1. Protecting Federal Government from Web 2.0 Application Security Risks
Dr. Sarbari Gupta, CISSP, CISA
Electrosoft
11417 Sunset Hills Road, #228
Reston, VA 20190

3. Agenda Web 2.0 Fundamentals Web 2.0 and the US Feds Web 2.0 Risks
FISMA and Web 2.0

4. Web 2.0 Fundamentals

5. Created by Rob Cottingham at http://mashable

6. What is Web 2.0? Social Media/Web Applications such as:
Facebook/LinkedIn
Twitter
RSS Feeds
Blogs
Wikis
Web Chat
Podcasts
Mashups
Photo/Video-sharing
Virtual Worlds …

7. Characteristics of Web 2.0 Tools
Applications hosted on Web platform
Users are Content Creators/Editors
Highly Interactive
Supports Rich Content / Media Types
Easy to Use

8. Web 1.0 Content Model Web Platform Site Content Security Controls
Webmaster
Web Platform
Browser Users
Sys Admin
Hackers

9. Web 2.0 Content Model (I) Content Outside Content Evil Users Providers
Web 2.0 Tool
Web Platform
Tool Programmer
Benign Users
Security Controls
Sys Admin

10. Web 2.0 Content Model (II) Web 2.0 Clients are Content Creators
Web 2.0 Server provides
Data Aggregation from Varied Sources
Platform for Information Exchange
Storage for User/Client-created Content
Segregation between Users (if needed)

11. Technologies enabling Web 2.0
AJAX (Asynchronous JavaScript and XML)
JSON (JavaScript Object Notation)
REST (Representational State Transfer)
SOAP (Simple Object Access Protocol)
and others …

12. Web 2.0 and the US Federal Government

13. Drivers for Fed Adoption of Web 2.0
Jan 21, 2009 – Memorandum on Transparency and Open Government
Promotes Transparency, Participation and Collaboration
Feb 24, M-09-12, President's Memorandum on Transparency and Open Government - Interagency Collaboration
Establishes mechanisms to seek participation/collaboration
Dec 8, M Open Government Initiative
Describes 4 Specific Steps for Agencies to implement Open Government

14. Benefits for Fed Adoption of Web 2.0 Tools
Increase education/outreach/training
Allow Rapid dissemination of information
Support Recruitment
Promote citizen participation in Government
Facilitate interactive communication

15. Fed Policy for Web 2.0
Apr 7, 2010 – Memo on Social Media, Web-based Interactive Technologies and the Paperwork Reduction Act
Describes activities that are not subject to the Paperwork Reduction Act (PRA)
Jun 25, 2010 – M Guidance for the Use of Third- Party Websites and Applications
Protecting Individual Privacy while using 3rd party websites/tools to engage with public
Nov 3, 2010 – M – Sharing Data While Protecting Personal Privacy
Promotes data sharing while embracing responsible stewardship

16. Fed Initiatives for Web 2.0
GSA/ Office of Citizen Services
answers.usa.gov; webcontent.gov; Apps.gov
CIA – Facebook for recruiting
HHS – Pandemic Flu Leadership Blog
USPTO – Collect input towards pending patents
DoD – Virtual Worlds to simulate terrorism
Library of Congress – Flickr to make public aware of holdings

17. Web 2.0 Risks

18. Web 2.0 Use Cases* for Government
Inward
Intra-organizational
(internal Wikis, SharePoint)
Inbound
“Crowd-sourcing”
(public polls, change.gov)
Internal
Sharing Direction
Outward
Inter-Institutional
(GovLoop, STAR-TIDES)
Outbound
Govt engagement on
commercial Social Media
(Twitter)
External
Group
Individual
Interaction Level
* Guidelines for Secure Use of Social Media by Federal Departments and Agencies”, ISIMC, V1.0, Sept 2009

19. Top Web 2.0 Security Risks Spear Fishing* Social Engineering*
Web Application Attacks*
Cross Site Scripting (XSS)
Cross Site Request Forgery (XSRF)
Security Flaws in (Aggregation) Partner Sites
Weak Authentication Controls
Information Leakage
Injection Flaws
* Guidelines for Secure Use of Social Media by Federal Departments and Agencies”, ISIMC, V1.0, Sept 2009

20. OWASP Top 10 (2010) A1: Injection A2: Cross-Site Scripting (XSS)
A3: Broken Authentication and Session Management
A4: Insecure Direct Object References
A5: Cross-Site Request Forgery (CSRF)
A6: Security Misconfiguration
A7: Insecure Cryptographic Storage
A8: Failure to Restrict URL Access
A9: Insufficient Transport Layer Protection
A10: Unvalidated Redirects and Forwards

21. Implications …
Application Security Vulnerabilities are at the core of Web 2.0 risks
Web 2.0 Applications provide new avenues for old threats due to their:
Complexity
Popularity
Ubiquity

22. FISMA and Web 2.0

23. Federal Information Security Landscape
Federal Practices in Information Security are driven by REGULATORY COMPLIANCE
Title III of E-Government Act of Federal Information Security Management Act (FISMA)
Privacy Act of 1974
OMB Circular A-130, Appendix III
OMB Memos, …
FISMA is implemented through NIST guidelines
Special Pubs , , …

24. NIST SP Rev 3
Title: Recommended Security Controls for Federal Information Systems and Organizations
Published: August 2009
Approach: Risk Management Framework
Categorize Information System
Select Security Controls
Implement Security Controls
Assess Security Controls
Authorize Information System
Monitor Security Controls
18 families of Security Controls ID
FAMILY
CLASS AC
Access Control
Technical AT
Awareness and Training
Operational AU
Audit and Accountability CA
Security Assessment and Authorization
Management CM
Configuration Management CP
Contingency Planning IA
Identification and Authentication IR
Incident Response MA
Maintenance MP
Media Protection PE
Physical and Environmental Protection PL
Planning PS
Personnel Security RA
Risk Assessment SA
System and Services Acquisition SC
System and Communications Protection SI
System and Information Integrity PM
Program Management

25. FISMA Definition of “Information Security”
Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—
(A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;
(B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and
(C) availability, which means ensuring timely and reliable access to and use of information.

26. Parsing the FISMA Definition …
Assets to be protected
Information
Information Systems
Information needs to be protected for C-I-A
Confidentiality (C)
Integrity (I)
Availability (A)

27. Web 2.0 Content Model Content Outside Content Evil Users Providers
Web 2.0 Tool
Web Platform
Tool Programmer
Benign Users
Security Controls
Sys Admin

28. Web 2.0 Usage Models for Feds
Fed Users are Web 2.0 Clients – Web 2.0 Server is in the Cloud
FISMA Controls may suffice to protect the IT resources used by the Fed Users
Feds Host Web 2.0 Applications/Servers
FISMA controls provide little or no protection for (citizen) Users

29. FISMA and Web 2.0 Content
User supplied Web 2.0 content can be protected for C-I-A per FISMA …
and yet be dangerous to other Users
Protecting Users of Government Web 2.0 Apps is …
not within the scope of FISMA

30. Introducing Safety & Reliability (I)
When Government builds a bridge over a river
Concern #1: Is the bridge reliable?
Concern #2: Is the bridge safe? …
Concern #n: Is the bridge protected from harm (by Users)?

31. Introducing Safety & Reliability (II)
When Government builds a Web 2.0 Application
Concern #1: Is the underlying Information System protected from harm (by Users)?
Concern #2: Is the Web 2.0 content protected for C-I- A?
The concerns that do not currently surface
Is the Application reliable?
Is the Application safe?

32. Final Thoughts
How do we protect US Federal Government and Citizens from Web 2.0 Risks?
Promulgate policy to ensure the safety and reliability of Government information systems from the Users’ perspective
Add security controls to explicitly require safety and reliability checks