The OWASP Foundation AppSec DC Securing the Core J2EE Patterns

Securing the Core J2EE Patterns

AppSec DC Sep 21, 2009

Rohit Sethi & Krishna Raja Project leader, Secure Pattern Analysis Project Security Compass [email protected] [email protected]

The OWASP Foundation http://www.owasp.org

Design Before Building

OWASP CC Flickr User Chris Devers, NC ND

2

We create Threat Models on Completed Designs

What About During Design? OWASP

3

Design Patterns are Used During Design

OWASP

4

Core J2EE Patterns are Used Extensively

OWASP

5

JSF Struts

Velocity

Proprietary Frameworks

Tapestry Spring

OWASP

6

Project: Analyze Patterns

OWASP

7

Project Goals  Analyze patterns for security pitfalls to avoid  Determine how patterns can implement security controls  Provide advice portable to most frameworks

OWASP

8

Not Overlapping

OWASP

9

Uses  Designing new web application frameworks  Designing new apps that use the patterns  Source code review of existing apps  Runtime assessment of existing apps  Integrate with threat modeling of new or existing apps

OWASP

10

OWASP

11

Avoid

OWASP

12

Design Analysis (This Project)

Control Implementation (ESAPI)

Verification (Static / Runtime Scan)

OWASP

13

You Can Help ...

...Tell Developers CC Flickr User wili hybrid

OWASP

14

Next?

OWASP

15

Our Dream:

+ New web application framework idea CC Flickr User Evan Hunter, NC ND

= Designtime security analysis CC Flickr User IceSabre, NC

Secure-by-default web application framework

CC Flickr User AMagill OWASP

16