maginot line - amazon web services · 1 © 2017 veracode inc. acquired by ca technologies© 2017...

© 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES1 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES

Maginot LineCommon AppSec Anti-Patterns

© 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES2 @PeteChestna

Who am I?

• 27+ Years Software Development Experience

• 12+ Years Application Security Experience

• Certified Agile Product Owner and Scrum Master

• At current employer since 2006• From Waterfall to Agile to DevOps• From Monolith to MicroService• Consultant on DevSecOps best practices

• Fun Fact: I love whiskey!• Tell me where to drink local whiskey


Agenda

• InfoSec vs. AppSec maturity

• Common anti-patterns

• Practical solutions

© 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES4 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES4 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES

InfoSec vs. AppSec


InfoSec


AppSec

© 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES7 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES7 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES

AppSec Anti-Patterns


AP: The Goal?


AP: The Goal?

Find TrackDevelop Fix Re-test

Develop

Bug

NoBug Develop Develop Develop


AP: The Goal?


Measurement is Key


Training and Awareness


Train Yourself on the Process


Help them fix what they find


AP: Security Mandate


Relationships


Mutual Accountability


AP: What Open Source?

Healthcare Provider

How: Targeted a flaw in OpenSSL, CVE-2014-0160, better known as Heartbleed

Result: The theft of Social Security Numbers and other personal data belonging to 4.5 million patients

Financial Institution

How: Hackers exploited a known vulnerability in an open source component

Result: Social Security Numbers and personal data for more than 143 million Americans stolen. Three executives lose their jobs.


Built Mostly from Components

80% to 95% of modern apps consist of assembled components.

Proprietary Code

Open Source

Open Source

Open Source

Open Source

Open Source

Open Source

Open Source

Open Source

Open Source

Open Source

Open Source

Open Source


Open Source – More or Less Secure?

• Defect rate in open source is no better or worse than first party code

• The difference is that developers never revisit

• Integrated and abandoned

• It’s not a problem until a vulnerability is discovered


Integrated and Abandoned Explicitly -Struts


Integrated and Abandoned Implicitly –Apache Commons Collections


Component Family Tree –Apache Commons Collection (ACC) 3.2.1

Apache Commons Collections 3.2.1

(1290)

Apache Commons BeanUtils (1348)

Spring Web (1779)

Spring Framework (501)

...

Core Hibernate ORM Functionality (1185)

Spring TestContextFramework (3007)

Spring Web MVC (1314)

...

Apache Commons Configuration (803)

Hadoop Core (399)

SonarQube Plugin API (262)

...

Apache Velocity (748)

Spring Context Support (916)

SnakeYAM (519)

...

Within 5 generations, 80,323components contain ACC 3.2.1

The components are then used in millions of software applications

>26% of software applications had ACC 3.2.1

50.3% of software applications had some vulnerable version of ACC


AP: What Open Source?Strategy: Security Champions


AP: What Open Source?Strategy: Assess MTTR

• How quickly can you ship a code change?

• For each application:– Methodology– Test automation– Time to deploy– CI/CD?– Minutes/Hours/Days/Weeks?


AP: What Open Source?Strategy: OSS Incident Response Plan

• Monitor for new CVEs

• Triage CVE based on:– Database of applications– CVSS score– Known exploit

• Disseminate to champions– Vulnerability assessment– Remediation plan– Notification of remediation or

mitigation


Conclusions

maginot line - amazon web services · 1 © 2017 veracode inc. acquired by ca technologies© 2017...

Documents