Navigating the Security Landscape: Network Security vs* Application Security

In today’s digital landscape, integrating network security and application security is essential for a robust defense strategy. Network security protects infrastructure from unauthorized access and external threats, while application security safeguards software from vulnerabilities and attacks. A combined approach offers comprehensive threat protection, improves incident response, and strengthens the overall security posture. Key benefits include preventing unauthorized access, protecting sensitive data, and ensuring the resilience of applications against both external and internal threats.

Let’s start with Networking Security — Networking security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure. It encompasses a range of policies and practices designed to ensure the confidentiality, integrity, and availability of data and resources within a network. Common network security attacks include Distributed Denial of Service (DDoS) attacks, which overwhelm a network with traffic to render it unusable, and other threats like malware, phishing, and man-in-the-middle attacks. Leading vendors in the network security space include Cisco, known for its comprehensive security solutions and robust firewall technology; Zero Networks, which specializes in zero trust security models to prevent unauthorized access; and Juniper Networks, offering a wide array of networking and cybersecurity products to safeguard network infrastructure.

Network security defenses involve a combination of technologies, practices, and policies designed to protect network integrity and data from cyber threats. Traditional approaches include Virtual Private Networks (VPNs), firewalls, and Intrusion Detection Systems (IDS), which monitor and filter incoming and outgoing traffic to prevent unauthorized access. Modern approaches have evolved to include Zero Trust security models, which assume that threats could be inside the network as well as outside, requiring strict identity verification for every person and device trying to access resources on the network.

Additionally, according to the Cybersecurity and Infrastructure Security Agency (CISA), implementing Multi-Factor Authentication (MFA) can reduce the chance of an attack by 90%, making it a crucial component of a robust security strategy.

According to CISA, MFA reduces the chance of attack by >90%!

Next, let’s talk about Application Security.

Application security focuses on safeguarding software and applications from potential threats and vulnerabilities. It involves a range of measures and practices designed to protect applications from unauthorized access, manipulation, or exploitation. Examples of common application security issues are highlighted in the OWASP Top 10, which lists the most critical security risks to web applications, such as injection attacks, broken authentication, and cross-site scripting (XSS). Notable examples of application security vulnerabilities include the OpenSSL Heartbleed bug, which exposed a critical flaw in the OpenSSL cryptographic software library, and the Apache Struts vulnerability, which was exploited in significant data breaches. Implementing robust application security practices is essential to protect sensitive data and maintain the integrity and reliability of applications.

Let’s take CVE 2020–10687 for example..

CVE-2020–10687 is a vulnerability that affects certain versions of the HTTP server software. The attack graph for this vulnerability outlines the various stages and components involved in a potential exploit.

1. Threat Actor:

• The attack begins with a threat actor who aims to exploit the vulnerability. This individual or group typically has some level of knowledge about the target system and its vulnerabilities.

2. Web Client:

• The threat actor uses a web client to initiate the attack. The web client can be a custom script or tool designed to interact with the target web server.

3. Malicious HTTP Payload:

• The threat actor crafts a malicious HTTP payload. This payload is specifically designed to exploit the HTTP request smuggling vulnerability. HTTP request smuggling involves sending specially crafted HTTP requests that are interpreted differently by different servers, leading to security flaws.

4. HTTP Request Smuggling:

• The malicious HTTP payload exploits the HTTP request smuggling vulnerability. In this scenario, the payload is designed to be interpreted as two different requests by two different parts of the server infrastructure, usually the front-end server (like a proxy) and the back-end server (like the actual application server).

5. HTTP Request:

• The crafted HTTP request is sent from the web client to the target web server. The request is designed to be interpreted in a way that allows the threat actor to bypass security controls, manipulate server behavior, or access unauthorized data.

6. Exploit Execution:

• Once the HTTP request smuggling is successful, the threat actor can execute various malicious actions. These actions may include intercepting and modifying legitimate user requests, injecting malicious content, or gaining unauthorized access to sensitive information.

7. Potential Outcomes:

• Data Theft: Sensitive data from users or the server can be stolen.

• Session Hijacking: User sessions can be hijacked, leading to unauthorized actions being performed on behalf of the user.

• Security Controls Bypass: Security mechanisms such as authentication and authorization can be bypassed.

• System Compromise: The server or underlying infrastructure can be compromised, potentially leading to a broader attack on the network.

Summary

CVE-2020–10687 involves a complex attack vector where a threat actor uses a web client to send a malicious HTTP payload that exploits an HTTP request smuggling vulnerability. This allows the attacker to manipulate server behavior and potentially gain unauthorized access to sensitive information or execute further malicious actions. Properly securing web servers and applications, as well as implementing robust request validation and security controls, are crucial to mitigating such vulnerabilities.

MALICIOUS JAVASCRIPT CODE EXAMPLE

Here’s an example of vulnerable JavaScript code that could be used in an XSS attack to steal usernames and passwords and send the stolen credentials to an attacker’s server:

1. Form Submission Interception:

• The JavaScript code adds an event listener to the form’s submit event. This event listener prevents the default form submission using e.preventDefault().

2. Credential Extraction:

• It then retrieves the values of the username and password fields using document.getElementById(‘username’).value and document.getElementById(‘password’).value.

3. Data Exfiltration:

• The code creates a new Image object and sets its src attribute to a URL controlled by the attacker ([http://attacker-server.com/steal](http://attacker-server.com/steal%60)). The username and password are sent as query parameters, which means when the image is “loaded,” the credentials are sent to the attacker’s server.

Mitigation

To prevent such XSS attacks, consid

1. Input Validation and Sanitization:

• Always validate and sanitize user inputs both on the client and server sides to ensure no malicious code is executed.

2. Content Security Policy (CSP):

• Implement a CSP to restrict the sources from which scripts can be loaded. This can help mitigate the impact of XSS by preventing the execution of unauthorized scripts.

3. Escaping Outputs:

• Escape all untrusted data before rendering it in the HTML to prevent the injection of malicious scripts.

4. HTTPOnly Cookies:

• Use HTTPOnly cookies to prevent JavaScript from accessing sensitive cookies.

5. Use Frameworks that Automatically Escape Data:

• Utilize web development frameworks that automatically escape data to prevent XSS vulnerabilities.

By following these practices, you can significantly reduce the risk of XSS attacks and protect sensitive user information.

How do we protect against such threats? This is where odern Application Security Vendors come into play.

Modern application security solutions are essential for protecting software from potential threats and vulnerabilities throughout the development lifecycle. These solutions include static, dynamic, and interactive testing, as well as dependency scanning and code reviews. Below is a brief overview of these approaches and some common vendors in the field.

Static Application Security Testing (SAST)

SAST is a white-box testing method that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the code. It helps identify vulnerabilities early in the development process.

- Common Vendors: Checkmarx, Veracode, Fortify

• Example: Checkmarx offers a robust SAST solution that integrates with various development environments to scan code for security flaws during the coding phase.

Dynamic Application Security Testing (DAST)

DAST is a black-box testing method that analyzes running applications for vulnerabilities by simulating external attacks. It does not require access to the source code.

- Common Vendors: Veracode, Acunetix, AppScan

• Example: Veracode provides DAST services that scan web applications in runtime to identify vulnerabilities such as SQL injection and cross-site scripting (XSS).

Interactive Application Security Testing (IAST)

IAST combines elements of both SAST and DAST by analyzing applications in real-time during execution. It leverages instrumentation to monitor applications and detect vulnerabilities as they are being used.

• Common Vendors: Contrast Security, Veracode

• Example: Contrast Security offers an IAST solution that integrates with applications to provide continuous security analysis during runtime.

Dependency Scanning

Dependency Scanning checks the libraries and frameworks that an application depends on for known vulnerabilities. It helps ensure that third-party components used in the application are secure.

• Common Vendors: Snyk, WhiteSource, Black Duck

• Example: Snyk offers a comprehensive dependency scanning solution that integrates with development pipelines to monitor and fix vulnerabilities in third-party libraries.

Code Review

Code Review is the practice of manually inspecting the source code by developers to identify potential security vulnerabilities, code quality issues, and logic errors. It can be enhanced with automated tools to assist in the process.

• Common Tools: GitHub Code Scanning, Bitbucket Code Insights

• Example: GitHub Code Scanning can be used to automatically scan code for vulnerabilities during pull requests and provide feedback within the development workflow.

Common Vendors in Application Security

• Checkmarx: Known for its comprehensive SAST solutions, Checkmarx helps developers find and fix security issues in the source code early in the development process.

• Veracode: Provides a range of application security services, including SAST, DAST, and IAST, offering a complete platform for securing software.

• DefectDojo: An open-source application vulnerability management tool that integrates with various security testing tools to manage and triage vulnerabilities found during the security testing process.

Summary

Modern application security solutions encompass a variety of testing methods and practices to ensure software security throughout the development lifecycle. Key solutions include SAST, DAST, IAST, dependency scanning, and code reviews. Leading vendors such as Checkmarx, Veracode, and DefectDojo provide comprehensive tools and platforms to help organizations identify, manage, and remediate security vulnerabilities, ensuring the development of secure applications.

Network Sec + AppSec = Better Together

Better Together: Network Security and Application Security

In today’s digital landscape, the convergence of network security and application security is crucial for a comprehensive defense strategy. While network security focuses on protecting the infrastructure from unauthorized access and threats, application security aims to safeguard software and applications from potential vulnerabilities. Integrating both approaches ensures robust protection across all layers of an organization’s IT environment.

Embedding Zero Trust into Applications: A Transformational Shift

As a side quest, let’s talk a little bit about leveling up and embedding Zero Trust into Applications as well.

While traditional Zero Trust models focus on enforcing security controls at the network level, embedding Zero Trust principles directly into applications offers an even more resilient approach. Many attacks and compromises occur because network security appliances, which listen on network interfaces, are inherently exposed to vulnerabilities like CVEs, RCEs, DDoS, or credential stuffing. These threats highlight the risks of relying solely on external defenses.

By embedding Zero Trust Networking (ZTN) into applications during the SDLC, we can eliminate these exposures altogether. Applications with embedded ZTN have no listening ports on the underlay network (WAN, LAN, or host OS network), making them unattackable via conventional IP-based tools. This proactive approach renders threats like DDoS or port scanning immediately ineffective.

Shifting the Burden of Security

This paradigm shift flips the security responsibility from consumers, who often rely on bolted-on network and application security tools, to producers. By embedding security directly into applications, systems become secure by default and design, simplifying architectures and ensuring resilience.

One example is an open-source solutions like OpenZiti make this revolutionary approach accessible, empowering developers to create difficult to attack applications without requiring significant additional resources. By adopting embedded ZTN, organizations can redefine their security strategies, ensuring applications and systems are immune to conventional network-based threats.

Benefits of Integrating Network and Application Security

1. Comprehensive Threat Protection:

• Network Security: Utilizes firewalls, VPNs, Intrusion Detection Systems (IDS), and other technologies to prevent unauthorized access and detect potential threats at the network level.

• Application Security: Implements practices like SAST, DAST, IAST, and dependency scanning to identify and mitigate vulnerabilities within the software.

2. Enhanced Security Posture:

• By combining network security and application security, organizations can create multiple layers of defense. Network security ensures the perimeter is secure, while application security protects from within, addressing internal vulnerabilities.

3. Improved Incident Response:

• A unified approach allows for better coordination and faster response times during security incidents. Network monitoring can detect unusual traffic patterns, while application security tools can pinpoint specific vulnerabilities being exploited.

4. Zero Trust Implementation:

• Network Security: Ensures that only verified devices and users can access the network. This includes implementing MFA (Multi-Factor Authentication) and continuous network monitoring.

• Application Security: Validates that applications and users have the necessary permissions, minimizing the risk of insider threats and unauthorized access to sensitive data.

5. Safeguarding Applications:

• Protecting applications is vital as they often contain sensitive data and are common targets for attackers. Integrating application security measures like code reviews, vulnerability scanning, and security patches with network security controls ensures that applications are resilient against attacks.

Real-World Example

Consider a financial services company that adopts a Zero Trust model. They implement network security measures such as firewalls and VPNs to secure their infrastructure. Simultaneously, they use application security tools like SAST and DAST to continuously scan their financial applications for vulnerabilities. By doing so, they ensure that their applications are not only secure from external threats but also protected from potential internal flaws.

TL;DR:

Combining network security and application security through a Zero Trust model enhances overall protection by securing infrastructure and applications from both external and internal threats. This integrated approach improves threat detection, incident response, and safeguards sensitive data, ensuring a robust security posture.