sumnevaSERT Presentation

AGENDA
• Overview
• Demonstration
• Summary

2 Copyright © 2010 Sumneva - All Rights Reserved - http://sumneva.com - info@sumneva.com

Overview


INSECURITIES
• We live in a time where the security
of data is the most emphasized
yet least practiced thing
• WikiLeaks
• HBGary
• Epsilon

• Unfortunately, adding security to our
applications is almost always event
driven or reactive


CUSTOMER DEMAND
• Despite this, we’re all tasked with quickly
developing applications for our customers/
clients
• Often times, we take
shortcuts and leave
out things, like security
• Not because we want to,
because we have to


EXCUSES, EXCUSES...
• We make many, many excuses to ourselves as to
why we didn’t adequately secure our applications:
• Not enough time
• No one cares about the
data/application
• It’s “internal only”
• Our users are not smart
enough to do anything
malicious
• False sense of security


RECIPE FOR DISASTER
• Given:
• The stresses of getting our applications released quickly
• The lack of time we have to do so

• Our applications - APEX & otherwise - are likely to
have potential security vulnerabilities that
we could easily ﬁx
• If we only knew what they were and had the time...


SUMNEVASERT

• sumnevaSERT: Security Evaluation & Review Tool
• APEX application designed to evaluate and
identify potential security issues in other
APEX applications
• Supports APEX 4.0+
• Runs on any edition of the
database
• Can be easily customized to
meet your speciﬁc security and/or
QA requirements


HOW IT WORKS
• sumnevaSERT uses a simple scoring & red light/
green light approach to evaluate your application
based on a number of pre-deﬁned criteria
• Each application gets a score based on the result of
evaluating an attribute
• Percentage as well as X of Y points

• Each attribute evaluated either passes or fails
• Pass yields a point; failure yields none


HOW IT WORKS
An authorization scheme was
expected, but not found. Thus, this
attribute failed.

The developer can click on Fix
and see step-by-step instructions.


WHAT IT LOOKS FOR
• sumnevaSERT ships with a set of attributes that
inspect APEX applications for the following:

• Application Settings • Session State Protection
• Session Timeout • Unrestricted Items
• Security Attributes • Encrypted Items
• Schema Properties • Page Access
• SQL Injection • Form Autocomplete
• Cross Site Scripting • Authorization Schemes


ONE SIZE DOESN’T FIT ALL
• If you need additional attributes inspected,
you can customize sumnevaSERT as much as you like
• sumnevaSERT supports a number of rule types:
• NULL/NOT NULL
• List of Valid Values
• Less Than/Greater Than
• PL/SQL


MULTI-PURPOSE
• Thus, you can create your own attribute set(s) for
specific purposes, for example:
• General Security Attributes
• General set of attributes that must be met
and a minimal score must be achieved

• Application with Sensitive Data
• Look for specific columns in reports and
flag for follow-up

• Minimal Configuration Signature
• Applications must use a specific
authentication scheme, etc.


sumnevaSERT
D E M O N S T R A T I O N


Summary


THE REALITY
• sumnevaSERT will identify most security exploits that
hackers and malicious users alike look for in APEX applications
and provide step-by-step solutions to ﬁx them
• But it will not secure everything
• There’s no such thing as a silver bullet of any sort...

• You still need a strong overall security policy
• Strong Passwords
• Physical access control
• Code Audits
• Best Practices


AVAILABILITY
• Initial release in Beta now
• Still accepting beta customers - contact us for details

• Targeted release of June 2011
• Will support APEX 4.0+


LICENSING
• Per instance of APEX
• Can run on as many applications as you like in as many
workspaces as you like in a single instance of APEX

• Contact us for details & pricing
• sales@sumneva.com
• +1 (703) 879-4615
• http://www.sumneva.com/sert


http://sumneva.com


sumnevaSERT Presentation

Recomendados

Recomendados

Más contenido relacionado

Destacado

Destacado (13)

Similar a sumnevaSERT Presentation

Similar a sumnevaSERT Presentation (20)

Último

Último (20)

sumnevaSERT Presentation