Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Vulnerabilities in Golang

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for Carol Carol
October 27, 2022
53
0

Vulnerabilities in Golang

Vulnerabilities in Golang - Supply chain security

Avatar for Carol

Carol

October 27, 2022

More Decks by Carol

See All by Carol
Contribute to translate K8s Docs, Glossary and CNCF-whitepaper
Avatar for Carol krol3
1
110
DevSecOps em Aplicações, Cloud, Artefatos
Avatar for Carol krol3
2
150
Security in Cloud using Infrastructure as a Code (IaaS)
Avatar for Carol krol3
0
170
Compliance in Cloud Native
Avatar for Carol krol3
2
210
Security Opensource Tools in Cloud Native
Avatar for Carol krol3
1
220
Intro to Operators in Kubernetes
Avatar for Carol krol3
0
80
Container Security
Avatar for Carol krol3
4
320
Segurança em Kubernetes
Avatar for Carol krol3
1
220
Vault em Kubernetes
Avatar for Carol krol3
3
220

Featured

See All Featured
Introduction to Domain-Driven Design and Collaborative software design
Avatar for Kenny Baas-Schwegler baasie
1
740
Visual Storytelling: How to be a Superhuman Communicator
Avatar for David Neal reverentgeek
2
510
Done Done
Avatar for chrislema chrislema
186
16k
The AI Search Optimization Roadmap by Aleyda Solis
Avatar for Aleyda Solis aleyda
1
5.7k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
Avatar for Stéphanie Walter stephaniewalter
287
14k
sira's awesome portfolio website redesign presentation
Avatar for ElsiraPls elsirapls
0
220
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
33
1.6k
Exploring anti-patterns in Rails
Avatar for Elle Meredith aemeredith
3
320
Getting science done with accelerated Python computing platforms
Avatar for Jacob Tomlinson jacobtomlinson
2
180
[RailsConf 2023] Rails as a piece of cake
Avatar for Vladimir Dementyev palkan
59
6.5k
Pawsitive SEO: Lessons from My Dog (and Many Mistakes) on Thriving as a Consultant in the Age of AI
Avatar for David Carrasco davidcarrasco
0
120
The Limits of Empathy - UXLibs8
Avatar for Cassini Nazir cassininazir
1
310

Transcript

  1. © 2022 Aqua Security Software Ltd., All Rights Reserved Desmistificando

    as Vulnerabilidades em Golang

  2. 2 in/carolgv krol3 @krol_valencia

  3. 3 • Intro • Vulnerabilities • Secure Golang in the

    SDLC Agenda

  4. 4 Security is Hard Process, People and Technology

  5. 5 Container security? k8s security? Cybersecurity?

  6. 6

  7. 7 Who’ s to blame for the security breach ?

  8. 8 Maturity Model in my company – Agile process

  9. 9 Maturity Model in my company – Agile process

  10. 10 Applying Devops …. Where is the vulnerabilities in my

    SDLC? ….

  11. 11 Vulnerabilities

  12. 12 A flaw or weakness that may allow harm to

    occur to an IT system or activity.

  13. 13 Common Vulnerabilities and Exposures Is it an exploitable vulnerability?

  14. 14 Zero day CISO Chief Information Security Officer

  15. 15 Developing web applications … What are the common vulnerabilities?

  16. 16 Top 10 Open Web Application Security Project – Top

    10

  17. Go net library affected by critical ip address validation vulnerability

    https://www.bleepingcomputer.com/news/security/go-rust-net-library-affected-by-critical-ip-address-validation-vulnerability/ SSRF - Server side request forgery

  18. 18 Secure Golang in the Software Development Lifecycle (SDLC)

  19. 19 Go vulnerability check

  20. 20 Go vulnerability check

  21. 21 Go vulnerability check https://go.dev/security/vuln/

  22. 22 Before vulncheck

  23. 23 How scanners work? How to find CVEs?

  24. 24 Golang Dependency Management

  25. 25 go.mod go.sum

  26. 26 Lock file ? - Dependency Confusion

  27. 27 Auditable Checksum database https://go.dev/blog/module-mirror-launch

  28. 28 Open Source Vulnerabilities https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html

  29. 29 Consumer / Producer Code – Supply chain

  30. 30 scala-network/GUI-miner dstellitecoin/gui-miner Supply Chain Attacks

  31. 31 Supply Chain Attacks

  32. 32 Supply Chain Attacks

  33. 34 Supply Chain Attacks

  34. 35 Supply Chain Security Tool

  35. 36

  36. None

  37. 38 Applying Devops ….

  38. 39 New technology ... new security holes ... new security

    best practices.

  39. 40 Applying DevSecOps ….

  40. 41 Pipeline sample https://github.com/krol3/demo-go-xss/

  41. 42 Pipeline sample – Detecting xss

  42. 43

  43. © 2022 Aqua Security Software Ltd., All Rights Reserved Thanks

    in/carolgv krol3 @krol_valencia