Security Manager's Journal: Hashing out secure applications
In-house developers show themselves to be woefully behind the times when it comes to security via authentication
Computerworld - My company has a small team of software developers, who program applications for the business. Nothing too fancy. Sometimes the applications they produce are meant only for system-to-system communication, but more often they are intended to extract data from a system or database and present it to end users in a readable, Web-friendly format. It's my job to make sure those applications are secure. I do this by checking their software with a code scanner, testing their application with vulnerability analysis and penetration-testing tools, and using my eyes to look at the lines of code they've written.
One of the first things I look at when I'm reviewing a new piece of software is authentication. Does it require a username and password? When there is a need for separate user profiles, or users have different levels of authorization to access data in the system, authentication is usually required. And more often than not, that is the case with the Web applications produced by our developers. And of course, the developers don't usually consult with me before they write their code, so any problems I find result in delays and resentment, because when a developer produces an application that does not perform authentication securely, I have to send it back to do that part over.
This happened to me last month. A software developer coded an authentication algorithm using the MD5 hash. MD5 is one of many hashing algorithms available today. Hashing is like encrypting. With the right key, you can decrypt an encrypted value, but you're not supposed to be able to "decrypt" a hash. A hash is like one-way encryption -- you can compare two hashed values, but you shouldn't be able to derive the original data from the hash. That's why hashes are used in password-checking algorithms. The idea is simple: Usernames are stored in a database, but instead of storing the users' passwords there as well, a hash of the password is stored. When the user types his username and password into the application, the username is compared with what's in the database, and the entered password is hashed, and the hash value is compared to what's in the database. This is a tried-and-true technique. So what is wrong?
Encryption and hashing algorithms have a shelf life. And the MD5 hashing algorithm is way past its expiration date.
To find out about how secure various algorithms are, you can rely on the U.S. government. Well, you used to be able to rely on the government. As I wrote in my last column, the National Institute of Standards and Technology shut down its website before I was able to look up the following information, and rather than proceeding to write without facts, I opted to wait until the government reopened and I could reach the NIST website again. Now that the site is back up, I've been able to get my facts straight.
More by J.F. Rice
- Security Manager's Journal: Trapped: Building access controls go kablooey
- Security Manager's Journal: We manage our threats, but what about our vendors?
- Security Manager's Journal: With Heartbleed, suddenly the world is paying attention to security
- Security Manager's Journal: A rush to XP's end of life
- Security Manager's Journal: Security flaw shakes faith in Apple mobile devices
- Security Manager's Journal: Cyberattacks just got personal
- Security Manager's Journal: Target breach unleashes fresh scams
- Security Manager's Journal: Giving thanks for SIEM
- Security Manager's Journal: Hashing out secure applications
- Security Manager's Journal: Why the shutdown is like the cloud
- Securing Mobility, From Device to Network At one time, the process of managing and securing mobile devices and applications was fairly straightforward. Most organizations worried about one application (email)...
- Data Protection eGuide In this eGuide, CSO and sister publications IDG News Service, Computerworld, and CIO pull together news, trend, and how-to articles about the increasingly...
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!