APPLICATION SECURITY IN LARGE ENTERPRISES (PART 2)

application_security_in_large_enterprises_part_2 x

Detailed Description:

Large enterprises of a thousand persons or more often have distinctly distinct data security architectures than lesser businesses. Typically they treat their data security as if they were still little companies.

This paper endeavors to demonstrate that not only do large businesses have an entire ecology of focused programs, specific to large businesses and their needs, but that this software has distinct security implications than buyer or small enterprise software. identifying these dissimilarities, and analyzing the way this can be taken advantage of by an attacker, is the key to both striking and keeping safe a large enterprise.

The Web applications are the important part of your business every day, they help you handle your intellectual property, increase your sales, and keep the trust of your customers. But there’s the problem that applications re fast becoming the preferred attack vector of hackers. For this you really need something that makes your application secure.

And, with the persistent condition of today’s attacks, applications can easily be get infected when security is not considered and scoped into each phase of the software development life cycle, from design to development to testing and ongoing maintenance of the application. When you take a holistic approach to your application security, you actually enhance your ability to produce and manage stable, secure applications. Applications need training and testing from the leading team of ethical hackers, for this there should be an authentic plan to recover these issues that can help an organization to plan, test, build and run applications smartly and safely.

Large enterprises of a thousand people or even more have distinctly different information security architectures than many other smaller companies. Actually, they treat their information security as if they were still small companies.

We are going to discuss some attempts to demonstrate that not only do large companies have an entire ecology of specialized software, specific to large companies and their needs, but that this software has different security implications than consumer or small business software for the applications. Recognizing these differences, and examining the way this can be taken advantage of by an attacker, is the key to both attacking and defending a large enterprise. It’s really important to cover up the security procedures in the large enterprise.

Key Features:

·        

Web application security checking from development through output

·         Security check web APIs and world wide web services that support your enterprise

·         Effortlessly organize, view and share security-test outcomes and histories

·         Endow broader lifecycle adoption through security automation

 

·         Increase security information over your whole enterprise

(
Application security in large enterprises (part 2)
Student Name:
) (
Instructor Name
)

Detailed Description:

Large enterprises of a thousand persons or more often have distinctly distinct data security architectures than lesser businesses. Typically they treat their data security as if they were still little companies.

This paper endeavors to demonstrate that not only do large businesses have an entire ecology of focused programs, specific to large businesses and their needs, but that this software has distinct security implications than buyer or small enterprise software. identifying these dissimilarities, and analyzing the way this can be taken advantage of by an attacker, is the key to both striking and keeping safe a large enterprise.

The Web applications are the important part of your business every day, they help you handle your intellectual property, increase your sales, and keep the trust of your customers. But there’s the problem that applications re fast becoming the preferred attack vector of hackers. For this you really need something that makes your application secure.

And, with the persistent condition of today’s attacks, applications can easily be get infected when security is not considered and scoped into each phase of the software development life cycle, from design to development to testing and ongoing maintenance of the application. When you take a holistic approach to your application security, you actually enhance your ability to produce and manage stable, secure applications. Applications need training and testing from the leading team of ethical hackers, for this there should be an authentic plan to recover these issues that can help an organization to plan, test, build and run applications smartly and safely.

Large enterprises of a thousand people or even more have distinctly different information security architectures than many other smaller companies. Actually, they treat their information security as if they were still small companies.

We are going to discuss some attempts to demonstrate that not only do large companies have an entire ecology of specialized software, specific to large companies and their needs, but that this software has different security implications than consumer or small business software for the applications. Recognizing these differences, and examining the way this can be taken advantage of by an attacker, is the key to both attacking and defending a large enterprise. It’s really important to cover up the security procedures in the large enterprise.

Key Features:

· Web application security checking from development through output

· Security check web APIs and world wide web services that support your enterprise

· Effortlessly organize, view and share security-test outcomes and histories

· Endow broader lifecycle adoption through security automation

· Increase security information over your whole enterprise

· Verify compliance with guidelines and security policies

· Accessibility of the application by the Internet;

· If the application provides the ability to method or supply get get access to sensitive data;

· Source of application’s development; such as, in-house, bought, or bound for;

· Extent that protected practices are used in the application’s development method;

· Existence of an productive, recurring method to monitor, recognize, and remediate or correct vulnerabilities

· Reality of a periodic promise method to validate individually the security of the application

Applications cover the gamut of an organization’s procedures. From accounting packages and intranet portals to comprehensive enterprise resource planning (ERP) schemes, almost 100 per hundred of an organization’s mission-critical data flows through these submissions. The function of IT auditors, therefore, is to determine if correct controls are in location to defend the data residing in these schemes.

Auditors can use various advances when carrying out a comprehensive review of an application’s security controls. Discovering about each of these evaluation methods will endow auditors to determine ahead of time which procedure will yield the most optimal results as well as supply auditors with the information they need to better assess an application’s security functionality.

Evaluations of an application’s security characteristics can range in detail and scope. The most broadly used methods for evaluating scheme security controls encompass the use of high-level conceive audits, black-box or penetration tests, and source cipher reconsiders. The next three parts supply a more comprehensive description of each assessment choice.

Most accomplished security professionals agree that, along with a strong backdrop in technology, a thorough comprehending of the enterprise is of paramount importance when it arrives to conceiving protected solutions for that business. Though some purist security technologists may find it difficult to accept, it is nevertheless factual that security is there for the enterprise and not the other way around. Security lives to endow the enterprise, not to be an impediment

Technologies Involved:

Conceiving for security in software is futile except you plan to proceed on the design and incorporate essential protected controls throughout the development stage of your programs development lifecycle. It is imperative that secure characteristics are not ignored when design artifacts are converted into syntax constructs that a compiler or interpreter can realize. Composing protected cipher is no different than composing code that is working, reliable, or scalable.

Managing security actually means that understanding the risks and deciding how much risk is acceptable. Everyone knows that different levels of security are appropriate for different organizations. No network is 100 percent secure, so don’t aim for that level of protection. You should look for the major vulnerabilities that you can address with your existing resources.

Computer networks have numerous advantages all over the Internet. Connecting your network to the Internet provides access to an enormous amount of information and allows you to share information on an incredible scale. However, the communal nature of the Internet, which creates so many benefits, also offers malicious users easy access to numerous targets. The Internet is only as secure as the networks it connects, so we all have a responsibility to ensure the safety of our networks.

You should follow these steps that can provide you the insight of best specific issues:

· Understanding networking concepts

· Identifying vulnerabilities on your network

· Creating security policies and selecting and configuring a firewall

· We also focus on wide area networking and network management

1) Use Strong Passwords and Change Them Regularly

Passwords are actually the first part of defense in preventing unauthorized access to any computer. Regardless of type or operating system, a password should be required to log in. Although a strong password will not prevent attackers from trying to gain access, it can slow them down and discourage them.

Strong passwords should include:

· Be at least eight characters long

· Include a combination of upper case and lower case letters, numbers and at least one special character, such as a hash.

2) Passwords and Strong Authentication

Strong, or multi-factor, authentication combines multiple authentication methods resulting in stronger security or the password we required. Other than this authentication method another one is used now a day. For example a smartcard or key -fob, or a fingerprint iris scan and face recognition.

3) Use a Firewall

We should have a firewall to protect against threats from outside sources. While anti-virus software will help to find and destroy infected software that has already entered, a firewall’s job is to prevent these malicious viruses from entering in the first place. Actually anti-virus can be thought of as infection control while the firewall has the role of disease prevention.

Managing Technologies:

· Clearly define your change management plan that will help in firewall management authority and a documented process can also help prevent unwanted changes to the current configuration of the network security.

· Test major firewall changes before going live. Make sure to test major firewall changes before they are implemented in production. If possible, build a testing environment that mirrors production systems.

· Protect yourself by taking a configuration snapshot before making major changes to your firewall and this is one of the best protection way.

· Monitor user access to the firewall configuration. User access logs can act as an elementary detection system, potentially revealing unauthorized access attempts from within or outside the network security.

· Company should schedule regular policy audits because over time, rules may not match the actual security policy and unused rules may clog traffic and present a barrier to network changes.

Technologies involved in Large Enterprises:

IM applications are peer-to-peer software that permit text and voice communication between two or more users. Widespread IM submissions are Yahoo! Messenger, MSN Messenger, Google converse, and AOL Instant Messenger. Risk modeling physical exercises for IM submissions generally includes the following components:

· An overview of the submission and its security objectives.

· An identification of assets.

· A detection and ranking of risks.

· An identification of vulnerabilities.

· Below is a recount of each element.

Security Objectives

The application’s security objectives should be asserted apparently. For an IM submission, these might be correct authentication of user credentials, secure connection between IM purchasers, availability of the messaging service, and protected meeting management.

Submission Overview

IM submissions normally have client-server architecture. As a outcome, it is significant to identify the constituents of the submission and the communication scheme among these disparate, yet connected architecture segments. The major components of an IM submission and its purposes encompass:

· Purchaser undertakings (e.g., sending and receiving notes, supplementing and deleting associates, and customizing the purchaser environment).

· Server activities (e.g., organizing the database of users subscribed to the IM service, overseeing meeting minutia, and providing notification functionality).

· IM connection protocols (e.g., recognizing exact note formats and sequences).

Identifying Assets

The IM programs stores and transmits sensitive data, including client names and passwords, profiles and other customized client facts and figures, and files dispatched and received.

Detecting Threats

The IM application’s client-server architecture may be susceptible to risks, such as:

· Personal thefts, which are exploited by feeble authentication and meeting administration mechanisms.

· Facts and figures robberies, which are exploited by insecure get access to to command means.

· Privacy breaks, which are exploited through feeble authentication or server defense means.

· Isolated cipher executions, which are exploited through buffer overflows.

· Communal engineering methods, which are exploited through phishing and cross-site scripts attacks.

Finding out Vulnerabilities

One of the most crucial steps in the threat modeling method is recognizing the application’s vulnerabilities. These may encompass:

· Message field overflows. The attacker could assemble a note that determinants the remote IM purchaser to smash into by overflowing the note area or by overflowing other IM constituents.

· File move buffer overruns. A document title with excessively long names can cause a buffer overflow when the client’s IM endeavors to download the document from the server.

· Cross-site scripting. HTTP-based IM constituents can permit malicious scripts to be injected and performed at the user’s end.

· Username spoofs. An attacker can spoof a legitimate meeting ID and flood an isolated user client without being recognized.

For more data on risk modeling, IT auditors can visit Microsoft’s submission risk modelingWorld Wide Web sheet. Microsoft furthermore has evolved a free threat modeling device that can be downloaded from its World Wide Web location.

Cryptography

As cited earlier, submissions use encryption techniques when saving or transmitting perceptive data. When reconsidering cryptographic vulnerabilities, auditors should identify key lifetime, storage, transmission, and disposal means as well as the encryption algorithms and key exchange protocols being used.

Future Trends:

For bigger enterprises, cloud-based services will endow 30-40 per hundred of enterprise functionality while still relying on homegrown IT consigned solutions for the residual 70-60 per hundred of functionality. As this change happens interior answers will be sustained through newer private/hybrid cloud platforms.

Impact

The internal IT function will evolve the art of operating in the hybrid environment where, on one hand, it will dispute and leverage ISVs (independent programs vendors) and cloud service providers to incorporate specific functions/features to support unique requirements; on the other hand, internally with enterprise purposes, it will drive the mandate of simplification and standardization.

Different in the past where out-of-the-box functionality was customized due to free get access to modify an on-premises solution, the new cloud-enabled environment will serve as a deterrent to propel only exclusive obligation support where comparable benefit is to be gained.

References:

Tatiana Hodorogea, (2013). Modern Technologies Used for Security

http://www.intechopen.com/books/applied-cryptography-and-network-security/modern-technologies-used-for-security-of-software-applications

Mike Arpaia, (2012). Code as Craft

http://codeascraft.com/2013/06/04/leveraging-big-data-to-create-more-secure-web-applications/

Paylod, (2013). APPLICATION SECURITY

http://www.f5.com/it-management/solutions/application-security/overview/

John H. Sawyer, (2013). How Enterprises Can Use Big Data To Improve Security

http://www.darkreading.com/management/how-enterprises-can-use-big-data-to-impr/240157674

Ask SujataRamamoorthy, (2011). Scaling application vulnerability management across a large enterprise

http://public.dhe.ibm.com/common/ssi/ecm/en/wgc12349usen/WGC12349USEN.PDF

Chris Jackson, (2010). Network Security Auditing

http://www.worlduc.com/UploadFiles/BlogFile/36%5C1126397%5C1

MihaPihler, (2011). Simple Firewall Best Practices for Small and Midsize Businesses

http://technet.microsoft.com/en-us/security/hh144813.aspx

Daniel Adinolfi, (2006). Data Security Practices and Guidelines

http://www.it.cornell.edu/security/depth/practices/data_guidelines.cfm

Jeff Tyson, (2009). How Firewalls Work

http://www.howstuffworks.com/firewall.htm/printable

Jim Bird, (2012). Survey on Application Security

http://www.sans.org/reading-room/analysts-program/sans-survey-appsec

Admin, (2008). Application Security

http://www.occ.gov/news-issuances/bulletins/2008/bulletin-2008-16.html

Paul D. Hamerman, (2011). Seven trends to shape the future of enterprise applications and ERP

http://www.computerweekly.com/news/2240105104/Forrester-Seven-trends-to-shape-the-future-of-enterprise-applications-and-ERP