1 00:00:01,740 --> 00:00:07,990 Welcome come to a module and assessing application security the module will highlight and examine typical 2 00:00:07,990 --> 00:00:10,830 security problems from an administrative point of view. 3 00:00:12,880 --> 00:00:20,140 The previous module discussed application layer threats and attacks this time emphasis will be on top 4 00:00:20,140 --> 00:00:23,930 administrative practices and approaches to existing problems. 5 00:00:25,430 --> 00:00:31,080 Hints in how to knowledge will be provided to administrators to help them identify and secure applications. 6 00:00:33,130 --> 00:00:40,670 Once risky programs are detected tips on reducing their threat level will be given the stakes are high. 7 00:00:42,430 --> 00:00:47,590 How should an administrator respond to face with the necessity to allow a program to operate or be run 8 00:00:50,600 --> 00:00:56,660 the program in question could for example be a CEO his beloved application or a program that has been 9 00:00:56,660 --> 00:01:01,010 10 years in use in an accounting department that will not pretend to want to learn to use a different 10 00:01:01,010 --> 00:01:01,690 tool. 11 00:01:03,710 --> 00:01:08,980 The old program stores did it in a completely nontransparent manner and it can't be exported to boot. 12 00:01:11,220 --> 00:01:16,050 It would only seem possible for an administrator to report a security problem to a software company 13 00:01:16,950 --> 00:01:21,300 like only after it produced a crisis and hope for a swift reaction. 14 00:01:23,370 --> 00:01:27,510 But what if the producer quit working on the software or simply doesn't want to reply. 15 00:01:29,170 --> 00:01:34,910 Or what if your company is small and they complaint is likely to be ignored. 16 00:01:34,940 --> 00:01:37,900 The problem is a serious one. 17 00:01:38,070 --> 00:01:43,710 If you take a look at the bird's eye view in the slide above it seems like any implemented solution 18 00:01:43,710 --> 00:01:47,130 that conforms to the set of rules we outlined throughout this course. 19 00:01:47,430 --> 00:01:53,460 Filtering traffic using two firewalls and isolated demilitarized zone where high risk programs are running 20 00:01:53,790 --> 00:02:00,570 monitoring web traffic manually and on a regular basis is still inefficient when it comes to databases. 21 00:02:00,600 --> 00:02:07,710 For example a customer database What's the reason for this. 22 00:02:07,720 --> 00:02:13,600 The problem is in the fact that attacks that rely on attempting to access as servers bypass firewalls 23 00:02:13,600 --> 00:02:20,160 in a way that is undetectable for them since an executable server is listening on some port. 24 00:02:20,260 --> 00:02:25,420 If the port is open to an external firewall potential attackers will try to connect directly to an as 25 00:02:25,420 --> 00:02:28,720 Cuil server. 26 00:02:28,830 --> 00:02:33,200 There would not need a proxy in the form of a web application. 27 00:02:33,400 --> 00:02:38,440 If the port is not open attackers will try to connect through port 80 to a computer that is inside the 28 00:02:38,440 --> 00:02:44,950 demilitarized zone and read tunnel traffic to port 14:30 3 or some other port that will help them cross 29 00:02:44,950 --> 00:02:46,010 the firewall. 30 00:02:48,120 --> 00:02:52,950 This is more complicated and requires an attacker to seize control over an entity that is inside the 31 00:02:52,950 --> 00:02:53,680 zone. 32 00:02:55,390 --> 00:02:57,720 The solution is not infeasible however. 33 00:02:59,630 --> 00:03:02,410 On the contrary it is quite likely to be tried. 34 00:03:04,790 --> 00:03:11,840 If someone tries to read or worse still modify the contents of a database they will probably use as 35 00:03:11,840 --> 00:03:13,820 fuel injection for this purpose. 36 00:03:15,460 --> 00:03:22,200 They will manipulate as Cuil queries the attackers queries will be answered to a browser that connects 37 00:03:22,200 --> 00:03:27,040 to a web application and the application will forward them to an S CULE server. 38 00:03:28,880 --> 00:03:36,050 All security solutions in between will simply be bypassed if the web application also turns out to be 39 00:03:36,050 --> 00:03:45,000 vulnerable the environment that can be used to attack it as a browser and port 80 or 443 any security 40 00:03:45,000 --> 00:03:47,920 solutions that the computer network level are ignored. 41 00:03:49,960 --> 00:03:54,760 An updated and well configured web server does not lend security to applications that are run by the 42 00:03:54,760 --> 00:03:55,980 server. 43 00:03:56,080 --> 00:04:05,520 It's often the opposite this course puts emphasis on such situations in particular even a good configuration 44 00:04:05,520 --> 00:04:10,860 of an entire server and web servers won't do much good if a potential attacker is able to establish 45 00:04:10,860 --> 00:04:13,350 a privileged account in the application. 46 00:04:14,910 --> 00:04:20,940 Data snooping can occur if an attacker has local access to a network. 47 00:04:21,090 --> 00:04:28,890 One of the earlier modules discussed is the fact that local attacks account for 80 percent of all attacks. 48 00:04:28,900 --> 00:04:33,550 This means that the majority of security solutions do not apply to us since we connect to a channel 49 00:04:33,550 --> 00:04:42,420 that is beyond them and that's server can be mis configured as well not due to an administrator's mistake 50 00:04:42,940 --> 00:04:50,260 but due to faults of the database that's running on the PC often a database requires a connection to 51 00:04:50,260 --> 00:04:55,850 a client application is made using the account of an administrator for the entire skewl server. 52 00:04:57,490 --> 00:05:01,440 It's unclear why it should need these privileges. 53 00:05:01,440 --> 00:05:03,440 This is the default setting. 54 00:05:03,600 --> 00:05:06,040 Databases are configured and running in this way.