that comprise virtual physical-access control.
  • Security administration: This needs to be in place for customers who have questions or need help. Policy enforcement, deployment, updates, help desk, key recovery and system logging are all vital components of an enterprise system that provides “provable” security to comply with data privacy regulations and to repel litigation.

Many phones use RSA encryption for authentication. While most of the big antivirus vendors provide security solutions for smartphones, few have the “silver bullet” for all platforms. As device manufacturers continue to add processing power and storage capacity; and platform vendors provide more applications for generating and consuming data, security will become a greater concern as attackers look upon it as their new playground.

New Tools Keep Coming

Posted on by
Reply

Several new and updated tools have been released recently. These are mostly aimed at application scanning, specifically getting into the backend database. While it’s no surprise that these tools keep coming, we just want to reinforce the need for better application security. We don’t anticipate an end to attacker tools anytime soon, so keep your guards up 😉