OWASP software and data integrity failures (noun) [Word Notes]

Summary

Podcast Summary: Hacking Humans Episode: OWASP Software and Data Integrity Failures (noun) [Word Notes]
Host/Author: N2K Networks
Release Date: June 10, 2025

---

Introduction

In this episode of Hacking Humans, hosted by N2K Networks, the focus centers on OWASP Software and Data Integrity Failures—a critical topic in the realm of cybersecurity. The discussion delves into the intricacies of software and data integrity, exemplified by high-profile cyber attacks, and explores robust mitigation strategies recommended by OWASP (Open Web Application Security Project).

---

Understanding OWASP Software and Data Integrity Failures

Speaker B begins by unpacking the acronym OWASP, breaking it down as follows:

• O: Open
• W: Web
• A: Application
• S: Security
• P: Project

He further explains that Software refers to the instructions that tell a computer what to do, while Data pertains to information stored on a computer. Integrity Failures involve support structures that are supposed to be reliable but turn out to be compromised due to faulty code and inadequate protection against unauthorized changes.

Notable Quote:

"Software and data integrity failures happen when an application relies upon plugins, libraries, or modules from untrusted resources, repositories, and content delivery networks."
— Speaker B [01:30]

Historical Context and OWASP's Evolution:

• David Wickers and Jeff Williams of Aspect Security first highlighted top software security coding issues in 2003, which later evolved into the OWASP Top 10—a definitive guide outlining the most critical security concerns for web applications.
• As of 2021, OWASP introduced a new category: Software and Data Integrity Failures, positioned at number 8 on the list.
• Andrew van der Stock, OWASP Foundation Executive Director and Top 10 Project Leader, oversees the international team of security professionals driving these initiatives.

---

The SolarWinds APT29 (Nobelium) Attack: A Case Study

OWASP experts cite the 2020 SolarWinds compromise as a quintessential example of software and data integrity failure. In this incident:

• APT29, also known as Nobelium, infiltrated the SolarWinds network.
• The attackers accessed the company's code repository and embedded a Remote Access Trojan (RAT) into the SolarWinds Orion product, a widely used network management system.
• Approximately 18,000 customers inadvertently downloaded the tainted update, propagating the RAT across numerous systems.

Notable Quote:

"The main idea is to protect code and data sources from unauthorized and undetected change."
— Speaker B [03:45]

---

OWASP’s Mitigation Strategies

To counteract such sophisticated supply chain attacks, OWASP recommends the following five mitigation tactics:

1. Code Signing:

   • Sign all internally developed software.
   • Ensure that commercial and open-source software undergoes the same process.

2. Trusted Repositories:

   • Use only code libraries from verified and trusted sources.

3. Vulnerability Scanning:

   • Regularly scan both internally developed and open-source software for known vulnerabilities.

4. Review Processes:

   • Establish stringent review procedures for any code and configuration changes.

5. Segregation and Access Controls:

   • Enforce strict segregation, configuration, and access controls within your continuous integration and continuous deployment (CI/CD) pipeline.

Notable Quote:

"None of these mitigation strategies, if implemented by any of the 18,000 SolarWinds customers, would have protected them from the APT29 attack."
— Speaker B [04:30]

Despite the robust recommendations, the SolarWinds attack underscores the challenges of supply chain security, highlighting the importance of a zero trust strategy that minimizes permissions and access privileges related to critical products like Orion.

---

SolarWinds’ Response: Insights from Tim Brown

A pivotal segment features Tim Brown, SolarWinds' Chief Information Security Officer (CISO), detailing the immediate response following the APT29 attack notification. Recorded during an interview hosted by MJ Shore of CompTIA ISAO in November 2021, Tim Brown recounts the urgent measures taken in the critical first 24 hours.

Key Points from Tim Brown:

• Immediate Notification and Coordination:

  • On December 12th, a Saturday, SolarWinds was alerted by Kevin Mandia about the compromised code.
  • Rapid communication ensued with the CTO of FireEye, another target of the attack.

• Assembling the Response Team:

  • A diverse team, including legal counsel from Piper and forensic experts, was mobilized swiftly.
  • Collaboration with CrowdStrike facilitated a comprehensive investigation.

• Establishing a War Room:

  • By Sunday morning, a dedicated war room was operational, strategizing the response.
  • As a public company, prompt disclosure was imperative, necessitating the filing of a 10-K report.

Notable Quote:

"This was all on Saturday, as we're going through stuff first on the phone. Sunday morning we were all in the office and started in a war room just working through all of the details because as a public company on Monday morning or Sunday night, we needed to get information out to essentially the street."
— Tim Brown [05:45]

Tim emphasizes the unprecedented speed and coordination required to manage the fallout from the attack, illustrating the high-stakes environment of responding to a major security breach.

---

Conclusion

This episode of Hacking Humans provides a comprehensive examination of OWASP's Software and Data Integrity Failures, using the SolarWinds APT29 attack as a case study to highlight vulnerabilities in the software supply chain. By outlining OWASP’s mitigation strategies and featuring firsthand insights from SolarWinds' CISO, the podcast underscores the critical importance of robust security practices and proactive defense mechanisms in safeguarding against sophisticated cyber threats.

For organizations building their own software, OWASP’s guidelines serve as essential practices to prevent unauthorized and undetected changes, thereby enhancing the integrity and security of their applications and data.

---

This summary was crafted to encapsulate the key discussions and insights from the podcast episode, providing a detailed overview for those who have not listened to the original content.

Transcript

[A]

You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor, ThreatLocker keeping your system secure shouldn't mean constantly reacting to threats. ThreatLocker helps you take a different approach by giving you full control over what software can run in your environment. If it's not approved, it doesn't run. Simple as that. It's a way to stop ransomware and other attacks before they start without adding extra complexity to your day. See how ThreatLocker can help you lock down your environment at www.threatlocker.com.

[B]

The word is OWASP Software and data integrity Fail spelled O for open W for Web A for application S for security P for project software for instructions that tell a computer what to do Data for information stored on a computer and integrity failures for support structures that are supposed to be sound that turn out to be faulty code and data repositories that don't protect against unauthorized changes. Example Sentence Software and data integrity failures happen when an application relies upon plugins, libraries, or modules from untrusted resources, repositories, and content Delivery networks, or CDNs. Origin and context David Wickers and Jeff Williams, working for Aspect Security, a software consultant company, published an education piece in 2003 on the top software security coding issues of the day that eventually turned into the OWASP top 10, a reference document describing the most critical security concerns for Web applications. Today, OWASP is an international team of security professionals that led by the foundation executive director and top 10 project leader Andrew van der Stock. In 2021, the committee created a new category called Software and Data Integrity Failures and listed it at the number 8 position. The main idea is to protect code and data sources from unauthorized and undetected change. OWASP pundits have cited the 2020 SolarWinds compromise as the perfect example of this kind of failure. In that attack campaign, hacker group APT29, also known as Nobelium, compromised the SolarWinds network, found the company's code repository, and inserted a Remote Access Trojan, or RAT, into the SolarWinds Orion product, a commercial network management system. When some 18,000 customers downloaded the next software update for the Orion product, they also downloaded the rat. OWASP recommends several mitigation tactics to defeat this kind of attack vector. 1. Sign internally developed software and insist commercial and open source software that you use does the same. 2. Verify that you're only using code libraries from trusted repositories. 3. Scan internally developed and open source software for known vulnerabilities. 4. Establish a review process for code and configuration changes. And finally five enforce segregation, configuration and access controls on your continuous integration continuous deployment pipeline. In the Aftermath of the APT29 attacks, the SolarWinds CISO Tim Brown rolled out a new software design strategy he called Secure by Design that incorporates many of the OWASP recommendations. But I want to be clear here. None of these mitigation strategies, if implemented by any of the 18,000 SolarWinds customers, would have protected them from the APT29 attack. From their view, the attack is a supply chain attack from a trusted vendor. Their best bet to reduce the probability of supply chain risk is to pursue a robust zero trust strategy by severely limiting permissions and access by the Orion product. On the other hand, the OWASH recommendations are for those organizations who build their own software intended for both external and perhaps internal use, like Solar Winds. Nerd reference in November 2021, MJ Shore, the senior Vice President and Executive Director at the CompTIA ISAO, hosted Tim Brown, the SolarWinds CISO, to discuss the APT29 attack. This clip is Tim describing his response in the initial hours after the attack notification.

[C]

December 12th. So it was a Saturday. Our CEO got a from Kevin Mandia and said, hey, we believe that you've shipped tainted code. Of course, I got a call very quickly after that and then got a call with the CTO for FireEye. We went through details very quickly. We realized that yes, that's the case. So we started marshaling people together and started working on kind of the response. This one was different in that we didn't need to do a lot of research to determine, hey, this was real, right? It was like, boom, got it. It's real. We started pulling the right people together on Saturday and the right people together kind of interesting, right? So that include our legal team. So we have PLA Piper as a external legal counsel. Learned afterwards that they're the largest legal firm in the world, but they came in with their forensics team. With them we brought in CrowdStrike to start really a, you know, macro investigation of the environment and start doing that. So this was all on Saturday, as we're going through stuff first on the phone. Sunday morning we were all in the office and started in a war room just working through all of the details because as a public company on Monday morning or Sunday night, we needed to get information out to essentially the street. So a 10k had to get filed. So timelines were just really compressed. FireEye was planning to be public with their information on Sunday, so there was a lot to do in those first first 24 hours.

[B]

Word notes is written by Nyla Genoe, executive produced by Peter Kilpe and edited by John Pettrick and me, Rick Howard. The mix, sound design and original music have all been crafted by the ridiculously talented Elliott Peltzman. Thanks for listening.

[A]

And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate darknet exposure [e-mail] cyberwire and see what attackers already know. That's spycloud.com cyberwire.