1 / 44

Continuous Application Security “We’re Pulling Out All the Stops” Jeff Williams @ planetlevel

Continuous Application Security “We’re Pulling Out All the Stops” Jeff Williams @ planetlevel. Factories Instrument Everything. Programmable Controllers. Connectors and Adapters. Live Dashboard. Identify problems before they become PROBLEMS. The Phoenix Project.

moriah
Download Presentation

Continuous Application Security “We’re Pulling Out All the Stops” Jeff Williams @ planetlevel

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Continuous Application Security“We’re Pulling Out All the Stops”Jeff Williams@planetlevel

  2. Factories Instrument Everything

  3. Programmable Controllers

  4. Connectors and Adapters

  5. Live Dashboard Identify problems before they become PROBLEMS

  6. The Phoenix Project

  7. What Is Continuous AppSec? What: The rightdefenses for everyapplication are… • Present • Correct • Used Properly How: Portfolio and enterprise security controls are verified… • Continuously • Automatically • In real time

  8. Building Continuous AppSec Your IT Organization… Continuous AppSec Analytics DEV CI TEST QA STAG SEC OPS Transform our existing tools into SENSORS 2) Instrument entire software organization 3) Collect big data security analytics Manual Static JUnit Dynamic Interactive

  9. Check Your Headers https://cyh.herokuapp.com/cyh

  10. Initial Sensors • CheckYourHeaders • http://cyh.heroku.com/cyh • OWASP Dependency Check • http://www.owasp.org/index.php/OWASP_Dependency_Check • Nmap • http://nmap.org • Sslyze • https://github.com/iSECPartners/sslyze • OWASP ZAP • http://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project • Minion • Gauntlt

  11. Results/Demo • I hate presentations that wait until the end to show me the result. • If you hate it, please feel free to check your email or play angry birds • If you like it, I’ll give you the details…

  12. Monkey Architecture Sensors Speak Evil! See Evil! Hosts Dashboard Hosts Monkey Server Hosts Digesters Hear Evil!

  13. What’s In an AppSec Sensor

  14. Sensor Launcher and Config? • Launcheris a small script that runs tool with specified config • Config is stuff like • Hostname • Target URLs • Perhaps full sitemap • Credentials • Tool options • Recursive • Output format • Destination directory • Etc…

  15. Managing Sensors with Puppet • class depcheck{ • package { 'openjdk-7-jdk':ensure => installed, } • exec { "/usr/sbin/update-alternatives • --set java /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java": } • exec { "/usr/sbin/update-alternatives • --set javac /usr/lib/jvm/java-7-openjdk-amd64/bin/javac": } • … check bash • ssh_authorized_key { 'monkey': ….. } • … check permissions • file { "/home/monkey/agentmonkey/TOOLS/dependency-check-1.1.4-release": •         source => "puppet:///modules/depcheck/dependency-check-1.1.4-release", • recurse => true,} • file { "/home/monkey/agentmonkey/SCRIPTS/depcheck.sh": •         source => "puppet:///modules/depcheck/depcheck.sh", … } • cron  { "cronDepcheck": • command => "/home/monkey/agentmonkey/SCRIPTS/depcheck.sh", • user    => monkey, • minute  => 0, } • }

  16. Handling Results Monkey Server ARMS Server (with Sensors) rsync Raw Sensor Data

  17. Standardizing the Data *Currently CSV

  18. Digesters DIGESTED Python, XPath, etc… RAW

  19. Monkey Format • Timestamp – April 14, 2014 10:10 AM EDT • IPAddress – 192.168.2.234 • Hostname – webgoat.internal • AppName – WebGoat • URL – http://webgoat.internal/WebGoat/attack • LOC – /filepath/Foo.java @ 123 • Tool – DependencyCheck • Category – Platform • Subcategory – Libraries • TestName – CheckCVE • TestDesc – Verify library is… • TestResult – Library has CVE-2011-124 • ASVS – V6.2 • CWE – CWE-2013-03 • Security – 40 (0 to 100) • Coverage – OOS • Confidence – 100

  20. Initial Categories

  21. Dashboards Monkey has a self-organizing dashboard Sensors report their own category, subcategory, and testname Cat: Transport SubCat: HeartBleed TestName: heartbleed

  22. HeartBleed

  23. Designing a HeartBleed Sensor • Experiment Style • Environment • Analysis Technique • Data Sources • Negative • Dev • Manual • Code  • Positive • CI • SAST • HTTP  • Sampling • Test • Passive • Configuration • Intelligence • QA • IAST • Data Flow  • Staging • DAST • Control Flow • Security • Platform • JUnit  • Prod • Connections • Choose based on: • Speed • Accuracy • Feedback • Scalability • Ease of Use • Cost

  24. Adding HeartBleed to Monkey • Download scanner • Realize it’s written in Go • Download Go compiler • Add Sensor to Monkey (20 minutes) • Build Digester (10 minutes) • Continuous monitoring enabled in 1 hour! • And then I realized my mistake…

  25. The Better Way to Test for HeartBleed

  26. Sensors? What sensors should we add next?

  27. What’s In Your Expected Model? Expected Requirements Threat Model Abuse Cases Policy Standards… • There is no security without a model

  28. What Are You Actually Testing? Actual Pentest Code Review Tools Arch Review …

  29. Unfortunately… Expected Actual Not being tested (aka RISK) Doesn’t need testing (aka WASTE)

  30. Are You Secure? Secure?

  31. Aligning Sensors with Business Concerns • Fraud • Availability

  32. Continuous Application Security! Expected Actual Translate “expected” into sensors Application Portfolio A A A New Threats, Business Priorities A A A A A A A A A A A A A A A Application security dashboards

  33. How to Get Started

  34. Hit me up on twitter @planetlevel

  35. Aspect 2013 Global AppSec Risk Report

  36. Access Control Intelligence Sensor

  37. Known Vulnerable Libraries Sensor Run DependencyCheckduring every build (and do a build once a month even if nothing changed) • Libraries  • SAST   • Negative  • CI

  38. CSRF Defense Sensor • Run tests through ZAP • ZEST to check CSRF Token • Get results via ZAP REST API • HTTP  • Passive   • Positive  • QA

  39. A Junit Sensor?

  40. Injection Sensors Use code instrumentation tools for DFA vulnerabilities • Data Flow  • IAST   • Negative  • Dev

  41. Architecture, Inventory, and More… • What would you like to gather from all your applications? • Inventory? Architecture? Outbound connections? Lines of code? Security components? • All possible…. and all at devops speed and portfolio scale

  42. Security Intelligence Sources Data Flow Backend Connections HTTP Traffic Vulnerability Trace Control Flow Libraries and Frameworks Configuration Data

  43. Enterprise Controls Dashboard

  44. Basic Infrastructure DEV CI TEST QA STAG SEC OPS Sensor Puppet rsync Raw Results

More Related