http://coldfusion.com logo
Join Slack
Powered by
I know maybe its a lot to ask from an opensource p...
# lucee
g
I know maybe its a lot to ask from an opensource project but does Lucee have some kind of security certification ?
b
Hey Gareth, from the way you phrased the question, it seems like you are asking if the Lucee runtime is certified for security, is that correct? If so, any security flaws are typically the result of poor development, not Lucee. But the same thing is true for Adobe ColdFusion Enterprise, right? If you are referring to certification training in the area of security, I believe Adobe offers that, but the concepts can be applied to any environment. If you need certification, you are likely to be required to use a third-party auditor. Whether you use open source or not. Hope that helps.
g
Assuming I have my own security audit process, what does lucee have, for its internal runtimes? What would I tell an auditor if they were to ask me Adobe vs Lucee
q
For our audits, we claim the runtimes of Tomcat and the JDK version. We also have paid for a security audit of the Lucee codebase plus our own code. This has let us pass PCI-DSS, HIPAA, ITAR (limited) and certain DOD specs.
🎯 2
But 90% of the audits I come across are more concerned with how you deploy your apps, patching, updates, and following certain best practices with interacting with user-submitted content.
b
I'm not aware of any security audits you perform on just a language/runtime per se. I mean, you can hire a pentester to look for holdes in software-- which has happened for Lucee. They didn't hire the pentester, Apple did and Apple was using Lucee and the pentester foud stuff that Lucee fixed. But there isn't a "certification" that comes with that.
Generally, if you want to know if your app can "pass" a scan, then you stand up your app, point a scanning software at it, and see what the report says.
Usually, the questions to ask about a particular software, is what the security remediation process looks like for that software. Do they have a dedicated method for reporting security issues and are they handled promptly.
Lucee process for handling security vulns isn't as fleshed out as Adobe's, which has the entire PSIRT team behind it, and Lucee doesn't tend to create CVEs (unless the pentester in question creates them)
But Lucee does generally fix security issues quickly, even though they're typically not super keen on communicating the details.
b
Hey Brad, thanks for mentioning the Apple thing. Here is an article that talks about it... https://projectdiscovery.io/blog/hello-lucee-let-us-hack-apple-again
b
Yep, that's the guy
He's a smart cookie
I don't know how much Apple paid him, but I believe he found vulns in both Lucee and Adobe
He dug very deep into the engine
That sort of pentesting is infinitely more useful than the cute little automated web-based pentest "scans" you can perform, but I'm sure he wasn't cheap either.
q
@bdw429s -- when you start to deal with DOD and certain ITAR deployments, you do need to apply for certifications for the entire stack. Some of the consumer ones, like PCI-DSS you need to certify the final deployment (sometimes QSAs or ISAs will want code reviews of the products in the stack or certifications from the banks that certain software is already tested).
Open in Slack
PreviousNext
Powered by