High-Security Content Any content that the organization believes result in financial loss, negative brand reputation, or serious penalties should the asset be stolen or leaked Theft of a blockbuster feature before its first worldwide theatrical release Theft of home video content before its first worldwide street date of masters or screeners Security Controls The IT Governance Institute defines controls as “the policies, procedures, practices and organizational structures designed to provide reasonable assurance that business objectives will be achieved and undesired events will be prevented or detected and corrected.” Security controls are typically selected based on the classification of the asset, its value to the organization, and the risk of the asset being leaked or stolen. In order to mitigate identified risks, organizations are encouraged to implement controls commensurate to each specific risk. Such measures should also be evaluated periodically for their design and effectiveness based on the current threat environment. The best practices outlined in this document are based on guidance from the Open Web Application Security Project (OWASP), Cloud Security Alliance (CSA), PCI Data Security Standard, NIST 800-53, SANS Critical Security Controls, and ISO 27002.
Best practices are presented for each security topic listed in the MPAA Content Security Model using the following format: APPLICATION SECURITY CLOUD SECURITY DEVELOPMENT LIFECYCLE AUTHENTICATION AND ACCESS SECURE CODING AND VULNERABILITY MANAGEMENT ORGANIZATION AND MANAGEMENT OPERATIONS DATA SECURITY No. Security Topic Best Practice Implementation Guidance AS-2.7 Authentication & Access Use human verification tools such as CAPTCHA or reCAPTCHA with web applications Use CAPTCHA or reCAPTCHA to protect against bots
AS-3.8 Continued Secure Coding and Systems Manage cookies securely if cookies are used: Use the “Secure” attribute with cookies Use the “HttpOnly” attribute with cookies Use the “Domain” attribute with cookies Use the “Path” attribute with cookies Use non-persistent attributes (e.g., “Expires”, with cookies Avoid using the same cookie names for different paths or domain scopes inside the same application AS-3.9 Implement controls to prevent SQL injection. Use prepared statements Use stored procedures Escape all user-supplied input Minimize the privileges assigned to every database account in the environment Validate using whitelisting AS-3.10 Implement controls to prevent unvalidated URL redirects and forwards. Avoid using redirects and forwards Do not allow the user to input the URL if redirects must be used Ensure the supplied URL is valid if user input cannot be avoided Sanitize input using whitelisting if URL input must be allowed AS-3.11 Implement controls to prevent connections from anonymity networks (e.g., Tor, Freenet, Netshade), if possible. Refuse all connections to any part of the application, if the IP address of the user is anonymized, if possible AS-3.12 Implement controls to prevent IP address leakage. Prevent the leakage of user IP addresses to third party applications (e.g., social media)
Penetration Testing A penetration test, or the short form pen test, is an attack on a computer system with the intention of finding security weaknesses, potentially gaining access to it, its functionality and data. Rapid Application Development (RAD) application development is both a general term used to refer to alternatives to the conventional waterfall model of software development as well as the name for James Martin's approach to rapid development. In general, RAD approaches to software development put less emphasis on planning tasks and more emphasis on development. In contrast, the waterfall model emphasizes rigorous specification and planning. RFC 1918 In the Internet addressing architecture, a private network is a network that uses private IP address space, following the standards set by RFC 1918 for Internet Protocol Version 4 (IPv4) and RFC 4193 for Internet Protocol Version 6 (IPv6). These addresses are commonly used for home, office and enterprise local area networks (LANs), when globally routable addresses are not mandatory, or are not available for the intended network applications. reCAPTCHA reCAPTCHA is a user-dialogue system originally developed by Luis von Ahn, Ben Maurer, Colin McMillen, David Abraham and Manuel Blum at Carnegie Mellon University's main Pittsburgh campus. reCAPTCHA was acquired by Google in September 2009. Like the CAPTCHA interface, reCAPTCHA asks users to enter words seen in distorted text images onscreen. By presenting two words, it protects websites from bots attempting to access restricted areas and helps digitize the text of books. Risk Assessment The identification and prioritization of risks that is performed to identify possible threats to a business. Risk Management The identification, analysis and mitigation of risks through risk assessment and the implementation of security controls. Router Device software and hardware are tailored to the tasks of steering and forwarding information. SANS Critical Security Controls The Twenty Critical Security Controls for Effective Cyber Defense (commonly called the Consensus Audit Guidelines or CAG) is a publication of best practice guidelines for computer security. The project was initiated early in 2008 as a response to extreme data losses experienced by organizations in the US defense industrial base. The publication can be found on the website of the SANS Institute.
URL A uniform resource locator (URL) is a reference to a resource that specifies the location of the resource on a computer network and a mechanism for retrieving it. A URL is a specific type of uniform resource identifier (URI), although many people use the two interchangeably. A URL implies the means to access an indicated resource, which is not true of every URI. URLs occur most commonly to reference web pages (http), but are also used for file transfer (ftp), email (mailto), database access (JDBC) and many other applications. U.S. Department of Defense 5220.22-M (NISP Operating Manual) DoD 5220.22-M, or the NISP Operating Manual, establishes the standard procedures and requirements for all government contractors, with regards to classified information. NISP or the National Industrial Security Program, is the nominal authority (in the United States) for managing the needs of private industry to access classified information. Vault An area that is dedicated to storing physical media with content. Virtual Area Network (VLAN) Computer network having the attributes of a LAN / Internal Network but not limited to physical location. Virtual Private Network (VPN) Computer network that allows users to access another larger network. Waterfall The waterfall model is a sequential design process, used in software development processes, in which progress is seen as flowing steadily downwards (like a waterfall) through the phases of conception, initiation, analysis, design, construction, testing, production/implementation and maintenance. Watermarking The process of (possibly) irreversibly embedding information into a digital asset. Web Application Security Web application security is a branch of Information Security that deals specifically with security of websites, web applications and web services. Whitelisting A whitelist is a list or register of entities that are being provided a particular privilege, service, mobility, access or recognition. Entities on the list will be accepted, approved and/or recognized. Wide Area Network (WAN) Computer network covering a broad area (e.g., a company). Work in Progress (WIP) Any good that is not considered to be a product.