Global Quality Journal

Application Security Testing…..the Integrated Quality Way! (Eclipse, Maven, Cucumber, OWASP ZAP)

Greg Margolin:

Should QA engineers get involved in application security testing? Should we consider that there might be vulnerabilities in the systems that we release? In a word, should we care? Or is the whole endeavor better off left to professional white hat hackers?

The answer to the question is easy to come by, if we ask a somewhat similar question: should architects, builders, and civil engineers be concerned with structural safety of their buildings? Or is the whole endeavor better off left to first responders -- firefighters, EMTs, police officers, judges, doctors, nurses, and funeral directors?

Well, the good people at the OWASP ZAP project really hope that everybody, developers, ops, QA, would get involved in building secure web applications. They developed a great tool that is useful to everybody on the team -- from complete novices to advanced penetration testers. The tool is an integrated platform that allows users to conduct passive scanning of a web application (the tool is a web proxy), launch active scanning --- attacks, simulate brute force and fuzzing attacks, and conduct authentication testing. When a vulnerability is discovered it is properly flagged and useful background information is provided. On the OWASP ZAP site there are a lot of very useful video tutorials as well.

In this installment of GQP's Integrated Quality series, I show how a QA team could make a first step in integrating application security testing into their daily activities. As a model, I used my previous video tutorial where I showed how JMeter can be driven by Cucumber using Maven within Eclipse. The objective in that video was to show how performance requirements could be surfaced to the design level instead of being buried within a tool and scripts.

Going forward with this model, I have used the same project in Eclipse and very similar Groovy code to integrate OWASP ZAP within the testing cycle. The demo is basic, I specify the requirement of testing for web security vulnerabilities in Cucumber, run OWASP ZAP, inspect generated reports for risk alerts, and then produce a familiar Cucumber report.

Toward the end of the video I run both JMeter and OWASP ZAP to show the Integrated Quality (TM) approach in all its glory.

posted by: Greg Margolin

High Speed Of Coding Killed Application Security

Unsafe at any speed? Jeff Williams of Aspect Security makes a sobering observation that rings very true.

Darkreading.com:

A typical, midsized financial organization has a portfolio of over a thousand applications. The largest firms exceed ten thousand applications. Each of these applications, on average, has hundreds of thousands of lines of custom code, and the largest can have over ten million lines. In addition, each application also includes anywhere from dozens to hundreds of software libraries, frameworks, and components that typically total over ten times the size of the custom code. And this portfolio is growing rapidly -- over 20% of these applications have new and updated code each year.

By comparison, consider the US Federal Tax Code, which has also grown dramatically over the years. Currently, the tax code totals just 4.4 million lines of “code” – roughly equivalent to just a handful of applications. As a security researcher I’ve discovered thousands of vulnerabilities in code. But as a former CEO, I’ve also analyzed a ton of legal contracts for loopholes. What’s interesting is that whether I’m scrutinizing software code or reviewing legal language, the analysis is not as different as you might think. Both require a detailed understanding of specialized language and a solid understanding of the underlying business.

So after two decades of high speed coding, a typical large financial organization has a pile of code as large as 2,000 copies of the entire 73,954 pages in the US Federal Tax Code -- almost 10 billion lines of code. (read full article) 

posted by: gqjournal