Third-Party Code and Code Repositories

• Organizations may introduce third-party code by outsourcing code development, making security testing of outsourced code as important as internally developed code.
• Security professionals should know how third-party code is used and how their organization makes services available, because security flaws often arise in shared code.
• Vigilance about security updates is crucial due to the dependencies created by shared code.

Software Diversity

• Security professionals aim to avoid single points of failure to prevent availability risks from single component issues.
• Monitoring dependencies on single source code, binary executables, or compilers is vital, even if eliminating all dependencies is impossible.
• Tracking dependencies is a key element in maintaining a secure codebase.

Code Repositories

• These are centralized locations for application source code storage and management.
• Their main purpose is storing source files used in software development in a centralized, secure location that allows for change coordination among developers.
• Code repositories offer version control, tracking changes, and allowing code rollback to earlier versions when needed.
• Code repositories facilitate software development by enabling organized collaboration and meet the needs of security/auditing professionals through automated auditing/logging of changes.
• Exposing code promotes code reuse; developers can search for and reuse code for specific functions instead of starting from scratch.
• May be public, offering open-source code, or private, for internal organizational use.
• They help avoid the problem of dead code, where no one is responsible for the code, or know the location of the original source files.
• They are an important part of application security, but only one aspect of code management, which means cybersecurity teams should work with developers to properly provision and deprovision applications following approved release management processes.

Code Security

• Software developers take steps to secure the creation, storage, and delivery of their code using various methods.

Code Signing

• Code signing allows developers to confirm code authenticity to end-users.
• Developers use a cryptographic function to digitally sign code with a private key, with browsers using the developer's public key to verify the signature.
• This ensures the code is legitimate and unchanged by unauthorized individuals; lacking this can lead to users running inauthentic code.
• Code signing relies on the digital signature process; the developer signs with a private key, and the public key is in a digital certificate distributed with the application.
• Users get the certificate with the application, and their system uses the certificate's public key for signature verification.
• Code signing guarantees code origin and integrity, but does not guarantee the code is free of malicious content and malicious code can still pass the signature verification process if the developer signs it.

Code Reuse

• Many organizations reuse internal and third-party software libraries and software development kits (SDKs).

• Libraries are shared code objects for related functions, such as those for biology research, financial analysis, or social media functions.

• Instead of writing all code, developers can locate and use libraries with relevant functions.

• Organizations often publish SDKs to make libraries more accessible.

• SDKs are software library collections with documentation, examples, and resources that help programmers quickly start developing.

• SDKs also include utilities to help developers design and test code.

• Parameter pollution attacks exploit web platforms that improperly handle multiple copies of the same parameter.

• Modern platforms often defend against parameter pollution, but successful attacks still occur due to unpatched systems or insecure custom code.

Web Application Firewalls

• Web application firewalls (WAFs) play an important role in securing web applications against attacks.
• Developers should have strong application-level defenses like input validation and parameterized queries, to protect their applications.
• Applications may contain injection flaws due to insufficient developer testing or delayed vendor patches.
• WAFs operate like network firewalls but at the Application layer of the OSI model.
• A WAF sits in front of a web server, and processes all network traffic.
• The server scrutinizes input, performs validation using whitelisting/blacklisting, and prevents malicious traffic from reaching the web server as a layered defense against web application vulnerabilities.

Database Security

• Secure applications depend on secure databases to provide necessary content and transaction processing.
• Relational databases are at the core of modern applications; securing them goes beyond protection against SQL injection attacks.
• Cybersecurity professionals need deep knowledge of secure database administration practices.

Parameterized Queries and Stored Procedures

• Parameterized queries protect applications against injection attacks.
• With parameterized queries, developers prepare SQL statements and then allow user input as defined variables that prevent code insertion; Java uses PreparedStatement(), while PHP uses bindParam().
• Stored procedures work similarly, but SQL code is on the database server, not in the application.
• The client sends arguments to the server, which inserts those into a precompiled query template, thereby preventing injection attacks and improving database performance.

Obfuscation and Camouflage

• Organizations risk data theft by maintaining sensitive personal information in databases.
• Minimize data; do not collect unnecessary sensitive information and dispose of sensitive information when no longer needed.
• Data minimization reduces risk by preventing the loss of control of information that is not stored.
• Tokenization replaces direct personal identifiers with unique identifiers using lookup tables.
• A widely known value is replaced, such as a student ID, with a randomly generated 10-digit number.
• Maintain a lookup table to convert the values if needed, while keeping the lookup table secure.