Interview with Jeremiah Grossman on LearnSecurityOnline.com

Originally published on LearnSecurityOnline.com

http://learnsecurityonline.com/index.php?option=com_content&task=view&id=297&Itemid=0

# LSO #
How about some background about yourself, who you are? What you do? Who you work for? Location?

# JG #
I started out as a graphic designer; turned to a Web developer then UNIX admin, then Web security guy. Today, I’m founder and CTO of WhiteHat Security, a leading provider of website vulnerability management services headquartered in Santa Clara, Ca.

I was raised in Maui, Hawaii and grew up in Silicon Valley. I’ve been commonly referred to as one of the top Web security experts, recognized as one of InfoWorld 2007 Top 25 CTOs, and all that sort of fluffy stuff. Personally, I prefer engineer and entrepreneur. My daily job consists of delivering presentations, R&D for future products and services, speaking with a lot of companies and learning about their Web security challenges, and helping out with the Web Application Security Consortium (WASC). I write a lot too. Blog, books, articles, interviews. :-)

# LSO #
How did you get into the security business (your specific field)?

# JG #
While working at Yahoo pen-testing websites, I found I had far too much work and not enough time to do it. If every one of the 600 websites took 40 hours to assess for vulnerabilities, it would take me roughly 11.5 years to finish. Unless we hired a team of 10, no solution available was going to meet our needs. This was not a problem unique to Yahoo: Many companies across the industry were experiencing the same dilemma. They know they have vulnerabilities needing to be fixed and no idea where they’re located. I saw a market opportunity, set out to build a better solution, and jumped in with both feet. WhiteHat’s executive staff envisioned a highly scalable vulnerability assessment Software-as-a-Service solution incorporating proprietary, automated scanning with expert analysis. Six years later here we are. Now, how I got my Job at Yahoo is a whole other story. ;)

http://jeremiahgrossman.blogspot.com/2007/04/how-i-got-my-start.html

# LSO #
You are considered to be on of the forerunners of Web Security. I remember seeing your talks at Blackhat in 2002 when you released the WhiteHat Arsenal and being totally blown away at what you could do with a web browser and the browser has only become more and more powerful over the years. In your opinion, Are we past the worst of web vulnerabilities, there now, or is the worst yet to come?

# JG #
Wow, has it been that long? On the positive side, unless someone finds a truly new attack technique, the number of vulnerabilities in the average website will likely slowly decline in the years to come. The downside is the attackers will have a lot of green field to exploit and they haven’t even really begun to hack. Unfortunately the worst is yet to come and we’ve already seen some fairly bad stuff happen to date.

# LSO #
Web 2.0 and Ajax. Is it the end of the world as we know it? or just another technology in the mix?

# JG #
Y2K didn’t end the world, so why should Web 2.0 and Ajax? Web 2.0 is the way we’re using the Web, and Ajax is a set of technologies developers used to build it. Others don’t share my view, but I don’t think either Web 2.0 or Ajax makes a website more susceptible to attack. They all have the same problems in the same ways, just a lot faster and easier to make mistakes. What has changed though is our capacity to find vulnerabilities in Ajax-laced websites. You see, the bad guys really don’t need or use scanners to hack websites because they only need to find one issue; and, it’s faster to do it by hand. The good guys on the other hand have to find all issues and protect against them all - all the time. That means the good guys need scanners to keep up. The problem with scanners though is they’ve shown to be severely lacking in Ajax support despite the marketing claims. Not to mention the volume of false positives they generate.

# LSO #
How do you think technical aspects of web hacking have changed over time and how does one keep up with the current advances?

# JG #
The basics have been the same for quite a while, but the advanced stuff is getting fairly large, sophisticated, and constantly evolving. The nuances of Web security takes a while to learn if you start from zero. The only way I’m personally able to keep up is by reading a tremendous amount and communicating as often as I can with others. So, I read white papers, mailing lists, blogs, news stories, etc. I also attend conferences, contribute to community projects, and utilize email quite heavily.

# LSO #
Say I want to get into web security, it HUGE, where do i start?

# JG #
At the beginning! No seriously. If I had to start again, the first thing I’d do is pick up a programming language like Java or C# and develop my own super simple Web applications to get the basic concepts. Then, I’d seek to understand how the Web is architecturally put together from the ground up. That means learning everything I could about TCP/IP, HTTP, DNS, SSL, and general encryption. I’d make my own Web servers and Web browsers, create little tools to create packets in the various protocol layers, and basically play around with all the technology till I felt really comfortable. Then, I’d work my way back up the stack learning HTML, JavaScript, and the DOM, all the while making little applications to keep my interest. But, what you’re probably asking at this point is “where is the security,” right?

From my point of view, security is a state of mind more than anything else. I’ve always felt that if I understood all aspects of the technology to an intimate degree, then “security” portions became super easy. If I knew how everything worked, was meant to work, then I could proceed to test if I could make it work in ways other than intended.

Some early books on my bookshelf:

The Protocols (TCP/IP Illustrated, Volume 1)
http://www.amazon.com/Protocols-TCP-IP-Illustrated/dp/0201633469/ref=
pd_bbs_sr_1/104-1693213-7738351?ie=UTF8&s=books&qid=1193682211&sr=8-1

TCP/IP Network Administration (3rd Edition; O'Reilly Networking)
http://www.amazon.com/TCP-Network-Administration-OReilly-Networking/dp/0596002971
/ref=pd_bbs_sr_1/104-1693213-7738351?ie=UTF8&s=books&qid=1193682225&sr=8-1

UNIX System Administration Handbook (3rd Edition)
http://www.amazon.com/UNIX-System-Administration-Handbook-3rd/dp/0130206016/ref=
pd_bbs_sr_1/104-1693213-7738351?ie=UTF8&s=books&qid=1193682255&sr=8-1

Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition
http://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Source/dp/0471117099/ref=
pd_bbs_sr_1/104-1693213-7738351?ie=UTF8&s=books&qid=1193682281&sr=8-1

DNS and BIND
http://www.amazon.com/DNS-BIND-5th-Cricket-Liu/dp/0596100574/ref=pd_bbs_2/104-1693213-7738351?
ie=UTF8&s=books&qid=1193682300&sr=8-2

Mastering Regular Expressions
http://www.amazon.com/Mastering-Regular-Expressions-Jeffrey-Friedl/dp/0596528124/ref=pd_bbs_sr_
1/104-1693213-7738351?ie=UTF8&s=books&qid=1193682314&sr=8-1

JavaScript: The Definitive Guide
http://www.amazon.com/JavaScript-Definitive-Guide-David-Flanagan/dp/0596101996/ref=
pd_bbs_sr_1/104-1693213-7738351?ie=UTF8&s=books&qid=1193682325&sr=8-1

# LSO #
You mention in your interview with Colleen Frye about the disclosure dilemma. What are your thoughts on disclosure? I think its a double edged sword because, let's face it, 0-days and worms keep system admin, network managers, pen-testers, and consultants in business but it seems alot of vendors are pushing the no-disclosure (or only to us) route.

# JG #
For the most part, I’m in the non-disclosure camp. Meaning: I only privately disclose vulnerabilities when I have a good working relationship with the other party. And, if I release something publicly, it’s only because I feel the attack technique is new and has further implications that would benefit by public research. Be mindful though that I would not recommend people blindly follow my philosophy. Instead, they should find a system that works within their personal code of ethics, morals, professionalism, and level of risk acceptance. Because let’s face it, the industry is not what it used to be 10 to 15 years ago and already has pushed much of the research underground.

# LSO #
do you think that's good for the industry? is it good to push all that research underground?

# JG #
I take a pragmatic approach to security and I feel that business owners and software vendors have a responsibility for the data they protect and the products they sell. We all must take into consideration the environment around us, and understand that it’s hostile. We should have no expectation that anyone is going to share any vulnerability information ahead of time. We can hope they will before going public. But, do not depend on it and frankly it’s hopeless to demand it.

# LSO #
on a similar note, what are your thoughts on the German anti-hacking laws and what do you think would happen to security industry if the US went that route?

# JG #
I don’t think we have to wait for that to happen; it’s probably already here and just haven’t realized. When considering our current political climate and recent legal changes in the U.S., it seems to me that any one of us could easily be accused of committing an illegal act and be held to account. All that really has to happen is for a few more high profile prosecutions to impact security researchers to have a nasty and lasting side effect. What I do think is coming is export controls placed on vulnerability information (0-days), just like they do on encryption - because of their potential impact on national security. It’s a brave new world.

# LSO #
Do you think JavaScript is the new shellcode? If so why?

# JG #
Yes, definitely, because Cross-Site Scripting in the new buffer overflow. ;)

# LSO #
Tell us what you think of the future of network enumeration via JavaScript. What are the attacks that we should look for in the coming years from JavaScript?

# JG #
It’s difficult predicting the future in security, but if I had to guess, I could see phishers using XSS a lot more. The malware guys will continue defacing highly trafficked and trusted websites to exploit their visitors’ Web browsers. And the high-end espionage attack types will go for the Intranet hacking stuff using JavaScript malware. It’s the latter that’ll be hard to track, measure, and defend.

# LSO #
Can you compare/rate the criticality of XSS, XSRF, SQLI?

# JG #
Unfortunately no. It’s hard to generalize their severity, criticality, threat, etc. For the most part, website vulnerabilities have to be rated individually, while taking into consideration the value of the website, the data it contains, and the sophistication of the attack required.

# LSO #
Have you or anyone you are aware of made any progress on your non-JavaScript port scanning idea that you posted here at:
(http://jeremiahgrossman.blogspot.com/2006/11/browser-port-scanning-without.html)

# JG #
Ilia Alshanetsky certainly took the next step by improving the speed of my original designs, but I think I’ve personally taken that concept about as far as I need to. The Intranet zone has been breached and the rest just seems to be adding insult to injury. No need to make exploitation easy for the bad guys. It’s the browser vendors turn to remediate the problem architecturally.

# LSO #
How real of an attack vector is DNS-Rebinding? How prevalent do you think it is in the wild?

# JG #
DNS-Rebinding (Anti-DNS Pinning) spent several years in the realm of the theoretical obscurity, but that changed recently when more researchers demonstrated creative Proof of Concepts. It’s a very powerful attack vector with a lot of potential damage. Worse still is that I think the browser vendors are at a loss for how to deal with the problem. It’s also difficult to tell if the bad guys are using this in the wild maliciously. Unfortunately, we’ll know when the side effects get really bad and we’ll find the attack being used in a piece of malware.

# LSO #
Are people really vulnerability scanning internal networks with Nessus/Metasploit through a socks proxy?

# JG #
Not that I’m aware of.

# LSO #
Can you tell us a little bit about WhiteHat Sentinel? Have appliances taking the human out of the network security and web security loop (minus the people writing the checks for the appliances)?

# JG #
Nah, human expertise will be a vital part of any comprehensive Web application vulnerability assessment process, forever. Unless of course someone solves the halting problem or websites magically become “secure enough”, but I doubt it.

WhiteHat Sentinel is a website vulnerability assessment and management service that is customer controlled and expert managed. Without the marketing-fu, that means our customers websites receive a complete vulnerability assessment whenever they’d like or as often as their website changes, with the security of knowing they have the expertise of WhiteHat engineers as support. Presently, we’re performing hundreds of vulnerability assessments each week, many orders of magnitude above anyone else, with the significant added benefit of the false positives weeded out. To deliver this type of service is no small task and it’s really our SaaS technology that enables WhiteHat to have this incredibly efficient process. Our remotely hosted vulnerability scanning infrastructure does all the heavy lifting and also allows us to configure custom tests for each website to identify those pesky business logic flaws.

# LSO #
What can i do to keep mom and dad safe on the net? Or anyone who gives you the "huh" when you go into phishing, hacking, XSS, CRSF, malware, etc?

# JG #
The most effective way to keep them safe is to switch them to a Mac. Sorry Windows people, but your operating system is target #1. And, for the same reason swap out Internet Explorer for Firefox, Mozilla, or Opera. These two acts alone will significantly reduce the likelihood of their machine getting hacked. Then, disable Active X, java, and unless they really complain about it, flash to. And, for good measure, install SafeHistory and Adblock Plus. To keep them from getting phished, teach them to be skeptical of any email from someone they don’t know, especially the ones with links and/or attachments. Instead of clicking on links in their email, set up a list of bookmarks to select for their bank and other important business oriented websites.

# LSO #
How important do you feel that programming is for this field, specifically how do you feel about Web Language programming? If yes, what language(s) do people need to know well?

# JG #
The best Web security experts in my experience have Web development background. Most any Web language works just fine, since we’re all niche practitioners anyway. HTML/JavaScript are a must no matter what. But if you had to start now. .Net and Java and their development frameworks are what you need to know to an intimate degree.

# LSO #
What tools need to be in every web application pen-tester's toolkit?

# JG #
Three different Web browsers (at least), a proxy or two, and some text encoders and decoders.

# LSO #
What are the basics that you think every security person should know?

# JG #
For me, the key things that I’ve come to appreciate are that technology skills can be learned over time, but for many it’s difficult to grasp certain fundamental information security concepts. That security is a state of mind, that it is a process and not a product, and that it is our responsibility to mitigate risk. Anyone can spend a bit of time to learn how to properly configure a firewall, but do they know why they are doing it? What are the attacks they hope to thwart or don’t address? What business challenges crop up as a result of firewall implementation?

The point is we have to question our assumptions, our conventional wisdom, and constantly check to ensure they still hold true. Often they do not.

# LSO #
Any suggestions on breaking into the security field? Or someone considering security for a career?

# JG #
Get involved in anyway and at any level you can. This could be an entry-level job, contributing to a community effort, or participating in a mailing list discussion. Read everything (white papers, articles, blogs, etc). Email the authors and ask tough questions. Attend conferences and local chapter meetings.

The whole idea is to meet people, build relationships, and learn everything you can by helping out. This also demonstrates your passion and value to those you interact with. Nothing says more to an employer (or a recruiter) than personal initiative and self-motivation.

# LSO #
Jeremiah, thanks tons for all your work in the industry and for agreeing to the interview.

Jeremiah Grossman
Blog: http://jeremiahgrossman.blogspot.com/
Book: XSS Attacks: Cross Site Scripting Attacks and Defense

Interview with Andres Riancho, creator of w3af

This interview was originally published over on LearnSecurityOnline.com.

==============================
Interview with Andres Riancho
==============================


In my opinion penetration testing frameworks and toolkits are fast becoming a necessity in today's audit process. Tools like Core Impact, Saint, BidiBlah and others are staking their claim in this service/client-side exploitation side of this market market and toolslike Web Inspect, Accunetix, Appscan, have staked their claim in the web application security side of the market.

I'm an open-source security tool user myself so my tools of choice for these two areas have been Metasploit (Service/Client-side), and Wapiti (Web App), but ladies and gentlemen there is a new kid on the block. The tool is called w3af (Web Application Attack and Audit Framework). The tool developer Andres Riancho has graciously agreed to an interview with LSO.

I have to say that Andres has been such a great help to me in not only developing a web application testing methodology/framework for my job, but also teaching me the basics of web app security auditing. He has so many skills from his years of experience so he was able give me little tips that really helped me connect the dots so to speak. So Andres, thanks for w3af - I really like the tool, and thanks for all of the help. I really appreciate it.

-j0e

# LSO #
How about some background about yourself, who you are? What you do? Who you work for? Location?

# AR #
First of all I'm a simple guy, that enjoys spending time with his friends, girlfriend, family and dog. On the other hand, I'm a security consultant that works at Cybsec (www.cybsec.com). I'm located in Argentina, land of "dulce de leche" and great meat.

# LSO #
How did you get into the security business (your specific field)?

# AR #
Like most of us, I'm a really curious person , so I started with security when I was 14. After some time, I got a job as an IPS administrator at a local ISP, when I got bored of it (pretty fast actually) I started working for Cybsec, mostly performing web application penetration tests. In other words, I started with security as a hobby, and now I make a living out of it.

# LSO #
How do you think technical aspects of web hacking have changed over time and how does one keep up with the current advances?

# AR #
Technical aspects of web hacking haven't changed much, the vulnerabilities are almost the same, but the "transport" method for the vulnerability is what keeps changing, before we had URL encoded strings, now it's XML and JSON, tomorrow it will be another type of encoding, but there always will be SQL injection, information leakage, etc.

# LSO #
Say I want to get into web security, it HUGE, where do i start?

# AR #
You should start by knowing how HTTP works, the basics of web application development and you should also read a lot about Cross Site Scripting, SQL injection, remote file inclusion and other common vulnerabilities. A good place to start is the OWASP site, and particularly the OWASP TOP 10.


# LSO #
Do you think Javascript is the new shellcode? If so why?

# AR #
I think that new things are still to be discovered about Javascript, but I don't really think it's going to be the "next generation shellcode". Browser security and cross site scripting are an important part of web security, but it's just that, a part of it. We should not focus all the attention on Javascript, there is still a lot of work to be done securing the web applications vulnerabilities that lead to the server being compromised.

# LSO #
Tell us what you think of the future of network enumeration via javascript. What are the attacks that we should look for in the coming years from javascript?

# AR #
Right now we have seen just the beginning of advanced javascript attacks, in the future someone will code a good framework for doing all kinds of attacks over cross site scripting. BeEF (http://bindshell.net/tools/beef/) is one of the cross site scripting exploitation frameworks I have been checking out, and I think it really has some potential.

# LSO #
How viable of a web application audit tool is Firefox? http://www.securityfocus.com/infocus/1879/1 shows Firefox being used for crawling websites, discovering hidden calls, and logic discovery - what are the top 5 tools that you use the most in web application/web services auditing and why?

# AR #
Browsers are the most powerful/useful tool to perform a web app audit, in the particular case of Firefox, this power is multiplied by100 if you use security aware extensions. The TOP5 tools I use while performing a web app audit are:

1- paros or burp ( two of the best local proxies, this tools are the most important in the whole process)
2- firefox ( as explained before )
3- firefox extensions like the web developer toolbar ( very usefull to test sites that have javascript )
4- w3af ( just because I coded it ;) )
5- nikto ( it's a classic, but it finds nice things once in a while )

# LSO #
Ajax is thought by some people to be what is going to lead us into "Web 2.0", and a great deal many security consultants see it as the ultimate attacker's playground. How do you see Ajax?

# AR #
There are only a few security consultants that do interesting work around web2.0, all the others out there are just reinventing the wheel every day; don't get me wrong, Ajax has introduced and will introduce a lot of new attack vectors, but the risk for users and companies IMHO will be low.

# LSO #
Do you plan to integrate ajax discovery/fingerprinting into w3af? Tools like fingerajax.rb/scanajax.rb are good for really simple stuff if you see a .aspx in the url, but there really isn't much of anything else on the market for command-line Linux tools for dealing with ajax.

# AR #
Well, actually I'm going to create a w3af plugin that wraps a browser or some other library/project that knows how to handle javascript. My idea is to wrap a browser, configure the browser to use a local proxy that will be run by w3af and then start interacting with the web application doing "clicks" on every HTML tag and recording the requests that are sent to the browser. Using this approach, w3af will be able to analyze most javascript-enabled sites!

I have been playing with pykhtml and discarded it because of some problems and the lack of portability to windows; and now I'm trying to achieve this task using zc.testbrowser.real, but I'm still working on this section of the project, so if anyone wants to help, just let me know.


# LSO #
Can you compare/rate the criticality of XSS, XSRF, SQLI?

# AR #
XSS: 3/10
XSRF: 2/10
SQLI: 9/10

As you may see, I'm not really into the "XSS is going to destroy the planet" thing, as I said before, it's something important but it's not so critical and we shouldn't loose our perspective and objectivity.


# LSO #
How important do you feel that programming is for this field, specifically how do you feel about Web Language programming? If yes, what language(s) do people need to know well?

# AR #
I think that you can't be a really good security expert if you don't know how to code in at least one low level programming language like C and one high level programming language, like Python. Source code is the base of all what happens in your computer, and if you don't know how to create it, you won't ever understand what happens when you click on a window button.

Web Language programming is something I don't personally enjoy, but it seems to be the future of programming. GWT is getting better and its user base is growing, so it seems that the future is going that way...

# LSO #
What tools need to be in every web application pen-tester's toolkit?

# AR #
w3af is in beta stage right now, but in a year or so it will be a must have tool for every web application pen-tester. Some other awesome tools I use are paros proxy, sqlmap and sqlninja.

# LSO #
What do you think are the 3 biggest changes in the security field in the last 5 years?

# AR #
The shift from attacking the servers, to attacking the clients has been an interesting change that started when most penetration testers found out that the servers weren't the weak link in the chain and that users would download and execute almost everything.

Big companies acquiring security companies was also a change that I was surprised with. Just to mention two of the most important business changes, IBM bought ISS and HP bought SPI Dynamics. I'm still expecting to see the long term repercussions in the world wide market!

One of the new things that have appeared in this last years are the vulnerability markets, like the zero day initiative and wabisabilabi. This business type is really interesting and gives freelance researchers good options to make money without the risks of selling their vulnerabilities and exploits to the Russian mafia.

# LSO #
Where do you see the security field going in the next 1-3 years?

# AR #
I think that many applications will be built over the HTTP protocol, and more than ever they will use Ajax and all the javascript tricks. So, more than ever a stable, complete and open source framework that can audit web applications will be needed.

# LSO #
What are the basics that you think every security person should know?

# AR #
The most important things to know in order to be a security professional are:
- Programming
- TCP/IP
- Web Application security
- Buffer overflows, format strings

# LSO #
What are the specifics that a person in your security field should know?

# AR #
Well, I mostly deal with web application penetration tests, so a person in my security field should really understand how HTTP works, it's internals, encodings, etc. It is also really important for a web application penetration tester to know how the information flows through a web application, type casting, data conversion, database queries, etc; so programming is one of the most important things. Finally but not least important, a good web application penetration tester should keep himself informed about new types of web vulnerabilities, this can only be achieved by reading mailing lists, reading the latest whitepapers and attending to one or two good security conferences a year.


# LSO #
Any suggestions on breaking into the security field? Or someone considering security for a career?

# AR #
There are two really important things to know when you are starting in the information security field:
- knowledge is power
- ask smart questions(http://catb.org/~esr/faqs/smart-questions.html),
no one will answer questions on the mailing lists if you don't ask them the right way

And of course, be ready to buy some glasses, work long hours and become really paranoid about sending non encrypted data over the wire.

# LSO #
Can you tell us about X, Y, Z (latest book, future book, current/future projects)?

# AR #
Right now, and at least for one more year, I'm going to be working on my main project, w3af. The framework has evolved a lot in the last year, and my personal objective is to create a stable and usable open source alternative to the commercial web application vulnerability scanners, that also includes among it's features the option to exploit the vulnerabilities that are found. Some new features I'm working at are Javascript and Flash support, this two features are going to be added to the almost impressive list of features, that include:

- Exploitation plugins
- Advanced post-exploitation payloads
- Integration with metasploit
- Detection of almost all web application vulnerabilities
- Information gathering using internet search engines
- Dynamic communication between plugins
- Easy to use console interface

w3af - Web Application Attack and Audit Framework

LearnSecurityOnline Interview with Andres Andreu

Originally published in the LearnSecurityOnline.com June 07 Newsletter

What we try to do with the Interviews with Security Professionals is ask people that are considered "Professionals" in the information/computer security field questions about their relevant field of research and advice on how for someone starting out to get to their level. Hopefully good information for people starting out.

============================
Interview with Andres Andreu
============================

[LSO]
How did you get into the security business, specifically penetration testing and penetration testing web applications?


[Andres]
I am at the core a software engineer so coding and architecting complex solutions is still an area of focus. I started getting into the security side of web software because I got sick of the weak app security that the network security world was providing. The Information Security industry needed much more than mere network security and those I was encountering that were in charge of security just couldn't see past the firewall/IDS/IPS paradigm. So I took it upon myself to do what I could so that the solutions I built wouldn't suffer from an overt lack of security.

Pen testing I kind of fell into by accident, it was something I informally did for years. AAMOF when I first heard the term I didnt know what it was but I had been performing those functions for some years. Earlier in my career I just took pleasure in breaking the coding work of others as well as my own. Pen testing is really a formalization of this otherwise devious activity. The web app realm was a natural progression because that kind of development work just started coming my way.


[LSO]
How about some background about yourself, who you are? What you do? Who you work for? Location?


[Andres]
I am a self employed native New Yorker but travel all over with work. I build custom software solutions as well as pen test anything I can legally get my hands on. Other then that I am a very dedicated husband,father of 4, artist (painting/illustration), and martial artist.


[LSO]
What do you think are the 3 biggest changes in the security field lately?


[Andres]
One change that really was inevitable, and is so evident these days, is a hard shift from the edge (network level security) to the core. The old guard of network based security is coming to terms with the fact that the security world is not boolean in nature. In the realm of core web app security there is also an interesting change in that Web 2.0 has brought about a resurgence of client side web computing. The web world of server side computing isn't going away anytime soon so the security field now has to contend with an interesting combination of the 2 tiers working simultaneously.

The field of information security is also getting a harsh dose of change with the distributed nature of things that are coming out these days. Mobile devices and their apps are a perfect example of this; and this concept of high mobility computing adds serious challenges. Moreover, users of these devices are becoming more and more savvy in terms of functionality. But as time has shown us all the more functionality at hand the more security challenges at hand. So expertise in this realm of security is an inevitable change.

Finally the information security field has been forced to get into the realm of compliance. It makes sense to an extent since security has an enforcement role. But time will tell if these moves are indeed wise because I travel the world and see the issue of policy creation and enforcement as a big area of challenge. I also see the frustration of otherwise technical security folk being forced into compliance related roles.


[LSO]
Where do you see the security field going in the next 1-3 years?

[Andres]
To hell! LOL, just joking. But all jokes aside the field has to change, adapt and overcome. It is still for all intents and purposes a reactive industry and that has to change. Many of the old school security people have not been able to keep up with the technological aspects of modern day info sec. They are network people at the core and just dont get the app space. So there will be a distinct shift in the industry where some people will enter the realm of security policy and wont deal with technology hands on. Those that do deal with hands on sec work will have a much richer skill set then what exists nowadays. They will truly be versed in the multiple layers of security, from the edge all the way down to code. This convergence is already starting from the inner world of developers, more and more of them are getting involved with security. And viewing info sec from a coders point of view is radically different then an edge perspective.


[LSO]
What are the basics that you think every security person should know?

[Andres]
The most basic set of knowledge is that of multiple tiers, or layers. No one layer is a silver bullet. I think your standard FW and IDS/IPS knowledge is important along with Proxy and Reverse Proxy technologies. The use of Proxy tiers is critical in todays web centric environments.

I find that protocol knowledge is lacking in the industry as is the handling of data. In reference to the latter, I mean an understanding of the effects that input data can have on a target and how to properly validate or dismiss such input. So those areas should be treated as basic along with the multi layer approach.


[LSO]
What are the specifics that a person in your security field should know?

[Andres]
To be effective in the field of web app security one has to understand how web apps work. So being familiar with the inner workings of web environments is important. Moreover, deeply understanding the OWASP Top 10 as areas of risk and remediation is a must.


[LSO]
Any suggestions on breaking into the security field?

[Andres]
Yeah, don't limit yourself and train yourself to be flexible. Adapting to constant environmental change is a way of life for modern day information technology professionals. The concept of wearing "many hats" is very real these days and maintaining pace with the chaos of modern day technology is key.

Don't be afraid of code, it is the at the heart of the problems most information security professionals have to solve. Familiarity with code will always be an advantage to anyone in the information security field. Also don't be afraid of RFC's, protocol knowledge is very important. You have to deeply understand what it is you will one day protect if you are to be truly effective.

Finally practice, practice and practice some more. An open mind coupled with practice on a myriad of platforms makes for a solid foundation. Virtual environments lend themselves well for all the practice and exposure necessary to be effective as a security professional these days. So build yourself a good virtual lab and hack/protect away.


[LSO]
Can you tell us about interesting things you are working on right now, or just recently finished (latest book, future book, current/future projects)?

[Andres]
I just wrote an article on XML Fuzzing for hackin9 magazine.

I am doing lots of Federated ID work these days. This represents a serious shift in security to that of heavily distributed data sets so it is quite challenging and exciting at the same time. So if for instance properly protecting one app/DB combo is challenging, now imagine protecting an object (of data) that doesn't actually fully exist in any one place. It exists partially in many places and some of those data sources you cant directly touch. This is very fun stuff that will be the norm in the future of the Internet.


[LSO]
Any cool new projects that you think we should let our members know about?

[Andres]
I have recently put some serious work into WSFuzzer, so check that out if you have any SOAP targets. I am also planning on kicking off a new project to deeply pen test REST services since I see them as an integral part of the future of web development.

Other then that I can't really expose my current work due to client confidentiality issues.

thx,

Andres Andreu, CISSP-ISSAP, GSEC
Author of "Professional Pen Testing for Web Applications" ISBN
0471789666