Application security in the ISO27001:2013 Environment

Vinod Vasudevan

• Publisher: IT Governance Publishing
• Year: 2015
• eBook ISBN: 9781849287692
• Edition: 2
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

Web application security as part of an ISO 27001-compliant information security management system

Web application vulnerabilities are a common point of intrusion for cyber criminals. As cyber security threats proliferate and attacks escalate, and as applications play an increasingly critical role in business, organisations urgently need to focus on web application security to protect their customers, their interests and their assets.

Although awareness of the need for web application security is increasing, security levels are nowhere near enough: according to the 2015 Trustwave Global Security Report, 98% of tested web applications were vulnerable to attack.

SMEs in particular should be very concerned about web application security: many use common, off-the-shelf applications and plugins – such as Internet Explorer, Java, Silverlight, and Adobe Reader and Flash Player – which often contain exploitable vulnerabilities.

Application Security in the ISO 27001: 2013 Environment explains how organisations can implement and maintain effective security practices to protect their web applications – and the servers on which they reside – as part of a wider information security management system by following the guidance set out in the international standard for information security management, ISO 27001.

The book describes the methods used by criminal hackers to attack organisations via their web applications and provides a detailed explanation of how you can combat such attacks by employing the guidance and controls set out in ISO 27001.

Product overview

• Second edition, updated to reflect ISO 27001: 2013 as well as best practices relating to cryptography, including the PCI SSC's denigration of SSL in favour of TLS.
• Provides a full introduction to ISO 27001 and information security management systems, including implementation guidance.
• Describes risk assessment, management and treatment approaches.
• Examines common types of web app security attack, including injection attacks, cross-site scripting, and attacks on authentication and session management, explaining how each can compromise ISO 27001 control objectives and showing how to test for each attack type.
• Discusses the ISO 27001 controls relevant to application security.
• Lists useful web app security metrics and their relevance to ISO 27001 controls.
• Provides a four-step approach to threat profiling, and describes application security review and testing approaches.
• Sets out guidelines and the ISO 27001 controls relevant to them, covering:
  • input validation
  • authentication
  • authorisation
  • sensitive data handling and the use of TLS rather than SSL
  • session management
  • error handling and logging
• Describes the importance of security as part of the web app development process

About the authors

Vinod Vasudevan, CISSP, is the chief technology officer (CTO) at Paladion. Before co-founding Paladion, Vinod worked with Microsoft. He wrote the chapter 'Application Security and ISO27001'.

Anoop Mangla is a risk specialist in banking and finance, and an expert on the effectiveness of security technologies in organisations' security. He wrote the chapter 'Introduction to Application Security Threats'.

Firosh Ummer, CISA, ISO27001 LA, CBCP, BS15000 LA, is co-founder of Paladion and head of the ISO 27001 consulting practice. Firosh wrote the chapter 'Threat Profiling and Security Testing'.

Sachin Shetty, CISSP, is a senior application security engineer with Paladion. He wrote the chapter 'Attacks on Applications'.

Sangita Pakala, GCIH, is Head of Application Security Projects at Paladion. She wrote the chapter 'Secure Development Lifecycle'.

Siddharth Anbalahan is a senior application security engineer. He has developed anti-phishing toolkits to enable banks to detect phishing attacks in real time. Siddharth wrote the chapter 'Secure Coding Guidelines'.

CHAPTER 1: INTRODUCTION TO THE INTERNATIONAL INFORMATION SECURITY STANDARDS ISO27001 AND ISO27002

What is information security?

It is a truism to say that information is the currency of the information age. Information is, in many cases, the most valuable asset possessed by an organisation, even if that information has not been subject to a formal and comprehensive valuation.

IT governance is the discipline that deals with the structures, standards and processes that boards and management teams apply to effectively manage, protect and exploit their organisations’ information assets.

Information security management is the subset of IT governance that focuses on protecting and securing an organisation’s information assets. The international standard ISO27000 defines information security as the “preservation of confidentiality, integrity and availability of information; in addition, other properties, such as authenticity, accountability, non-repudiation and reliability can also be involved”.

Reasons to implement an information security management system (ISMS)

There are, broadly, four reasons for an organisation to implement an ISMS:

1. Strategic: a government or parent company requirement, or a strategic board decision, to better manage its information security within the context of its overall business risks.
2. Customer confidence: the need to demonstrate to one or more customers that the organisation complies with information security management best practice, or the opportunity to gain a competitive edge over its competitors, in both customer and supplier relationships.
3. Regulatory: the desire to meet various statutory and regulatory requirements, particularly around computer misuse, data protection and personal privacy.
4. Internal effectiveness: the desire to manage information more effectively within the organisation.

Although not explicitly stated in ISO27001, it should be remembered that while all four of these reasons for adopting an ISMS are good, having an ISO27001-compliant ISMS will not automatically confer immunity from legal obligations. The organisation will have to ensure that it understands the range of legislation and regulation with which it must comply, ensure that these requirements are reflected in the ISMS as it is developed and implemented, and then ensure that the ISMS works as designed.

The ISMS and regulation

Regulations and the law in each of the areas mentioned above are still evolving; they are sometimes poorly drafted, often contradictory (particularly between jurisdictions) and have little or no case law to provide guidance for organisations in planning their compliance efforts. It can be difficult for organisations to identify specific methods for complying with individual laws. In these circumstances, implementation of a best practice ISMS may support a defence in court that the management did everything that was reasonably practicable for it to do in meeting its legal and regulatory requirements. Of course, every organisation would have to take its own legal advice on issues such as this, and neither this book nor these authors provide guidance of any sort on this issue.

ISO/IEC 27001:2013 (‘ISO27001’ or ‘the Standard’)

Published by the International Organization for Standardization (ISO), this is the most recent, most up-to-date, international version of a standard specification for an information security management system. It is vendor-neutral and technology-independent. It is designed for use in organisations of all sizes (“intended to be applicable to all organisations, regardless of type, size and nature”¹) and in every sector (e.g. commercial enterprises, government agencies, not-for-profit organisations), anywhere in the world. It is a management system, not a technology specification and this is reflected in its formal title, which is Information technology – Security techniques – Information security management systems – Requirements. ISO27001 is also the first of a series of international information security standards, all of which have ISO2700X numbers.

ISO/IEC 27001:2013 is a specification for an ISMS. It sets out requirements and uses words like ‘must’ and ‘shall’. One mandatory requirement is that controls determined during the information security risk treatment should be compared “with those in Annex A [to] verify that no necessary controls have been omitted”.² Annex A to ISO/IEC 27001:2013 lists the 114 controls that are in ISO/IEC 27002:2013, follows the same numbering system as that standard and uses the same words and definitions.

As Annex A of ISO27001 states, “The control objectives and controls listed [below] are directly derived from and aligned with those listed in ISO/IEC 27002:20013”.³ ISO27002 provides substantial implementation guidance on how individual controls should be approached. Anyone implementing an ISO27001 ISMS will need to study both ISO27001 and ISO27002.

While ISO27001 mandates the use of ISO27002 as a source of guidance on controls, control selection and control implementation, it does not limit the organisation’s choice of controls to those in ISO27002. Clause 6.1.3 c) of ISO27001states:

The control objectives and controls listed in Annex A are not exhaustive and additional control objectives and controls may be needed.

ISO/IEC 27002:2013 (‘ISO27002’)

This standard is titled Information technology – Security techniques – Code of practice for information security controls. Published in September 2013, it replaced ISO/IEC 27002:2005, which has now been withdrawn. Prior to this, until August 2007, it was designated ISO17799.

ISO/IEC 27002:2013 is a code of practice. It provides guidance and uses words like ‘may’ and ‘should’. It provides an internationally accepted framework for best practice in information security management and systems interoperability. It also provides guidance on how to implement an ISMS capable of certification, to which an external auditor could refer. It does not provide the basis for an international certification scheme.

Definitions

The definitions used in both standards are standardised within ISO/IEC 27000. This ensures that consistent definitions are available for all ISO2700X standards.

Risks to information assets

An asset is defined in ISO27000 as “anything that has value to the organisation”. Information assets are subject to a wide range of threats, both external and internal, ranging from the random to the highly specific. Risks include acts of nature, fraud and other criminal activity, user error and system failure. Information risks can affect one or more of the three fundamental attributes of an information asset, its:

• availability
• confidentiality
• integrity.

These three attributes, commonly known as the ‘security triad’, are defined in ISO27000 as follows:

• availability: the “property of being accessible and usable upon demand by an authorised entity”, which allows for the possibility that information has to be accessed by software programs as well as human users;
• confidentiality: the “property that information is not made available or disclosed to unauthorised individuals, entities, or processes”;
• integrity: the “property of protecting the accuracy and completeness of assets” (i.e. preventing unauthorised changes, whether malicious or accidental).

Information Security Management System

ISO27000 defines an ISMS as:

Part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security. The management system includes organisational structure, policies, planning activities, responsibilities, practices, procedures, processes and resources.

An ISMS exists to preserve confidentiality, integrity and availability. It secures the confidentiality, availability and integrity of the organisation’s information and information assets, and its most critical information assets are those for which all three attributes are important.

Relationship between the standards

The working relationship between ISO27001 and ISO27002 needs to be very clear, as ISO27001 relies to such a substantial extent on ISO27002 that it mandates its use.

The link between the two standards was created in 1999, when BS7799 was first published as a two-part standard:

• Part 1 was a code of practice.
• Part 2 was a specification for an ISMS that deployed controls selected from the code of practice.

The original Part 2 specified, in the main body of the Standard, the same set of controls that were described, in far greater detail (particularly with regard to implementation) in Part 1. These controls were later removed from the main body of Part 2 and listed in an annex, Annex A.

This relationship continues today, between the specification for the ISMS that is contained in one part of the combined standard, and the detailed guidance on the information security controls that should be considered in developing and implementing the ISMS and which are contained in the other part of the combined standard. The addition of further standards in the ISO2700x series has not changed this fundamental relationship between ISO27001 and ISO27002; rather, it has expanded the range of guidance in ISO27002 to refer to those other standards where relevant.

Specification compared to a code of practice

ISO/IEC 27001:2013 is a specification for an ISMS. It uses words like ‘shall’. It sets out requirements.

A code of practice or a set of guidelines uses words like ‘should’ and ‘may’, allowing individual organisations to choose which elements of the standard to implement, and which not. A specification does not provide any such latitude.

Any organisation that implements an ISMS that it wishes to have assessed against ISO/IEC 27001 will have to follow the specification contained in the Standard.

As a general rule, organisa...

Table of contents

• Cover
• Title
• Copyright
• Preface
• About The Authors
• Acknowledgements
• Contents
• Chapter 1: Introduction to the International Information Security Standards ISO27001 and ISO27002
• Chapter 2: The ISO27001 Implementation Project
• Chapter 3: Risk Assessment
• Chapter 4: Introduction to Application Security Theats
• Chapter 5: Application Security and ISO27001
• Chapter 6: Attacks on Applications
• Chapter 7: Secure Development Lifecycle
• Chapter 8: Threat Profiling and Security Testing
• Chapter 9: Secure Coding Guidelines
• ITG Resources