Research

The Universal Cloud Threat Model is a collaboration between PrimeHarbor Technologies and Securosis. It is a cloud-centric threat model to help organizations focus security efforts on the most-common attacks most organizations will experience. The UCTM is designed as an adjunct to other threat models. From the introduction:

Security Operations, SecOps for short, has been one of the more difficult security domains to modernize for cloud. It requires a combination of new subject matter expertise, new technologies, process updates, and even a slightly different mindset. Cloud impacts SecOps in ways both obvious and subtle, and because most organizations still have datacenters and offices, teams need to add new skills and update operations while still supporting everything already on their plates. It’s a daunting…

Data security remains elusive. You can think of it as something of a holy grail. We’ve been espousing the idea of data-centric security for years, focusing on protecting the data, so you can worry less about securing devices, networks, and associated infrastructure. As with most big ideas, it seemed like a good idea at the time.

The way applications are built, deployed, and maintained in most organizations is being disrupted. Macro changes include the ongoing cloud migration disrupting the tech stack, new application design patterns bringing microservices to the forefront, and DevOps changing dev/release practices. As we’ve been slowly navigating this sea change, the common thread across these changes is increasing reliance on Application Programming Interfaces (APIs).

After many decades as security professionals, it’s depressing to keep seeing the same issues and mistakes. It feels like we’re stuck in hacker Groundhog Day. Get up, clean up the mistakes made by users or administrators, handle a new attack, and fill out compliance reports, only to have to do it all over again the next day.

Our discussion of the PCI Council’s Tokenization Information Supplement.

Tokenization Guidance (PDF)

Attachments

• TokenGuidanceImg.png [354KB]
• TokenizationGuidanceAnalysis_Jan_2012.pdf [1.1MB]

From the AppSec US 2010 OWASP conference.

Security+AgileFAIL_OWASP.ppt_.pdf (PDF)

This is a reference page for database events commonly captured in the Audit Logs for major relational database platforms.

SQL Server (pdf) Sybase (pdf) DB2 (pdf) Oracle (pdf)

This presentation provides and executive summary of XML security issues: XML_SecurityOverview.pdf

Our presentation on Building A Web Application Security Program. This was presented as supplementary material to the white paper of the same name.