Security Management prepared by Dean Hipwell, CISSP ISSA - Sacramento Valley Security Top Lists prepared by Dean Hipwell, CISSP References: www.OWASP.org www.SANS.edu www.dsd.gov.au

OWASP Top 10 Web Application Security Risks for 2010 Security Management OWASP Top 10 Web Application Security Risks for 2010 Source: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project A1: Injection A2: Cross-Site Scripting (XSS) A3: Broken Authentication and Session Management A4: Insecure Direct Object References A5: Cross-Site Request Forgery (CSRF) A6: Security Misconfiguration A7: Insecure Cryptographic Storage A8: Failure to Restrict URL Access A9: Insufficient Transport Layer Protection A10: Unvalidated Redirects and Forwards

SANS Top Cyber Security Risks Security Management SANS Top Cyber Security Risks Source: http://www.sans.org/top-cyber-security-risks/ Priority One: Client-side software that remains unpatched. Priority Two: Internet-facing web sites that are vulnerable. Operating systems continue to have fewer remotely-exploitable vulnerabilities that lead to massive Internet worms. Rising numbers of zero-day vulnerabilities

SANS Top 20 Critical Security Controls - Version 3.0 Security Management SANS Top 20 Critical Security Controls - Version 3.0 Source: http://www.sans.org/critical-security-controls/ 1: Inventory of Authorized and Unauthorized Devices 2: Inventory of Authorized and Unauthorized Software 3: Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers 4: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches 5: Boundary Defense 6: Maintenance, Monitoring, and Analysis of Audit Logs 7: Application Software Security 8: Controlled Use of Administrative Privileges 9: Controlled Access Based on the Need to Know 10: Continuous Vulnerability Assessment and Remediation

SANS Top 20 Critical Security Controls - Version 3.0 Security Management SANS Top 20 Critical Security Controls - Version 3.0 Source: http://www.sans.org/critical-security-controls/ 11: Account Monitoring and Control 12: Malware Defenses 13: Limitation and Control of Network Ports, Protocols, and Services 14: Wireless Device Control 15: Data Loss Prevention 16: Secure Network Engineering 17: Penetration Tests and Red Team Exercises 18: Incident Response Capability 19: Data Recovery Capability 20: Security Skills Assessment and Appropriate Training to Fill Gaps

SANS Top 25 Most Dangerous Software Errors Security Management SANS Top 25 Most Dangerous Software Errors Source: http://www.sans.org/top25-software-errors/ Insecure Interaction Between Components CWE ID Name CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-434 Unrestricted Upload of File with Dangerous Type CWE-352 Cross-Site Request Forgery (CSRF) CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

SANS Top 25 Most Dangerous Software Errors Security Management SANS Top 25 Most Dangerous Software Errors Source: http://www.sans.org/top25-software-errors/ Risky Resource Management CWE ID Name CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-494 Download of Code Without Integrity Check CWE-829 Inclusion of Functionality from Untrusted Control Sphere CWE-676 Use of Potentially Dangerous Function CWE-131 Incorrect Calculation of Buffer Size CWE-134 Uncontrolled Format String CWE-190 Integer Overflow or Wraparound

SANS Top 25 Most Dangerous Software Errors Security Management SANS Top 25 Most Dangerous Software Errors Source: http://www.sans.org/top25-software-errors/ Porous Defenses CWE ID Name CWE-306 Missing Authentication for Critical Function CWE-862 Missing Authorization CWE-798 Use of Hard-coded Credentials CWE-311 Missing Encryption of Sensitive Data CWE-807 Reliance on Untrusted Inputs in a Security Decision CWE-250 Execution with Unnecessary Privileges CWE-863 Incorrect Authorization CWE-732 Incorrect Permission Assignment for Critical Resource CWE-327 Use of a Broken or Risky Cryptographic Algorithm CWE-307 Improper Restriction of Excessive Authentication Attempts CWE-759 Use of a One-Way Hash without a Salt

Au-DSD Top 35 Mitigation Strategies (Part 1) Security Management Au-DSD Top 35 Mitigation Strategies (Part 1) Source: http://www.dsd.gov.au/infosec/top-mitigations/top35mitigationstrategies-list.htm Ranking Strategy 1 Patch applications within 2 days for high risk vulnerabilities. 2 Patch O/S within 2 days for high risk vulnerabilities. 3 Minimize the number of local admins. Assign separate accounts. 4 Application white-listing: Prevent unauthorized programs. 5 HIDS/HIPS: Identify anomalous behavior. 6 E-mail content filtering: Allow only authorized attachments. 7 Block spoofed e-mail. 8 User education. 9 Web content filtering. 10 Web domain white-listing. 11 Web domain white-listing for HTTP/SSL. 12 Workstation inspection of Microsoft Office files.

Au-DSD Top 35 Mitigation Strategies (Part 2) Security Management Au-DSD Top 35 Mitigation Strategies (Part 2) Source: http://www.dsd.gov.au/infosec/top-mitigations/top35mitigationstrategies-list.htm Ranking Strategy 13 Application-based workstation firewall: block incoming traffic. 14 Application-based workstation firewall: prevent outgoing traffic. 15 Network segregation. 16 Multi-factor authentication. 17 Randomized local admin passphrases. (Prefer domain groups) 18 Enforce strong passphrases. 19 Border gateway using an IPv6-capable firewall. 20 Data Execution Prevention. 21 Antivirus software with up to date signatures. 22 Non-persistent virtualized trusted operating environment. 23 Centralized and time-synchronized logging: network traffic. 24 Centralized and time-synchronized logging: computer events.

Au-DSD Top 35 Mitigation Strategies (Part 3) Security Management Au-DSD Top 35 Mitigation Strategies (Part 3) Source: http://www.dsd.gov.au/infosec/top-mitigations/top35mitigationstrategies-list.htm Ranking Strategy 25 Standard O/S with unneeded functions disabled. 26 Application hardening: disable unneeded features. 27 Restrict access to NetBOIS features. 28 Server hardening. 29 Removable and portable media control. 30 TLS encryption between email servers. 31 Disable LanMan password support and cached credentials. 32 Block attempts to access web sites by their IP address instead of by their domain name. 33 NIDS/NIPS: Identify anomalous traffic. 34 Gateway blacklisting to block access to known malicious domains. 35 Full network traffic capture to perform post-incident analysis.