1	Application Layer Security By John Rouda
2	Overview of the Presentation Introduction Security Concepts Confidentiality Integrity Availability Design Vulnerabilities Development Vulnerabilities Deployment Vulnerabilities SQL Injection Sample Conclusion
3	Introduction What is Application Layer Security? Is it necessary? Who does it affect? What are the categories of vulnerabilities?
4	Security Concepts Confidentiality – ensuring that only authorized people can view the information Integrity – ensuring that data is correct and has not been altered or tampered with by any unauthorized person or program Availability – ensuring that the information remains available to all authorized users for immediate access
5	Design Vulnerabilities Making things too easy Better error handling and increased security planning Good faith design flaws Better planning, better testing and disjoined security features Giving too much access MAC – Mandatory Access Control Lack of proper error handling Better error handling and coded messages
6	Development Vulnerabilities Un-validated data entry Client-side Server-side Validate everything on the entry form and on the database Buffer overflow Better planning, better testing and disjoined security features
7	Deployment Vulnerabilities Deployment without planning Develop a deployment security plan Lack of employee education Educate employees Social Engineering Educate employees
8	SQL Injection If I set the username and password to: Username: Bob Password: Hardtoguess The SQL statement is: SELECT * FROM WebUsers WHERE Username=’Bob’ AND Password=’Hardtoguess’
9	SQL Injection The code in the page: String sql = new String(“SELECT * FROM WebUsers WHERE Username=’” + request.getParameter(“username”) + “’ AND Password=’” + request.getParameter(“password”) + “’” stmt = Conn.prepareStatement(sql) Rs = stmt.executeQuery()
10	SQL Injection Instead enter the password: Aa’ OR ‘A’=‘A The SQL statement now becomes: SELECT * FROM WebUsers WHERE Username=’Bob’ AND Password=’Aa’ OR ‘A’=‘A’ The attacker is now in the database! www.webideabank.net/sql/
11	Conclusion Security Concepts Confidentiality Integrity Availability Three common vulnerabilities Design Vulnerabilities Development Vulnerabilities Deployment Vulnerabilities
12	Questions? ?