Alice and Bob Learn Application Security

Tanya Janca, also known as SheHacksPurple, is the founder of We Hack Purple, an online learning academy dedicated to teaching everyone how to create secure software. With over twenty years of IT and coding experience, she has won numerous awards and worked as a developer, pentester, and AppSec Engineer. She was named Hacker of the Year by the Cybersecurity Woman of the Year 2019 Awards and is the Founder of WoSEC International, #CyberMentoringMonday, and OWASP DevSlop.

• Foreword xxiIntroduction xxiiiPart I What You Must Know to Write Code Safe Enough to Put on the Internet 1Chapter 1 Security Fundamentals 3The Security Mandate: CIA 3Confidentiality 4Integrity 5Availability 5Assume Breach 7Insider Threats 8Defense in Depth 9Least Privilege 11Supply Chain Security 11Security by Obscurity 13Attack Surface Reduction 14Hard Coding 15Never Trust, Always Verify 15Usable Security 17Factors of Authentication 18Exercises 20Chapter 2 Security Requirements 21Requirements 22Encryption 23Never Trust System Input 24Encoding and Escaping 28Third-Party Components 29Security Headers: Seatbelts for Web Apps 31Security Headers in Action 32X-XSS-Protection 32Content-Security-Policy (CSP) 32X-Frame-Options 35X-Content-Type-Options 36Referrer-Policy 36Strict-Transport-Security (HSTS) 37Feature-Policy 38X-Permitted-Cross-Domain-Policies 39Expect-CT 39Public Key Pinning Extension for HTTP (HPKP) 41Securing Your Cookies 42The Secure Flag 42The HttpOnly Flag 42Persistence 43Domain 43Path 44Same-Site 44Cookie Prefixes 45Data Privacy 45Data Classification 45Passwords, Storage, and Other Important Decisions 46HTTPS Everywhere 52TLS Settings 53Comments 54Backup and Rollback 54Framework Security Features 54Technical Debt = Security Debt 55File Uploads 56Errors and Logging 57Input Validation and Sanitization 58Authorization and Authentication 59Parameterized Queries 59URL Parameters 60Least Privilege 60Requirements Checklist 61Exercises 63Chapter 3 Secure Design 65Design Flaw vs. Security Bug 66Discovering a Flaw Late 67Pushing Left 68Secure Design Concepts 68Protecting Sensitive Data 68Never Trust, Always Verify/Zero Trust/Assume Breach 70Backup and Rollback 71Server-Side Security Validation 73Framework Security Features 74Security Function Isolation 74Application Partitioning 75Secret Management 76Re-authentication for Transactions (Avoiding CSRF) 76Segregation of Production Data 77Protection of Source Code 77Threat Modeling 78Exercises 82Chapter 4 Secure Code 83Selecting Your Framework and Programming Language 83Example #1 85Example #2 85Example #3 86Programming Languages and Frameworks: The Rule 87Untrusted Data 87HTTP Verbs 89Identity 90Session Management 91Bounds Checking 93Authentication (AuthN) 94Authorization (AuthZ) 96Error Handling, Logging, and Monitoring 99Rules for Errors 100Logging 100Monitoring 101Exercises 103Chapter 5 Common Pitfalls 105OWASP 105Defenses and Vulnerabilities Not Previously Covered 109Cross-Site Request Forgery 110Server-Side Request Forgery 112Deserialization 114Race Conditions 115Closing Comments 117Exercises 117Part II What You Should Do to Create Very Good Code 119Chapter 6 Testing and Deployment 121Testing Your Code 121Code Review 122Static Application Security Testing (SAST) 123Software Composition Analysis (SCA) 125Unit Tests 126Infrastructure as Code (IaC) and Security as Code (SaC) 128Testing Your Application 129Manual Testing 130Browsers 131Developer Tools 131Web Proxies 132Fuzzing 133Dynamic Application Security Testing (DAST) 133VA/Security Assessment/PenTest 135Testing Your Infrastructure 141Testing Your Database 141Testing Your APIs and Web Services 142Testing Your Integrations 143Testing Your Network 144Deployment 145Editing Code Live on a Server 146Publishing from an IDE 146“Homemade” Deployment Systems 147Run Books 148Contiguous Integration/Continuous Delivery/Continuous Deployment 148Exercises 149Chapter 7 An AppSec Program 151Application Security Program Goals 152Creating and Maintaining an Application Inventory 153Capability to Find Vulnerabilities in Written, Running, and Third-Party Code 153Knowledge and Resources to Fix the Vulnerabilities 154Education and Reference Materials 155Providing Developers with Security Tools 155Having One or More Security Activities During Each Phase of Your SDLC 156Implementing Useful and Effective Tooling 157An Incident Response Team That Knows When to Call You 157Continuously Improve Your Program Based on Metrics, Experimentation, and Feedback 159Metrics 159Experimentation 161Feedback from Any and All Stakeholders 161A Special Note on DevOps and Agile 162Application Security Activities 162Application Security Tools 164Your Application Security Program 165Exercises 166Chapter 8 Securing Modern Applications and Systems 167APIs and Microservices 168Online Storage 171Containers and Orchestration 172Serverless 174Infrastructure as Code (IaC) 175Security as Code (SaC) 177Platform as a Service (PaaS) 178Infrastructure as a Service (IaaS) 179Continuous Integration/Delivery/Deployment 180Dev(Sec)Ops 180DevSecOps 182The Cloud 183Cloud Computing 183Cloud Native 184Cloud Native Security 185Cloud Workflows 185Modern Tooling 186IAST Interactive Application Security Testing 186Runtime Application Security Protection 187File Integrity Monitoring 187Application Control Tools (Approved Software Lists) 187Security Tools Created for DevOps Pipelines 188Application Inventory Tools 188Least Privilege and Other Policy Automation 189Modern Tactics 189Summary 191Exercises 191Part III Helpful Information on How to Continue to Create Very Good Code 193Chapter 9 Good Habits 195Password Management 196Remove Password Complexity Rules 196Use a Password Manager 197Passphrases 198Don’t Reuse Passwords 198Do Not Implement Password Rotation 199Multi-Factor Authentication 199Incident Response 200Fire Drills 201Continuous Scanning 202Technical Debt 202Inventory 203Other Good Habits 204Policies 204Downloads and Devices 204Lock Your Machine 204Privacy 205Summary 206Exercises 206Chapter 10 Continuous Learning 207What to Learn 208Offensive = Defensive 208Don’t Forget Soft Skills 208Leadership != Management 209Learning Options 209Accountability 212Create Your Plan 213Take Action 214Exercises 214Learning Plan 216Chapter 11 Closing Thoughts 217Lingering Questions 218When Have You Done Enough? 218How Do You Get Management on Board? 220How Do You Get Developers on Board? 221Where Do You Start? 222Where Do You Get Help? 223Conclusion 223Appendix A Resources 225Introduction 225Chapter 1: Security Fundamentals 225Chapter 2: Security Requirements 226Chapter 3: Secure Design 227Chapter 4: Secure Code 228Chapter 5: Common Pitfalls 228Chapter 6: Testing and Deployment 229Chapter 7: An AppSec Program 229Chapter 8: Securing Modern Applications and Systems 230Chapter 9: Good Habits 231Chapter 10: Continuous Learning 231Appendix B Answer Key 233Chapter 1: Security Fundamentals 233Chapter 2: Security Requirements 235Chapter 3: Secure Design 236Chapter 4: Secure Code 238Chapter 5: Common Pitfalls 241Chapter 6: Testing and Deployment 242Chapter 7: An AppSec Program 244Chapter 8: Securing Modern Applications and Systems 245Chapter 9: Good Habits 247Chapter 10: Continuous Learning 248Index 249