SC Magazine Discussion by Dr MJ Frederick https://padlet.com/mj_frederick/8miica9mqey1 Application Security en-us 2017-09-30 21:01:16 UTC 2018-11-28 03:40:24 UTC hello@padlet.com SC- Application Security - Jessie Reddish (Group4) jessie_reddish https://padlet.com/mj_frederick/8miica9mqey1/wish/306592716 https://www.scmagazine.com/home/security-news/report-reveals-struggles-of-smbs-navigating-cyber-threat-landscape/
Report reveals struggles of SMBs navigating cyber threat landscape - 47% Small/Medium businesses have no understanding of how to defend their companies against attacks. A lack of resources, training, and personal is the leading cause to a company's data breach. SMBs are losing the battle to high tech attacks and will need to make a serious investment in cyber security to shore up their data protection.


]]> 2018-11-21 03:05:23 UTC https://padlet.com/mj_frederick/8miica9mqey1/wish/306592716 Group 6 https://padlet.com/mj_frederick/8miica9mqey1/wish/308100653 With the latest Facebook breach, Keith Casey from Okta API Problem Solver brings steps for mitigating challenges for organizations. 
1. Require MFA at the IDP level
2. Require MFA Before Linking Accounts
3. Zero Trust for Social Authentication
4. The Real Problem: Don’t Allow Impersonation
No matter the IDP (Identity Provider) it should be standard practice to have a second authentication factor. The same should be needed before linking accounts. Things like resetting passwords, transferring money or booking hotels ant etc. should require reauthentication or additional factors to confirm user's approval or identity to mitigate fraud, support issues and brand damage no matter the inconvenience. impersonation seems beneficial to organizations, but it comes with some potential drawbacks that could leave your system vulnerable so it’s better to not allow impersonation because the small advantages it gives aren’t worth the risks.]]> 2018-11-27 02:44:19 UTC https://padlet.com/mj_frederick/8miica9mqey1/wish/308100653 Group 5 https://padlet.com/mj_frederick/8miica9mqey1/wish/308460913 https://www.scmagazine.com/home/security-news/companies-customers-will-avoid-you-after-a-breach-survey-says/

Our group chose this article because it stood out as unique in the way it addressed application security. Instead of focusing on the technical side of things, this article explains the negative impact that lax or compromised app security can have on a business. Lost revenue and decreased faith from customers can break an entity.]]> 2018-11-27 18:46:34 UTC https://padlet.com/mj_frederick/8miica9mqey1/wish/308460913 Group 7 https://padlet.com/mj_frederick/8miica9mqey1/wish/308554616 Back in May of this year, a bug was identified within Facebook's search page that potentially allowed attackers to monitor search queries of users, as well as capture other information. According to the article, the search end point was not CSRF protected and had other flaws. This would have allowed users to be tricked into clicking into a malicious website that revealed numerical data related to their accounts, such as number of friends, etc. On the 13th, Facebook announced that the bug had been closed thanks in part to their bug bounty program. This article shows the importance of constant vigilance and safeguarding personal info even on websites that are believed to be safe or trusted. In addition, this shows that security flaws are important to actively monitor for in all applications as user data is constantly at risk from attackers.

https://www.scmagazine.com/home/security-news/facebook-reportedly-fixes-search-bug-that-could-have-threatened-user-privacy/]]> 2018-11-27 21:50:08 UTC https://padlet.com/mj_frederick/8miica9mqey1/wish/308554616 Group 8 (Mark Deel, Jonathan Pintos, Rachel Hale, and Long Phan) mark_deel https://padlet.com/mj_frederick/8miica9mqey1/wish/308582618 In this case, the interception of an authentication token leads to unhindered access to a large amount of personal information as well as access to customer's devices.

]]> 2018-11-27 23:48:56 UTC https://padlet.com/mj_frederick/8miica9mqey1/wish/308582618 Group 4 (Jesse, Peter, Pitou) https://padlet.com/mj_frederick/8miica9mqey1/wish/308607523 This is a very recent webcast that we found good enough to share. This session looks at the current state of application security and why treating the application seriously makes sense.]]> 2018-11-28 02:03:52 UTC https://padlet.com/mj_frederick/8miica9mqey1/wish/308607523 (Group 3) Megan McDowell, David Carman, Jessie Spires Forensics was run on an enterprise breach to find that initial access was made through a web server to a database server through a roundabout route where the data thefts occurred, where accesses were amplified via malware targeting “low-hanging fruit.” It should be warned that when web applications used as front-ends for databases are used, they become vulnerable to simple attacks such as SQL Injection. The tech went on the internet and mocked such injection, finding his way into the server and to sensitive information as a test. He warns that even if attacks are simple, defenses should not fail to be complex to protect from multiple variants of such attacks. https://padlet.com/mj_frederick/8miica9mqey1/wish/308621842 2018-11-28 03:39:08 UTC https://padlet.com/mj_frederick/8miica9mqey1/wish/308621842