PyCaribbean 2019: First steps into security engineering

http://pycaribbean.com/talk/first-steps-into-security-engineering/

Experience with security is a useful and even profitable skill for every technical and non-technical employee in IT. Contrary to common stereotypes, security is far more than black hoodies, math and crypto. It's also humans and communication skills. Attendees of my talks regularly ask me how to get started. Let me introduce you to diverse areas of info sec and point you to books, online courses, talks, and other resources to get you started.

Transcript

1. First steps into security engineering PyCaribbean 2019 / Santo Dominga 2019-02-16 Christian Heimes Principal Software Engineer christian@python.org / cheimes@redhat.com @ChristianHeimes
2. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 2 Who am I? • from Hamburg/Germany • Python and C developer • Python core contributor since 2008 • maintainer of ssl and hashlib module • Python security team
3. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 3 Professional life • Principal Software Engineer at Red Hat • Security Engineering • FreeIPA Identity Management • Dogtag PKI
4. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 4
5. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 5 Dane Hillard https://twitter.com/easyaspython/status/1096749245275820037
6. Agenda & Goals
7. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 7 This talk is • opinionated • subjective • biased • incomplete • edutainment Disclaimer
8. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 8 1. think 2. learn
9. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 9
10. Motivation Why should you care?
11. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 11 https://www.cnet.com/news/verizon-and-yahoo-agree-to-cut-4-billion-deal-by-350-million/ https://www.theguardian.com/technology/2016/dec/14/yahoo-hack-security-of-one-billion-accounts-breached
12. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 12 https://www.theguardian.com/technology/2017/aug/31/hacking-risk-recall-pacemakers-patient-death-fears-fda-firmware-update
13. Propositions & Statements
14. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 15 Security is a feature. Security is a selling point.
15. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 16 Attackers just need one vulnerability, defenders need to be perfect.
16. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 17 Users don't care about security. They are ignorant, disregardful, and responsible for security incidents.
17. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 18 ?
18. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 19 wrong dangerous arrogant (I used to think like that.)
19. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 20 We fight for the users! (Tron)
20. 0. attitude 1. think 2. learn
21. Security is not a feature
22. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 23 “Our cars are less likely to explode than competing products.”
23. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 24
24. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 26
25. Security is not dichotomic.
26. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 28 Alex Gaynor The worst truism in information security Attackers just need one vulnerability, defenders need to be perfect https://alexgaynor.net/2018/jul/20/worst-truism-in-infosec/
27. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 29 But what about the exploding cars?
28. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 30 “unbreakable” encryption absolute security
29. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 31 threat model cost–benefit analysis documentation
30. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 32 Threat Model: biometrics The Photographer [CC BY-SA 3.0 (https://creativecommons.org/licenses/by-sa/3.0) or GFDL (http://www.gnu.org/copyleft/fdl.html)], from Wikimedia Commons
31. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 33 Cost - Benefit
32. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 34 Mitigation: Defense in depth
33. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 35
34. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 36
35. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 37
36. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 38 https://www.independent.co.uk/travel/news-and-advice/air-safety-2017-best-year-safest-airline-passengers-worldwide-to70-civil-aviation-review-a8130796.html
37. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 39 Amazon Says One Engineer's Simple Mistake Brought the Internet Down 2017-02-28
38. Please mind the user between the chair and the keyboard
39. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 41 Arz [CC BY-SA 3.0 (http://creativecommons.org/licenses/by-sa/3.0/)], from Wikimedia Commons
40. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 42 So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users Cormac Herley, Microsoft Research
41. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 43 Human factor • Social engineering • CEO scam: Ubiquiti Networks victim of $39 million https://www.csoonline.com/article/2961066/supply-chain-security/ubiquiti-networks-victim-of-39-million-social- engineering-attack.html • Password in exchange for chocolate (up to 47.9%) Université du Luxembourg, Computers in Human Behavior, 2016; 61: 372 DOI: 10.1016/j.chb.2016.03.026 • dissatisfied employees • ignorant management
42. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 44
43. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 45 Your grandmother has installed Flash.
44. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 46 User Interface Lion Air Flight 610: Pilots fought automatic safety system before plane plunged
45. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 47
46. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 48 Challenger / Chernobyl
47. 0. attitude 1. think 2. learn
48. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 50 Professionally paranoid
49. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 51 be creative & learn from the past
50. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 52 Consider leaky abstraction layers
51. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 53 Example: Memory safety
52. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 54 Hardware security RSA Key Extraction via Acoustic Cryptanalysis https://www.tau.ac.il/~tromer/acoustic/
53. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 55 Physical security against intru-deers https://twitter.com/DCFurs/status/1087663240421593089
54. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 56 cybersquirrel1.com – attacks on power grid http://cybersquirrel1.com/
55. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 57 Ethics and responsibility
56. 0. attitude 1. think 2. learn
57. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 59 I know that I know nothing (Socratic paradox)
58. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 60 Skill #1 Communication
59. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 61 Stop reading, start doing! Parisa Tabriz So, you want to work in security? https://medium.freecodecamp.org/so-you-want-to-work-in-security-bc6c10157d23
60. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 62 Available for free: https://www.cl.cam.ac.uk/~rja14/book.html
61. Human Computer Interaction UI / UX
62. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 64 “Soft” skills • team work / team diversity • locate and evaluate information • law / legal affairs • business • ethics & compliance • rhetoric • read and write documentation
63. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 65 Social Engineering • The Social Engineering Framework https://www.social-engineer.org/framework/ • Social Engineering, The Art of Human Hacking Christopher Hadnagy (2010) • The Art Of Deception Kevin D. Mitnick (2003)
64. OpSec DevOps Admin
65. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 67 Digital self-defense • secure your hardware • disk encryption • privacy • ad-blocker • email provider • good passwords / 2FA • update, update, update! https://freedom.press/training/
66. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 68 Operating Systems • man pages • Advanced Programming in the UNIX Environment Stevens / Rago (2013)
67. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 69 Computer networks and system tools • IPv4, IPv6, routing, TCP, UDP, DNS, firewall • auditing, logging • SELinux • analysis and pentesting tools • wireshark • nmap • metasploit • IDA Interactive Disassembler
68. Software
69. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 71 General Resource • OWASP: Open Web Application Security Project • CWE: Common Weakness Enumeration • CVE: Common Vulnerabilities and Exposures • IETF RFCs
70. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 72 Top 10 bugs • injection attacks (SQL, LDAP, JSON, XQuery, XPath, ...) • broken authentication and access control • Cross-Site scripting (XSS) • XML entities • Insecure Deserialization (images, docs, ASN.1)
71. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 73 Unicode >>> import unicodedata # homograph / homoglyphic confusion attack >>> unicodedata.name('Руthοn'[0]) CYRILLIC CAPITAL LETTER ER # persistent XSS with wide unicode normalization >>> wide = ' ＜ script ＞ ' >>> safe = wide.replace('<', '&lt;') # quote >>> unicodedata.name(safe[0]) 'FULLWIDTH LESS-THAN SIGN' >>> unicodedata.normalize('NFKD', safe) '<script>' >>> import unicodedata # homograph / homoglyphic confusion attack >>> unicodedata.name('Руthοn'[0]) CYRILLIC CAPITAL LETTER ER # persistent XSS with wide unicode normalization >>> wide = ' ＜ script ＞ ' >>> safe = wide.replace('<', '&lt;') # quote >>> unicodedata.name(safe[0]) 'FULLWIDTH LESS-THAN SIGN' >>> unicodedata.normalize('NFKD', safe) '<script>'
72. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 74 Programming languages • C • Assembly • eBPF, BPF • Go • Java • JavaScript • Python • Rust
73. Cryptography
74. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 76 Cryptography • The Code Book, Simon Singh • Cryptography Engineering, Ferguson/Schneier/Tadayashi • Serious Cryptography, JP Aumasson
75. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 77 Cryptography free online resources • Cryptography I, Dan Boneh https://www.coursera.org/learn/crypto • The cryptopals crypto challenges https://cryptopals.com/ • Crypto 101, LvH, https://www.crypto101.io/ • Mathematics of Public Key Cryptography, Steven Galbraith (2012)
76. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 78 TLS/SSL, Certificates • Bulletproof SSL and TLS, Ivan Ristic • CA/Browser Forum Baseline Requirements https://cabforum.org/ • Mozilla Server Side TLS https://wiki.mozilla.org/Security/Server_Side_TLS
77. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 79 Passwords / Authentication • NIST 800-63-3: Digital Identity Guidelines • OAuth, OpenID Connect • 2FA (FIDO, WebAuthn) • Troy Hunt, https://haveibeenpwned.com/
78. Misc
79. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 81 News, blogs • Linux Weekly News https://lwn.net/ • Troy Hunt https://www.troyhunt.com/ • Krebs on Security https://krebsonsecurity.com/ • Bruce Schneier https://www.schneier.com/ • https://www.feistyduck.com/bulletproof-tls-newsletter/
80. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 82 Conference videos • Chaos Communication Conference (e.g. 35C3) • Black Hat • DEFCON • Real World Crypto
81. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 83 Security people • Adam Langley • Alex Gaynor • Brian Krebs (Krebs On Security) • Bruce Schneier • Dan Bernstein (djb) • Frank Denis • Hanno Böck • JP Aumasson • Katie Moussouris • Matt Blaze • Matthew Green • Nick Sullivan • Parisa Tabriz • Ryan Sleevi • Tanja Lange • Tavis Ormandy • Thomas Ptacek • Tony Arcieri • Troy Hunt
82. Summary
83. First steps into security engineering, PyCaribbean 2019 @ChristianHeimes 85 Summary • Mind the user • Keep learning • Get experience Write your own crypto (don't use it in production) Please send your suggestions christian@python.org / @ChristianHeimes
84. THANK YOU plus.google.com/+RedHat youtube.com/user/RedHatVideos facebook.com/redhatinc twitter.com/RedHat linkedin.com/company/red-hat