6

I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The application is widely used (market-leader) within a sector in my country and the information stored within the application is very sensitive.

The types of issues I've already identified are:

  1. Using a default database username and password (full admin access). This login is kept in plain text within the application folder.
  2. Storing user passwords in plain text within the database
  3. No complex password requirements
  4. Users having access to tools within the application that can run SQL queries (with full privileges; despite their own application level privileges limitations)
  5. A HTTP server service running on all client machines that responds to API requests. No user/password required.
  6. Default file share with all application files including the file containing the database/username/password
  7. Auditing information of user actions (that can be easily altered/deleted/masqueraded - see any of the above!) that have been used as evidence within million-dollar fraud/legal/HR cases

I haven't even looked at things like buffer overflows, SQL injection etc; but a colleague has offered to help me with this.

As I'm a bit new to this; I'm thinking that this would be a technical review (similar a published journal article) un-requested by the vendor? Larger users of this software often secure it as best as they can; I suppose I could write a "hardening" guide instead?

Can anyone provide me advice:

  • Any general advice based on the above?
  • Should I write a security review or hardening guide?
  • Are there some good examples of similar types of reviews? (I can find so many web-application reviews; but not so many application ones - however a couple of the SCADA ones were useful

Thanks!

Improve this question
3
  • What version(s) of Windows? Is the network isolated or is it publically accessible? Do you have administrative control over all of the client machines? What is your threat environment? i.e. Who would want the assets you are protecting?
    – this.josh
    Aug 28, 2011 at 5:54
  • Windows XP/7/2003/2008. Networks are usually isolated but I know some other sites have say guest wifi and the way the application works is that unknown to them anyone on the network (fixed/Wifi) could at least gain access to the database with ease. I have administrative control at my site, but other users would not always have this. Threat is theft of personal client information; unauthorized access of client files, breach of privacy; alteration of sensitive records etc.
    – Jonathan
    Aug 28, 2011 at 22:17
  • I've come across SCADA Attack Vectors which looks similar to what I had in mind for writing.
    – Jonathan
    Aug 28, 2011 at 22:20

2 Answers 2

Reset to default
3

Any general advice based on the above?

Talk to the people who may be hurt by a potential attack on the system: either directly or indirectly. Understand what their concerns are and let them know that you will do your best to protect their records and their privacy. As a security representative your job is to protect assets (personal data, etc) against threats. Your best security-focused solution will emerge once after you understand what you are protecting.

Look for vulnerabilities, but don't get too detailed. There will always be a very technical complicated vulnerabilities, but in a lot of incidents it is the relativly simple vulnerabilities that are exploited. You will get little criticism for missing a vulnerability that requires a highly skilled sophisticated attacker but you will get a lot for missing the simple vulnerabilities.

Think about operational security. In a mostly closed system the insider threat is a significant concern. Job rotation is a great method where practical. Look for ways to segment or break up the data so that if there is a breach or leak that the damage is limited.

Should I write a security review or hardening guide?

I think you should focus on the security review. There are security resources for the various versions of windows, and I hope there are competitant administrators running those windows systems.

Are there some good examples of similar types of reviews?

Improve this answer
1

I am speaking from the context of colleague experience and as such it should be treated as third party information, typically organizations that hire you to do a pen test expect some form of document enumerating the issues that were found and remediations of the affected systems. Something you said raised concern: 

I'm thinking that this would be a technical review (similar a published journal article) un-requested by the vendor

If I was this vendor I would promptly sue and ensure that your company lost any and all licenses that I could possible make them lose. It is at the discretion of the client and the contract that was signed. I would look into the hardening guides provided by DISA (STIGS offer a handy way to present a hardening guide). The only thing I can say with great confidence is to review the contract that was provided to your company and go from there.

Improve this answer
3
  • You are assuming that the asker is 1) working for a company [might work for an academic institution] 2) has a contract for the work [might instead have a research grant or work could be internal] 3) is in the USA or trusts US DoD documents.
    – this.josh
    Aug 28, 2011 at 5:51
  • I think 1 is irrelevant, unless academics get away with not needing NDAs. 2 and 3 I will give to you :)
    – Woot4Moo
    Aug 28, 2011 at 13:25
  • 1) working for a non-profit; I'll review our contract 2) internal 3) non-US but I'll review those documents
    – Jonathan
    Aug 28, 2011 at 22:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .