Cyber Defense Initiative 2015

Building a Web Application Vulnerability Management Program

• Jason Pubal - Master's Degree Candidate
• Thursday, December 17th, 7:15pm - 8:15pm

For years, attackers have assailed network and system level vulnerabilities, fueling demand for products like firewalls and network vulnerability scanners. As these products mature and IT security teams learn to better handle network security, the industry is seeing a visible increase in attacks moving up the stack to target application-level vulnerabilities.

Mature application security programs perform security testing against web applications during development but tend to be reactive to security defects once an application has been deployed. Web applications that are being used in a production environment are not typically subject to recurring security tests. There is fear of causing an impact to functionality and a notion that as long as the codebase has not changed it is impossible to find new security vulnerabilities in an application that was thoroughly tested prior to being deployed. Any vulnerability not found during this initial testing is only known about and addressed after an incident has occurred. Meanwhile, infrastructure vulnerability management performs recurring vulnerability scanning against production networks and servers as the web applications hosted on them are ignored.

As threats evolve and new attack vectors are discovered, applications need to be tested to see how they are affected. Application vulnerability management needs the same rigor infrastructure vulnerability management has; web application vulnerability assessments need to be continuous. The web application vulnerability management framework presented in this presentation is the next step in application security. This framework introduces a methodology, processes, and activities to achieve that goal.

Bio: Jason is a Director of information security leading web application security and penetration testing teams at a large financial services company. In his decade in information security, he has worked in various industries, done a little of everything security, and picked up a couple certifications along the way. With a development background, he has focused his efforts in the last few years on application security. A snowboarder, homebrewer, and hacker - Jason is happy to talk about application security, or your last good beer.