Slashdot Log In
Creating a Security Test Environment?
Posted by
kdawson
on Fri Aug 01, 2008 10:44 AM
from the as-sure-as-possible dept.
from the as-sure-as-possible dept.
Enderandrew writes "Our IT department has been tasked with creating a list of authorized software, and only allowing software to be added to such a list after it has been thoroughly tested. In theory that sounds like a great idea — but how should we test apps to make sure they are secure? We have tools to scan internal websites, and we use MBSA for our Windows servers. However, I'm turning to Slashdot to ask what are the best methods for creating a test environment where I can analyze apps for security vulnerabilities. We're a multi-platform shop, but my main concern is with Windows apps."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The only way to be sure... (Score:4, Insightful)
Re:The only way to be sure... (Score:5, Interesting)
You can't even be sure when you have the source code. [bell-labs.com]
Tell the folks who want this list that you must trust someone at some point and that will always leave you vulnerable.
Parent
Re: (Score:2)
Re: (Score:3)
Even then you can't be sure, because the hole could be built into the hardware. The best you can really do is get a stack of identical processors and chip sets and destructively slice all but one of them up and run them through an electron microscope to verify the circuits -
Of course that's assuming you have the code for the microscope controller... After all it's only showing stuff on a screen... Who knows if it's real ?
The only way to be sure...is to get rid of MS (Score:4, Interesting)
You can't even be sure when you have the source code. [bell-labs.com]
The point there is that you have to have the code for the whole stack not just an isolated application. For an application to be secure, you have to be able to do a valid code audit. For the code audit to be worth anything it has to be done all the way down to the core: compiler, libraries, utilities and operating system. So you can be sure when you have the source code, but you do have to have all of the source code.
So without even touching on the quality issues with MS, lack of code access rules out all MS products from the system on up to user applications. "Shared" source might be fine for specific, limited, platform-specific development contexts, but is basically the same as "escrow" And "escrow" is just another name for closed source, namely, as Ken Thompson point out, insecure. Ditching MS products won't automagically make your site secure, but it is a necessary first step.
Now there are some short cuts one can take in Ken Thompson's example. However, they all boil down to having the code for the whole system as he points out, not just parts. Even diverse double compiling [dwheeler.com] requires, at the end of the day, a system that has been vetted top to bottom to use as the baseline.
Now the next step is to deal with smaller, more modular units of code. They're not only good design but also easier to manage. Again, that rules out a certain party ...
FWIW it's interesting that the ACM recently pulled the Thompson article [acm.org]. It had been available for over a decade. One wonders how much longer the ACM will be a useful source of technical information.
Parent
Re:The only way to be sure... (Score:5, Funny)
You must be new here.
Parent
Re:The only way to be sure... (Score:4, Insightful)
And the best way to protect a computer is to remove its network and power cables. In the real world though, security isn't the exclusive goal.
I agree that open source apps give a stronger guarantee of security, but going from "we want things to be more secure" to "we want absolute security" to "closed-source apps must necessarily be removed" seems like a stretch, even if it makes for good open source advocacy.
Parent
Re: (Score:3, Insightful)
You can't be certain unless you have the source code, so tell the folks who are requiring this list to be created that they can say goodbye to Word and Excel.
The Principle of 'Never Look': When not empowered to act upon the information gathered, DO NOT GATHER THAT INFORMATION.
Suppose you have to de-certify an app due to something your research discovers, what then?
You may not be in a position to challenge this directive, but if you are, INSIST on the power/backing/support to enforce it. The political collateral involved in this will, at a minimum, delay it for a good long while.
Re:The only way to be sure... (Score:5, Insightful)
That is the problem right there: "a lot of free time" is not what most people have. Scanning the intarwebtubes for reports of vulnerabilities for various applications running on specific OS platforms may bring some results, but to my knowledge there is no unified security test suite benchmark. No matter what you choose, you *WILL* have vulnerabilities. The best you can do is limit those to vulnerabilities you can live with or do not yet know about.
Better yet is providing a SOP for implementing change/updates to all the 'verified' applications for zero-day exploit patches.
IBM does some extensive style work on vulnerability as do several others. I think I'd spend my time working on how to patch/update every 'in house certified' application rather than trying to ensure they have no vulnerabilities. The former keeps things good going forward, the latter only ensures past sins are fixed.
Spend your time where you will, but makes no sense to do extensive in-house testing unless you are writing your own in-house software. Rely on outside testing groups, work with them even. http://www.google.com/search?hl=en&output=googleabout&btnG=Search+our+site&q=software%20vulnerability%20testing%20results [google.com] results in about 242k hits and 142k for the same with +ibm added http://www.google.com/search?hl=en&q=software+vulnerability+testing+results+%2Bibm&btnG=Search [google.com]
Parent
Number 1 solution (Score:4, Funny)
Re: (Score:2, Funny)
Re:Number 1 solution (Score:4, Funny)
Parent
Government... (Score:4, Insightful)
Is your boss ex-military or something to that effect? If so, he may not understand the complexity of the task he is assigning.
Re: (Score:3, Informative)
Re:Government... (Score:5, Interesting)
It's totally arbitrary and has very little to do with security.
Parent
Re: (Score:3, Insightful)
If only... (Score:2, Funny)
If only the Internet had some kind of search engine where one could easily access the experiences of thousands of sys admins and/or developers.
Re: (Score:3, Insightful)
Re: (Score:2)
Thoroughly tested (Score:5, Insightful)
Just how thorough of testing is being asked? Some security flaws escape eyes for years (see DNS flaw). Some flaws are obvious. But, in general, you can never be 100% certain of a program be 'secure' unless you know its has passed some milspec cert.
While optimistic, I think the new policy is a bit misguided in its wording.
Re: (Score:3, Insightful)
Well, I'm asking what is the best way to set up a test environment for testing. I make my best effort while explaining to my bosses that it is near impossible to declare anything void of vulnerabilities.
All I can do is make my best effort.
Security at what level? (Score:5, Informative)
VMware is your best friend in this case. When dealing with client/server software, I'd install it in a VM, and then nmap it to see what affect it had against the machine with or without a firewall. Just to see what sort of ports were open, to characterize the software.
You can also use a lot of the great tools from SysInternals to poke around a bit more in the softwares workings, but using only software that is 100% security certified means you're going to have a bunch of people with blank hard disks. If you're using Windows and are paranoid to that point about security, I wouldn't look too far under the hood of that operating system if I were you.
There is the 'Good Enough' line. The point of systems security is not necessarily to maintain a paranoid, logged level of dilligence against every packet (though DPI isn't a -horrible- idea - it's ALL situational, tho
Re:Security at what level? (Score:4, Insightful)
This was to have been implemented today in my organization but in three stages to minimize disruption. We must conform to FDCC dictated by DHS. I received a USB drive with some instructions and files that I can use to download and install VMWare to create a sandbox for testing. The instructions are lengthy so I've just skimmed them but it appears that a software package is installed that when run establishes the baseline security of the virtual machine. Then the software to be tested is run in the virtual machine and if the base changes it fails.
I think that DHS or some Federal Agencies have lists of software that is FDCC compliant and this should ease the burden of testing if the lists can be easily accessed. I'll probably test one of my applications this weekend.
At any rate search on FDCC for more informaton.
Parent
Re:Security at what level? (Score:4, Insightful)
I think most answers here (at least the reasonable ones) are going to have more questions than answers. Questions like:
Part of the problem is that there isn't any such thing as completely thorough testing that makes sure everything is completely secure from any kind of attack whatsoever. It doesn't exist. So when you're talking about testing security, you have to know what you're trying to achieve.
Are you just trying to meet some kind of regulation placed on your company from an outside body? Because that outside body should be providing you with information, then, that will tell you how to meet their standards. Are you just trying to satisfy someone's paranoia? Then you just need to come up with a bullshit standard that satisfies that person's paranoia.
For most situations, it's enough to protect against generic hacking over the network, worms, etc. In those cases, as far as the software installed, it's probably enough to buy from major vendors or use respectable FOSS distributors, and keep things patched. If you're using Debian/Redhat/SuSE, then you're probably good. Even Microsoft's stuff (despite its bad reputation on Slashdot), if kept up-to-date with patches, is fine. A decent firewall goes a long way, and you can look into IDS stuff.
Another valid concern is employees, so make sure they're locked down as much as possible, not given access to resources they don't need. Ideally you'll audit what you can, keep backups going back so if some data goes missing (or is mysteriously changed), you can recover it.
Or you might just be asking about making sure a given piece of software isn't malware? So you do some research online and find if anyone is complaining about it. Maybe you install it, scan for opened ports, look at the network traffic coming off for anything anomalous.
But if you're talking about auditing the security of Firefox or MS Office for bugs that allow for privilege escalation or something, and you're unwilling to rely on the analysis of other experts.... well, good luck with that.
Parent
Nessus (Score:5, Informative)
Veracode (Score:4, Informative)
Veracode [veracode.com]
Based on its breakthrough binary analysis technology, Veracode offers the world's first subscription-based security testing service that provides organizations with the only automated and independent assessment of security risks in applications, whether those applications are built in house, purchased as commercial off-the-shelf software or developed offshore.
Disclaimer: I know the founders but I am not involved in the company at all.
- SR
snakeoil .. (Score:2)
Why don't they put this 'technology' in Windows ? Or how about designing a compiler that don't allow insecure code?
Re: (Score:3, Interesting)
Reinventing the wheel? (Score:2, Interesting)
security test environment .. (Score:5, Insightful)
You can't test for security vulns, especially in a Windows environment, as there is so many interlocking components that behave differently depending on the configuration. Introducing a service pack into a previously 'secure' environment and all bets are off. All you can do is patch, patch patch
You could also intalss a second intrusion detection [wikipedia.org] system that monitors the first for unauthorized access and keeps a full audit of access alterations etc. You could also compartmentalize your system so as a breech in a web service doesn't automatically lead to a total system compromise.
no rootkits (Score:5, Funny)
You should deny the installation of rootkits, they cause maintenance and security problems
Re:no rootkits (Score:5, Funny)
Parent
Ban Windows except in Virtual Machines (Score:3, Funny)
Seriously. All you need to do is install a user-friendly Linux distro in the workers' machines, and install Windows using VirtualBox.
That's the only way to be sure.
If you're talking about installing software on the Windows Servers, I can only say this: ARE YOU OUT OF YOUR MIND!?!?
Penetration testing, for starters (Score:4, Insightful)
Put 20 hackers in a room... (Score:5, Funny)
and refuse to give them hot pockets until they crack the program.
An Accountability Sh!tstorm (Score:5, Insightful)
This is a no-win situation for the persons assigned to certifying an application. I personally have a very hard time communicating with managers who believe, with an unshakable faith, this is a reasonable solution to a perceived problem. When it blows up, MY head rolls, not theirs. The ages-old "Get IT in my office *now*" blame-shifting game.
The right way to handle this would be to push back hard and explain why this is an epic failure in the making and resources quagmire. That isn't typically a good political solution though.
I would love some advice as to how to change such foolish thinking.
Maybe you've got a good thing going there, but if there have been IT organizational changes recently, this may be a harbinger of things to come.
Give it to sales (Score:5, Funny)
If a group from sales can't break an app, it's secure.
You might also use a bunch of chimps. The only difference there is all of the poo flinging, screaming and downright annoyance factor, but it's hard to find good chimps, so it's easier to just put up with it and use folks from sales.
Not as easy as it seems (Score:2, Interesting)
One of the problems is that there are lots of specialized applications. Users are often used to downloading open-source applications (like, say, an ssh client) when they need it -- and they don't want to wait three months to a year for it to undergo testin
Fools Errand. (Score:5, Insightful)
1) There is no secure software. Just software that doesn't have any known vulnerabilities.
2) Define 'thoroughly tested'.
3) White-listing applications is going to cause your company pain as people wait for required tools to become available.
4) You can't afford to do this yourself.
Look at it this way. When PHB is shouting for his new shiny piece of software to work, you can bet that 'thoroughly tested' gets severely watered down. You'll be left with some software on the list that has vulnerabilities whilst other people can't get their jobs done because the software hasn't been listed yet. Even if you avoid those pitfalls and manage to 'thoroughly test' each application, how many applications does your company use? Say you can test an application in 2 weeks - For one fulltime employee you'll white-list 24 applications in a year. The fact that you are asking /. for help suggests that you don't have much knowledge or experience in this field, so you're going to have to pay for training or for an employee with that training.
This model is doomed to failure, and whoever suggested it should be shown the door and replaced with a CISSP qualified guy (or gal). Security is a process, and what you need are tools to help carry out that process. Someone with a CISSP qualification will know where to find those tools.
Some of those tools might include auditing (to find what applications are in use), firewalls, IDS systems (to detect suspicious traffic), patch management (to mitigate vulnerable software), an intelligence provider (to tell you about new vulnerabilities and patches in a timely manner), a Security Event Management system (to manage security data and drive processes) etc...
For the record, I am a QA lead engineer with experience in enterprise and industrial security. I do this kind of stuff for a (good) living.
More about knowledge of infrastructure... (Score:4, Insightful)
The likely goal (from a management perspective) is to establish an authoritative list to allow for efficient management of vulnerabilities. If you know what's out there and "authorized" you can respond to threats far more quickly than otherwise.
Your management would be silly to expect you (unless you are an application analysis company) to thoroughly vet every application that comes through the door. It would be a terrible waste of time.
Do some basic analysis (what ports does it open, does it connect out to other systems, that sort of thing). Beyond that, I believe the value is simply in knowing about the application and being able to track any potential issues.
Well... (Score:2, Informative)
The workplace I work for is a rather large multi-billion (possibly trillion) dollar business. When testing application compatability they use development servers which are a mirror to the production ones but completely disconnected from the external network.
1) Apply new software to test enviroment
2) Distribute access to a test group
3) Gather reports, determine impact
4) Distribute into production if deemed appropriate
It isn't the most cost effective solution but it works when you're trying to roll out an upd
Look beyond apps (Score:3, Interesting)
but my main concern is with Windows apps."
First, secure your OS somehow. A Windows install will almost certainly be less secure then a comparable OS X/Linux/BSD install, not only because of the openness of code, but security through obscurity. Your real trouble isn't with skilled hackers, they can get through almost anything if it isn't the nightly build, but rather script kiddies who use 1337hax0rtool.exe to attack.
And there is no such thing as a secure system, only a more secure system and a less secure system.
you're asking slashdot? (Score:4, Funny)
Boss: create me a secure test environment.
guy: OK, my first step is to ask the people of the internet.
types: dear slashdot, how can I create a secure test environment?
slashdot responses:
-do not use any microsoft products. they are the borg.
-the important thing is whether you will use vi or emacs.
-use a ham radio instead
-who's going to "helm" the next LOTR "vehicle"
Penetration Testing Tools (Score:5, Informative)
There is no such thing as an app that is "known secure", only apps that are "unknown risk" and "definite risk".
With that in mind, you can mitigate your risk by:
1 - Closing ports down that you don't absolutely need talking to the world. Nmap is your friend here.
2 - Scan for as many known attack vectors as you can. A good start? Metasploit. Get it. Use it. The bad guys are already probing you with it.
3 - Personally, I also like to run a different server OS than desktop (i.e.: you probably have Windows on the desktop, so use Linux in the server room). Exploiting shared vulnerabilities between client and server makes life so much easier for the bad guy that REALLY wants to spoil your week.
4 - Beware of trust. In this case, beware of trust relationships between machines. You don't want one compromised server leading to a bunch more.
5 - Containment. You CANNOT guarantee every system is secure, so design your network to allow for the eventuality that some portion WILL be compromised. Limit the damage before it happens.
Oh, and after you use the black hat tools to test your network, scrub those systems you used to bare metal. Don't trust that those systems are still trustworthy.
No software (Score:3, Funny)
You can't possibly test everything. (Score:3, Insightful)
Give your employer a cost-benefit analysis comparing the migration to either a Linux or Mac server backbone that won't let users f*ck it up so easily, to the zillions of hours of overtime they'd have to pay a whole crew of code-monkeys and network goons to moonlight scrutinize all possible apps for all possible vulnerabilities, and let them decide
Virtual machines and a sniffer / IDS (Score:3, Informative)
Well, for a security test environment, I'd find it quick and easy to set up a bunch of virtual machines on an isolated network (that is similar to your production network, with proxies and firewalls to the big bad internet where appropriate, etc.). This will make your test environment easy to clone & reset to a known configuration.
Then you want to place a sniffer (wireshark) where you can see all traffic between the virtual machines. This gives you some idea of what a piece of software is "doing"... what remote servers it's trying to connect to, whether it bothers to use any type of encryption or at least obfuscation when it sends data around in the network, etc. Might want to run portscans (nmapfe) as well to see what vulnerabilities the software opens up on your host, and whether you can exploit them using commonly available hacker tools.
Finally, it'd also be informative to have an intrusion detection system (such as snort + acidlab) on that network (as well as on you production network) to help catch and interpret suspicious network activity.
So there are some basic things you can do to easily assess what risks your applications pose from the outside. It will help you catch basic hacker attacks such as IRC / VNC backdoors and stuff. More sophisticated attacks (which might conceal traffic to the outside via sneaky TCP-over-DNS or the like, or hide backdoors using port-knocking) would be harder to detect... for those you'd just have to have an accountability trail back to your suppliers of that software, especially if you have no way to inspect the source code for that kind of malicious embedded trojan.
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Perhaps he should try getting his software from someone who creates it with their brains instead of their muscle.
Re: (Score:3, Informative)
MBSA is far from perfect, but it is what IS demands of us. See, us lowly SysAdmins know nothing about security. But IS tells us that Microsoft is secure and Linux isn't because (direct quote) "is is programmed by teenage turds in their basement that don't know anything."
I'm glad we have those specialized security experts (spoonfed by Microsoft) to keep me in line.