Path to Self

Securing Code

Gary Robinson & Yan Huang

Uleska & CSIT

The Path to Self Securing Code

Gary Robinson

• Founder & Director at Uleska

• OWASP Europe Board Member

• Previously, Senior Application

Security Architect at CitiGroup

Dr. Yan Huang

• Sr. Engineer at the Center for

Secure Information

Technologies (CSIT)

• Part of Queens University

Belfast

• Sr. Engineer at CSITLabs

“Software development has accelerated and improved in almost

every aspect – apart from application security.”

“How can we change this?”

Fact

The Application Security industry already knows how to solve every software security issue.

The issue is in execution!

Inputs Outputs

Writing an Effective Source Code Scanner

Using Open Source tools to understand the application from it’s

code

www.csitlabs.com

Code Scanner Static Code Analysis

• Model Checking

• Control-flow analysis

• Data-flow analysis

• Symbolic analysis

• Information-flow analysis

Attack Surface Analysis

• Identify what functions and what parts of

the system you need to review/test for

security vulnerabilities

• Identify high risk areas of code that

require defence-in-depth protection Reducing Attack Surface

Java Source Code Scanner

• Traverses source code directory

• Enumeration of web interface attack surface

• GET/POST parameters

• Store information in a JSON format

JavaParser

• Java Open-Source Library

• LGPL License / Apache License

• The parser is extra lightweight, no dependencies

• Get an Abstract Syntax Tree (AST) from Java code

• Visitor design pattern

ANTLR (Another Tool For Language Recognition)

Language Grammar

Language Parser

AST

Tree Walker

What can we do with this

Project Model?

Using the power of a Project Model to Secure Software

Issues with current application

security

Project Model

Documentation printing engine

Real-time Risk Enumeration

Project Model

Data Flow engine

Real-time Data Flow

Enumeration

Project Models

Data/Artifact Recording Engine

Data/Artifact Enumeration

CVE, data type, library query

Project Model

Security Feature Code

Security Feature Automation Security Model

Project Model

Secure Configuration Generation

Secure Configuration

Automation Security Model

Project Model

Security Test Generation

Security Test Automation Security Model

Project Model

Security Code/Feature

Implementation Generation

Real-time Security

Implementation Security Model