Date post: | 05-Dec-2014 |
Category: |
Technology |
Upload: | source-conference |
View: | 1,471 times |
Download: | 0 times |
1© Copyright 2011 EMC Corporation. All rights reserved.
Nazira OmuralievaSusan Kaufman
RSA, The Security Division of EMC
Improving Application Security – Vulnerability
Response in the ISV World
SourceBoston 2011
2© Copyright 2011 EMC Corporation. All rights reserved.
Session Objectives
• Vulnerability response ecosystem and guiding principles for effective vulnerability response
• Important roles & responsibilities in a software vendor organization for vulnerability response
• Typical vulnerability response process• Tips on how you can create an effective
vulnerability response program in your organizations including resources in the public domain
2
3© Copyright 2011 EMC Corporation. All rights reserved.
Vulnerability Response Ecosystem
4© Copyright 2011 EMC Corporation. All rights reserved.
Source: Counterpane
time
risk
Vulnerabilitydiscovered
Vulnerabilityreported
Vendorpatches
vulnerability
Usersinstallpatch
Minimize time between patch availability and patch installation
(Customer)
Minimize time between vulnerability report and patch availability (Vendor & Finder)
Key actors: Finder Vendor
Customer
Key actors: Finder Vendor
Customer
Critical Components of a Successful Vulnerability Management Approach
5© Copyright 2011 EMC Corporation. All rights reserved.
Vulnerability Response: Guiding Principles • Drive towards simultaneously
publishing the vulnerability and the remedy
– Maintain a good relationship with the finder
– Ensure prompt response, updates and resolution
• Protect company’s reputation & shareholders
– Avoid bad press– Enforce legal review
• Align with customer best practices
– Proactive notification of security patch availability
– Continuous evaluation of public vulnerability impact on products
– Efficient response to customers’ scan reports
• Enable customers to evaluate related risk
– Provide enough information to evaluate ease of exploitation and impact
Product SProduct Securityecurity R ResponseesponseProduct SProduct Securityecurity R Responseesponse
6© Copyright 2011 EMC Corporation. All rights reserved.
Vulnerability Response: EMC’s Guiding Principles • Drive towards simultaneously
publishing the vulnerability and the remedy
– Maintain a good relationship with the finder
– Ensure prompt response, updates and resolution
• Protect company’s reputation & shareholders
– Avoid bad press– Enforce legal review
• Align with customers best practices
– Proactive notification of security patch availability
– Continuous evaluation of public vulnerability impact on products
– Efficient response to customers’ scan reports
• Enable customers to evaluate related risk
– Provide enough information to evaluate ease of exploitation and impact
EMC Product SEMC Product Securityecurity R Response Center*esponse Center*EMC Product SEMC Product Securityecurity R Response Center*esponse Center*
*EMC PSRC is a direct function of the EMC Product Security Office
7© Copyright 2011 EMC Corporation. All rights reserved.
EMC PSRC Leverages Industry Resources and Relationships• Supports industry standards:
– Common Vulnerability & Exposure (CVE)• Unique definition of vulnerabilities
maintained by MITRE
– Common Vulnerability Scoring System (CVSS)
• Severity rating defined by FIRST
– Common Weakness Enumeration (CWE)• a list of software weakness types
maintained by MITRE
• Relationships with researchers, reporting organizations & other industry bodies
– Tipping Point’s Zero Day Initiative (ZDI)– Computer Emergency Response Team (CERT)– Fortinet's FortiGuard– Secunia– Member of FIRST
8© Copyright 2011 EMC Corporation. All rights reserved.
Roles & Responsibilities: Vulnerability Response Process
9© Copyright 2011 EMC Corporation. All rights reserved.9
Finder
•Disclose vulnerability information to EMC privately
Product Engineering
•Appoint vulnerability response team members
•Create inventory of embedded components and subscribe to security alerts
•Validate vulnerability reports
•Create timeline for response
Security Response Taskforce
•Includes trained members from Engineering, Legal, Marketing, Public Relations, Investor Relations, Customer Service
•Review and approve the remediation and communication plans
Customers
•Receive security advisories and keep up to date with patches
Roles & Responsibilities for an Effective Vulnerability Response Program (EMC example)
10© Copyright 2011 EMC Corporation. All rights reserved.
Typical Vulnerability Response Process Flow
11© Copyright 2011 EMC Corporation. All rights reserved.11
Important Steps After the Remedy Release
• Root Cause Analysis– Analyze the root cause of product
vulnerabilities to detect and eliminate similar vulnerabilities that may already exist in the product
– Adjust development practices to prevent similar vulnerabilities in the future
• Vulnerability Regression Testing– Add tests to the regression test suite to
prevent reintroduction of the vulnerability
12© Copyright 2011 EMC Corporation. All rights reserved.
Examples of how to publicly share information on your vulnerability
response program
13© Copyright 2011 EMC Corporation. All rights reserved.
www.emc.com/security
13
Make it easy to report a security vulnerability
14© Copyright 2011 EMC Corporation. All rights reserved.
Detailed Process on Reporting a Security Vulnerability
14
•Monitored mailbox•PGP key for communication
15© Copyright 2011 EMC Corporation. All rights reserved.
Example of a Security Advisory
15
•CVE Identifier•Severity Rating•Details•Resolution steps
16© Copyright 2011 EMC Corporation. All rights reserved.
EMC Response Examples
17© Copyright 2011 EMC Corporation. All rights reserved.
No One Size Fits All 1. Coordinated Disclosure – researcher and vendor working in
harmony– EMC Celerra vulnerability publicly disclosed at Black Hat
2. Industry wide impact and cooperation on a vulnerability in a widely used protocol
– SSL TLS protocol vulnerability
3. Researcher/ customer publicly discloses information about a vulnerability not giving time for the vendor to respond
– Vulnerability in EMC product publicly posted in an industry forum
Model your process on industry best practices but expect surprises
18© Copyright 2011 EMC Corporation. All rights reserved.
Questions to consider and tips
19© Copyright 2011 EMC Corporation. All rights reserved.
Tricky Questions That The PSRC Comes Across Regularly
• Responsible disclosure vs. coordinated disclosure vs. full disclosure vs…….
• When to release a security patch vs. remediating the vulnerability in the next maintenance pack?
• When to publicly disclose security vulnerabilities vs. just fixing them in product releases?
• How to coordinate remediation and release of vulnerabilities found in common components developed by your company to take care of internal dependencies?
• How to keep third party/ open source embedded components up to date?
• Many more….
20© Copyright 2011 EMC Corporation. All rights reserved.
Steps to Creating a Vulnerability Response Program• Create a company wide Vulnerability Response Policy and Process
including roles and responsibilities and timelines for response – Do not wait till a vulnerability gets publicly reported
• Get executive acceptance and buy-in• Train internal employees on their roles and responsibilities• Set up a monitored mailbox that researchers can use to send
vulnerability reports and make it available on your website• Create a way to deliver security patches and send security
advisories to customers (public facing website, subscribed email lists)
• Establish disclosure practices (choose your poison – responsible/coordinated…)
• Maintain good relationships with finders – give them credit for finding vulnerabilities
20
Do not reinvent the wheel but customize it to your unique needs
Do not reinvent the wheel but customize it to your unique needs
21© Copyright 2011 EMC Corporation. All rights reserved.
• Resources in the public domain– Forum for Incident Response and Security Teams – Organization for Internet Safety: Security
Vulnerability Reporting and Response Guidelines– National Infrastructure Advisory Council:
Disclosing and Managing Vulnerability Guidelines– Common Vulnerabilities and Exposure (CVE)– Common Vulnerability Scoring System– National Vulnerability Database
21
Speaking of Not Reinventing the Wheel…
22© Copyright 2011 EMC Corporation. All rights reserved.
THANKYOU