Ahead of a revamped DEV522: Defending Web Applications Security Essentials course which will debut at SANS Dubai this October, course tutor Jason Lam urges organisations within the region to take a closer look at secure development processes. “Many organisations in the region are increasingly utilising outsourced development to partners in India and China which offer many cost benefits,” explains Lam, “The level of coding is often very good but organisations must still control risk and mandate the security level and defensive requirements – the reality is that you can’t outsource risk.”
Lam suggests that organisations have not developed enough skill in defining and managing best practice for working with external development contractors. “The customer must always draft the development framework and then be prepared to test that the application is secure and meets the agreed standard.”
Although a valuable tool, Lam suggests that automated methods for testing the security of applications should not be the only method, “What these tools can’t test for are vulnerabilities that have emerged during development due to poorly defined logic or processes,” says Lam, “Automated testing tools can be effective in finding vulnerabilities such as SQL injection and XSS once the entry points to the web site are located, often times, the testing tools miss a large portion of the site and are totally ignorant to the business logic issues within the website.”
The DEV522 course has been updated extensively to cover some of the major trends in software development and Lam points to the HTML 5 sections as a great example of why organisations have to continually help staff to maintain a relevant skill set. “HTML5 is an incredibly powerful tool set that in many way makes for an easier and more efficient development framework,” says Lam, “But it also has a different set of requirements in terms of secure development which need to be understood and considered to create secure applications. Like all systems, there are also unique weaknesses and potential vulnerabilities when working within HTML 5 and the course will show how developers can mitigate these risks.”
Alongside his role as a certified SANS instructor, Lam heads up cyber defence at a large global financial organisation in Canada and holds a BA in computer science from York University in Toronto, Ontario, as well as the CISSP, GCIA, GCFW, GCUX, GCWN, and GCIH certifications.
The expert also points out that the OWASP Top 10 list of vulnerabilities are still out in the wild and that even with advances in modern programming languages with built in defence mechanisms, there is still a lack of core security skills at the most fundamental level. “Most university courses are still missing out on teaching secure development techniques as an active part of the curriculum,” he points out, “and this imbalance means that organisations must start from the assumption that developers, either in-house or outsourced, may not have these skills by default.”
Lam suggests that every project leader needs to have a baseline set of security skills to allow the sensible creation of a best practice process, “However, there is no universal standard – each organisation needs to build a method that suits its own environment and working practices.”
SANS Dubai 2013, the Gulf Region's largest InfoSec training event will be held at the Hilton Dubai Jumeirah resort from October 26th till November 7th 2013. Alongside Dev522, the event will also host SANS Security 504: Hacker Techniques, Exploits & Incident Handling taught by James Lyne and the popular SEC542: Web App Penetration Testing and Ethical Hacking course with Dave Shackleford. The event is rounded off by FOR408: Computer Forensic Investigations - Windows In-Depth, taught by Jess Garcia.