Upgrade to Pro — share decks privately, control downloads, hide ads and more …

What is Rugged all about?

What is Rugged all about?

goto; Chicago : talk about Rugged, DevOps, Security.

Matt Konda

June 01, 2016
Tweet

More Decks by Matt Konda

Other Decks in Technology

Transcript

  1. He would want me to tell you • Software is

    eating the world. • DevOps and Security is a rare opportunity. • Makes security positive, cultural+ • Show the Rugged Manifesto • Honey Badger = Security + DevOps … • Empathy, Empathy, Empathy • Bridge communities!
  2. He would want me to emphasize • Instrumentation • Be

    Mean To Your Code • Complexity is the Enemy • Change Management (Automation through tooling) • Empathy (Did I say that yet?)
  3. He would want me to mention • By updating our

    software (and it’s dependencies) we can address a huge amount of attack surface. • DevOps should be good at this. • Empathy (Did I say that yet?)
  4. Introduction 1997 2006 2014 Consultant Engineer Software Architect Director of

    Engineering Rabble Rouser: Perl Java Applet C++ J2EE J2EE
 Spring Analytics Certificate Authority Vulnerability Scanner Penetration Test Manager Pricing Retail Banking Manufacturing Pharma Healthcare Research Ruby Rails Chicago BSides 2011, 2012 Defcon Skytalk OWASP Chicago, MSP 2013 AppSec USA 2012, 2013 ChicagoRuby 2013 Secure 360 Lone Star Ruby 2013 WindyCityRails 2013 Chicago JUG 2014 RailsConf 2014 Converge 2014 Chicago Coder Conference 2015 MS in CS Founder Consultant Agile Clojure Graph Database Trying to hack a business model that succeeds while helping developers. Domains: Projects: DevOps / Automation Training Coaching Code Review Plugged in to SDLC Consulting Assessments @mkonda [email protected] DevOps Growing
  5. I recognize that software has become a foundation of our

    modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged.
  6. I recognize that software has become a foundation of our

    modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged.
  7. I recognize that software has become a foundation of our

    modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged.
  8. This year, organized crime became the most frequently seen threat

    actor for Web App Attacks. Source: Verizon 2015 Data Breach Investigations Report
  9. SELECT "orders".* FROM "orders" WHERE (rewards_code = 'a') union select

    id, 'product', 1, 1, 'cc', 'cvv', 'expiration', email as first_name, encrypted_password as last_name, created_at, updated_at, id, 'reward' from users; --')
  10. Getting Rugged? Train. Search for string concatenation: +, append prefer

    parameterized queries! Do code review. Use static analysis. Use web app scanning.
  11. Getting Rugged? Train. Search for {{{, innerHTML, .raw, utext, etc.

    Do code review. Use static analysis. Use web app scanning.
  12. Security in the SDLC • Building software is a process.

    • The best way to make software secure is to make security part of the process. • There are many ways to do this - none is perfect. • Find a way to make the security fit your process.
  13. Story Continuous Delivery: The Unit of Work is a Story

    Requirements Design Code Test Security Requirements Security Unit Tests Exploratory Testing Static Analysis on Commit Code Review Threat model / attack surface Checklists Understand Dependencies
  14. A detailed example: • Let’s say a feature is being

    developed • Then devs and testers are checking a new feature • Let them browse through an attack proxy (like Burp or ZAP) in passive mode • At night or when the system is quiet, use the browsing pattern as seeds for overnight attacks
  15. continuous delivery Since its easy to provision we can do

    security testing safely in a new env.
  16. continuous delivery Another principle of software delivery: build security in!

    Done means secure! Empowered to do security right!
  17. Commit • Security Unit Tests • Static Code Analysis (Pipeline)

    • Security Requirements • Check Dependencies • Code Review • Checklists
  18. Deploy • Scripted Provisioning / Built in Change Control •

    Provisioning Auditing (Chef Audit, hardening.io) • Gauntlt
  19. Periodic • Full app analysis (static, manual pen test) •

    Secure Development Training • Baseline Security Requirements Review • ASVS Review • Data Science on Results
  20. <vulnerability> <name>CVE-2013-2251</name> <cvssScore>9.3</cvssScore> <severity>High</severity> <cwe>CWE-20 Improper Input Validation</cwe> <description>Apache Struts

    2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.</description> <references> <reference> <source>BID</source> <url>http://www.securityfocus.com/bid/64758</url> <name>64758</name> </reference> …