Tag Info

New answers tagged

3

As others have suggested, you can build in stories about security. And I would certainly encourage you to do that. But if you're talking about an external team coming in and spending several weeks doing an audit ... that, it seems to me, is more about agile than security. I know that agile places a heavy emphasis on shipping frequently -- after all, how ...


5

If your security model is based around the concept of a point-in-time external audit of your entire codebase, then you're doing security wrong. ...And you're probably using the audit wrong too. But we'll get to that. Beyond question, all code needs to be audited for security. In many cases, this is actually a legal requirement: no code ships without an ...


15

The short answer is: integrate security into your software development lifecycle. It should be integrated into every stage: design, implementation, and testing. There are many resources on how to build security into your software development lifecycle. See, e.g., Cigital's SDLC (the 7 touch points)], Microsoft's SDLC, OpenSAMM's SDLC, BSIMM, CERT's Build ...


2

You can do audits for each release just like a waterfall project. Although you noted some problems with doing that, many security companies can work very effectively with agile projects. However, if you release frequently, the cost of this may be prohibitive. Another approach is to move testing in-house. If you buy a scanning tool, you can perform your own ...


17

Microsoft's guidelines for Security Development Life-cycle (SDL) for Agile recommends security practices during design, implementation, and release of the project. Regardless of the development methodology in use, no line of code should make it into production until it has undergone a security review. If financial constraints are preventing this level of ...


2

Add misuse cases. If there is a feature that the system must exhibit, you use a use case. If there is a feature that the system must not exhibit, use a misuse case. "As a competitor, I want to query the database back end for company sensitive data; this must not happen." "As a hacktivist, I want to use the DMZ to reflect attacks at the government; this ...


0

Most probably false positive (depends of its content). Got the same warning on two different clean machines (Ubuntu 12.04 & Debian 7).


1

To add to what Mark said, it's also worth noting that execlp, execvp, and execvpe all invoke /bin/sh, as that's how they perform their path lookups. So, even without the 2nd-generational effects Mark mentions, just using the exec* family of functions does not guarantee bash will not be invoked. The correct fix is to make sure you have installed a patched ...


5

Wrong on both counts. In order to exploit the "shellshock" vulnerability, an attacker needs to control at least one environment variable (easy to do through CGI, SSH, or DHCP), and bash needs to be invoked at some point with the modified environment: directly as the result of an exec(), indirectly through system() or equivalent, highly indirectly through ...



Top 50 recent answers are included