Microsoft PowerPoint - HP_Moble_Application_Security_Solution_CN_Ok1.pptx

Size: px

Start display at page:

Download "Microsoft PowerPoint - HP_Moble_Application_Security_Solution_CN_Ok1.pptx"

双位卞
5 years ago
Views:

1 HP Mobile Application Security Solution 惠普移动应用安全解决方案 WILLYLINLIN (HPFORTIFYPRODUCT CONSULTANT) 2012Hewlett-PackardDevelopmentCompany,L.P.

2 大綱移动应用的趋势与威胁移动应用 Three Layers 移动应用安全設計思維惠普移动应用安全解决方案 HP Fortify SCA HP Fortify SSC Server 惠普移动应用安全解决方案視頻 Q & A

3 移动应用的趋势与威胁惠普趋势分析 2015 年 ( 约 6 亿个移动台设备, 将有近一个人均移动台设备 ) 2014 年移动支付将超过的 900 亿美元 2010 年和 2015 年间, 全球移动台数据流量将增加 26 倍 2015 年, 全球移动台数据流量的三分之二将会什么视频 ( 个人移动 TV, Movie )

4 2011GARTNER REPORT 十大移动应用未來趋势 1 地理位置服务 2 社交网络 3 移动搜索 4 移动商务 5 移动支付 6 移动电邮 7 移动视频 8 情境感知(context-aware) t a e) 服务 9 移动即时通讯 (MIM) 10 目标识别 (object recognition) 服务这些移动应用趋势的背后意味着, 需要有更多相关移动应用程序的支撑

5 移動應用的趨勢與威脅 One in Four Adults Now Use Mobile Apps

6 恶意软件成企业级市场移动应用最大隐忧

7 移动应用 THREE LAYERS 1. Server WebServer e Web Services s

8 移动应用 THREE LAYERS 2. Network DataType Sensitivity TransportProtection

9 移动应用 THREE LAYERS 3. Client StorageofCredentials ConfigurationFiles InsecureDevelopment PlatformIssues

10 移动应用 THREE LAYERS 1. Server 2. Network 3. Client WebServer WebServices DataType Sensitivity TransportProtection StorageofCredentials ConfigurationFiles i il InsecureDevelopment PlatformIssues

11 移动应用安全設計 - Security Thinking

12 移动应用安全設計基本检查表 Methodology Section Check / Vulnerability Examples Client(Static anddynamic) Droppedfilesonthefilesystem PooruseofAPIs Certificate issues Credentialsstoredondevice Datastoredondevice Network(Dynamic) Insecuretransmissionofcredentials Impropertransmissionofapplicationdata of application Relianceontheclientforsecurity Checksforsensitiveobfuscateddata Server(StaticandDynamic) SQL Injectionvulnerabilities XSSvulnerabilities AuthenticationandSessionmanagementissuesand issues Allstandardwebassessmentvulnerabilities

13 清晰的思维 ( Clear Thinking ) Know where you are using credentials Know what sensitive data is in play Track these through the device, network, and backend Test those all components Test those all components and their running paths

14 移动应用安全設計 - Security Thinking

移动应用安全开发流程整合 SECURITY JOBS Security Foundations Mobile Applications Plan Requirements

Application Specific Threat Modeling and Analysis Mobile Secure Coding Training Mobile

Secure Coding Standards Wiki Mobile Application Security Process Design Mobile Security

15 移动应用安全开发流程整合 SECURITY JOBS Security Foundations Mobile Applications Plan Requirements Architecture & Design Build Test Production Mobile Security Development Standards Application Specific Threat Modeling and Analysis Mobile Secure Coding Training Mobile Application Security Assessment (Static, Dynamic, Server, Network, Client) Mobile Secure Coding Standards Wiki Mobile Application Security Process Design Mobile Security Policies Threat Modeling CBT for Developers Mobile Risk Dictionary Static Analysis Mobile Firewall

16 惠普移动应用安全解决方案 Securing the client, the server and the network communications. Wireless

17 惠普移动应用安全解决方案静态测试 & 动态测试 HP Fortify SCA Tool HP Fortify Experts

惠普移动应用安全解决方案静态测试 (HPFORTIFYSCA) Coding Integration QA Deploy Maintenance HP Fortify SCA HP Fortify SS HP WI HP Fortify RTA Develop Dynamic Test Penetration

18 惠普移动应用安全解决方案静态测试 (HPFORTIFYSCA) Coding Integration QA Deploy Maintenance HP Fortify SCA HP Fortify SS HP WI HP Fortify RTA Develop Dynamic Test Penetration Test Deploy Static Code Analyzer SecurityScope WbI WebInspect Real Time Analyzer HP Fortify SSC Server 软件安全管理中心 Proactive alert Management Correlation Reporting

19 HP FORTIFY SCA 支持 21 种程式源码安全漏洞检测 1. ASP.Net 11. XML 2. VB.Net 12. C/C++ 3. C#.Net 4. ASP 13. PHP 14. T-SQL (MSSQL DB) 5. VBScript 6. VB6 15. PL/SQL (Oracle DB) 16. Action Script 7. Java 17.Object-C (iphone-2012/5) (Android 2011/6) 8. JSP 9. JavaScript 10. HTML 18. ColdFusion 5.0 选购 19. Python - 选购 20.COBOL - 选购 21. SAP-ABAP ABAP - 选购

20 惠普移动应用安全解决方案支持移動手機平台

21 HP FORTIFY SCA Support Android Java Packages 1. android.app 2. android.content 3. android.database 4. android.database.sqlite 5. android.location 6. android.net 7. android.os 8. android.telephony 9. android.telephony.cdma 10. android.telephony.gsm 11. android.text 12. android.util 13. android.webkit 14. android.widget

22 HP FORTIFY SCA 支持 Android 源码安全漏洞检测类别 (1/2) 1. Access Control: Android Provider 2. Access Control: Database 3. Android Bad Practices: Missing Broadcaster Permission 4. Android Bad Practices: Missing Receiver Permission 5. Android Bad Practices: Sticky Broadcast 6. Cross Site Scripting: Persistent 7. Cross Site Scripting: Poor Validation 8. Cross Site Scripting: Reflected 9. Header Manipulation: Cookies 10. Insecure Storage: Android External Storage 11. Log Forging 12. Password Management 13. Password Management: Empty Password 14. Password Management: Hardcoded Password 15. Password Management: Null Password 16. Password Management: Weak Cryptography

23 HP FORTIFY SCA 支持 Android 源码安全漏洞检测类别 (2/2) 17. Path Manipulation 18. Privacy Violation 19. Privilege Management: Android Location 20. Privilege Management: Android Messaging 21. Privilege Management: Android Telephony 22. Privilege Management: Missing API Permission 23. Privilege Management: Missing Intent Permission 24. Query String Injection: Android Provider 25. Resource Injection 26. SQL Injection 27. System Information Leak

24 HP FORTIFY SCA 支持 iphone 源码安全漏洞检测类别 (1/2) 1. Access Control: Database 2. Code Correctness: Regular Expressions Denial of Service 3. Format String 4. Key Management: Hardcoded Encryption Key 5. Log Forging 6. Memory Leak 7. Often Misused: Encoding 8. Often Misused: File System 9. Often Misused: SMS 10. Often Misused: Weak SSL Certificate 11. Password Management: Empty Password 12. Password Management: Hardcoded Password 13. Password Management: Null Password 14. Path Manipulation

25 HP FORTIFY SCA 支持 iphone 源码安全漏洞检测类别 (2/2) 15. Privacy Violation 16. Privacy Violation: Keyboard Caching 17. Privacy Violation: Screen Caching 18. Resource Injection 19. SQL Injection 20. Unreleased Resource: Streams 21. Unsafe Mobile Code: Insecure Transport 22. Unsafe Reflection 23. Weak Cryptographic Hash 24. Weak Encryption 25. Weak Encryption: Insufficient Key Size

26 HP FORTIFY SCA 支持源码安全漏洞检测类别互聯網

27 HP FORTIFY SCA 检测程序代码安全漏洞的程序转译阶段 Translation Phase[1] 分析阶段 Analysis Phase[2] 稽核阶段 Audit Phase[3]

28 HP FORTIFY SCA (1) 转译阶段 TRANSLATION PHASE NST: Normalized Syntax Tree IDE & AWB SSC Translation Phase

29 HP FORTIFY SCA (2) 分析阶段 ANALYSIS PHASE Analysis Phase IDE & AWB SSC

30 HP FORTIFY SCA (3) 稽核阶段 AUDIT PHASE IDE & AWB SSC Audit Phase FPR: Fortify Project Result

31 HP FORTIFY SCA 检测问题等级的区分方法检测问题等级的归类方式是以两个坐标值做为量化区分依据 (1) Likelihood ( 问题准确度的可能性 ) (2) Impact ( 一旦发生对部门或企业的影响冲击性 ) 高准确度区 : Critical / Medium 凡有嫌疑迹象区 : High/ Low 凡有安全漏洞或质量问题的嫌疑迹象就列出的部分资安人员再人工复核是否有问题

32 凡有嫌疑迹象区 : HIGH/ LOW - AUDIT

33 HP FORTIFY SCA 搭配 ECLIPSE 检测 ANDROID

34 HP FORTIFY SCA 搭配 ECLIPSE 检测 ANDROID

35 HP FORTIFY SCA 搭配 ECLIPSE 检测 ANDROID

36 HP FORTIFY SCA 检测 OBJECT-C ( iphone )

37 惠普移动应用安全解决方案软件安全管理中心 ( SSC SERVER ) Coding Integration QA Deploy Maintenance HP Fortify SCA HP Fortify SS HP WI HP Fortify RTA Develop Dynamic Test Penetration Test Deploy Static Code Analyzer SecurityScope WbI WebInspect Real Time Analyzer HP Fortify SSC Server 软件安全管理中心 Proactive alert Management Correlation Reporting 37

38 主动式减少软件风险的平台 Security Policy Alert System Module EventAlert SecurityIssuesStatusDashboard RemediatingVulnerabilitiesCollaboratively

39 DEFINE SOFTWARE SECURITY VARIABLES ON SSC SERVER

40 SECURITY POLICY ALERT SYSTEM CUSTOM DEFINE 100LOC

41 SECURITY POLICY ALERT SYSTEM ADD ALERT FOR 100LOC

42 SECURITY POLICY ALERT SYSTEM ADD ALERT FOR 100LOC

43 UPLOAD PROJECT SCAN RESULT ( FPR ) BY WEEKLY

44 SEND PROACTIVE ALERT MESSAGE WHEN SCAN RESULT OVER ENTERPRISE SECURITY POLICY

45 REMEDIATING VULNERABILITIES COLLABORATIVELY InteractiveCommunicationHowtoFixIssues

46 EASILY COMPARED DEVELOP TEAMS SECURITY LEVEL Multi-View:SecurityIssueCountsofPer1000Lines TheBestVendororDevelopTeam!

47 惠普移动应用安全解决方案視頻

48 Q & A

Fortify SCA简介

Fortify SCA简介 Fortify SCA 简介 Fortify SCA 是一个静态的白盒的软件源代码安全测试工具它通过内置的五大主要分析引擎 : 数据流语义结构控制流配置流等对应用软件的源代码进行静态的分析, 分析的过程中与它特有的软件安全漏洞规则集进行全面地匹配查找, 从而将源代码中存在的安全漏洞扫描出来, 并给予整理报告扫描的结果中不但包括详细的安全漏洞的信息, 还会有相关的安全知识的说明, 以及修复意见的提供