Continuous security: Bringing agility to the secure development lifecycle

1© 2017 Rogue Wave Software, Inc. All Rights Reserved. 1
Continuous security:
Bringing agility to the
secure development
lifecycle
Rod Cope, CTO
Twitter: @RodCope
AppSec California 2017

Rod Cope, CTO
Rogue Wave Software
Presenter

Agenda
• A holistic approach to
cybersecurity
• Making security agile
• Implementing in Jenkins
• Vulnerability examples

A holistic approach to
cybersecurity

We’re inundated by security threats

We’re inundated by data
News
Blogs, social media
conferences
Security standards
OWASP, CWE, CERT, etc.
NVD, White Hat, Black Hat OEMs, internal
Media
More and more software running inside
your car
Standards & legislation
Research
Developers don’t know security
(80% failed security knowledge survey)
Requirements
Source

A holistic approach to cybersecurity
Threat
Model
Internal
Threat
Metric
External
Data
Action
Information overload Develop an adaptive
threat model

 Scanning to discover open
Threat modelling identifies, quantifies, and addresses
security risks by:
1. Understanding the application & environment
2. Identifying & prioritizing threats
3. Determining mitigation actions
Identify
Assets
System
Overview
Decompose
Application
Identify
Threats
Prioritize
Threats
Threat model

Developing a threat metric
Build Score
Automated and functional
testing Pass fail metrics
Penetration testing Number of exploitable paths
Static analysis Compiler warnings, defects
Open source audits Unknown OSS
.
.
.
.
.
.

More on open source
• Growth in software complexity leads to more vulnerabilities
• Large OSS developer base doesn’t imply constant (or skilled) vigilance
• Using risky components in #9 on OWASP Top 10 list
On Apache Struts: “It is not noteworthy that an open source project could
have a severe vulnerability [it’s] that this flaw went undetected for at least
seven years.”
• “Over 680 TB of data exposed”1
• Ransomware groups have deleted over 30,000 databases2
• Example loss: 4.5 million patient records3
• 8 other flaws in core packages the first week of 2015
1. ComputerWorld
2. ComputerWorld
3. Reuters: U.S hospital breach biggest yet to exploit Heartbleed bug

Open source protection
Identify
Assets
Identify
Threats
• Deploy a governance and provisioning
platform to white list/black list open
source packages
• Be informed when new vulnerabilities are
published through the National
Vulnerability Database
• Know what is in your source code by
scanning for source code snippets that
have been copied and pasted

Other considerations
Isolate code to enforce strict boundaries between the
operating system and the processes.
Data in transit must be encrypted. Protect data at rest using
the underlying filesystem encryption features and employ
separate keys.
Every program and every user of the system should operate
using the least set of privileges necessary to complete the
job.
Use public key infrastructure (PKI) and sign actions with
private keys to prevent denial of authenticity.
If you employ cryptography, assume that algorithms will be
replaced over time. Keep your code modular for easy
replacement and don’t create custom algorithms.
Resource exhaustion makes software vulnerable to denial of
service (DoS) attacks.
Authenticate
Authentication should be strong and managed centrally to
ensure inputs are from trusted sources.

Making security agile

Release
to
Market
AcceptSprint 1
Sprint 2
Sprint n Release
Change
Adjust and Track
Feedback
Review
Next Iteration
No!
Yes!
Integrate
and Test
Integrate
and TestIntegrate
and Test
Characteristics
• Multiple testing points
• Rapid feedback
required
• “Outside” testing does
not meet agile needs
Agile development – integrate security

Understand
Needs
Invent
Solution
Develop
Build
Commit
Performance
Security
Release Deploy
Load
UAT/
Exploratory
Testing
Functional
Testing
Accept
Idea
Continuous Integration
SDLC Step
DevOps SDLC

Example of build score component
Static analysis Compiler warnings, defects
• Standards
• Rely on tool to maintain updates to the latest
security standards
• Research
• Rely on tool to develop custom rules based on
research shared by security analysts
• Customization
• Rely on tool to allow custom rules for your specific
needs

Implementing in Jenkins

Jenkins CI

Example: Enterprise web deployment
UI
Business
logic
Connectors
Data
layer
App 1
App 2
Services
Admin
Workflows
MySQL
Existing bug > OK
New flaw > FAIL
Oracle

Fast feedback; seeing trends helps identify
areas of bad code
Free up developer’s time, ensure consistency
+ repeatability (avoid human error)
Automate the discovery of security
weaknesses, compliance violations, OSS use
Best practices
Automate
the build
process
Automate
testing
Automate
reporting

Vulnerability example

Buffer overflow
Security

Static analysis report

Validate length, commit, build again

Real vulnerability: GNU libc
CVE-2015-1472
https://sourceware.org/ml/libc-alpha/2015-02/msg00119.html
• Under certain conditions wscanf can allocate too little
memory for the to-be-scanned arguments and overflow
the allocated buffer.
• Theoretically, any Linux machine connected to the
internet, using this version, is at risk

GNU libc example: fail

GNU libc example: fix

The application security world is fluid
Create concrete,
actionable strategies
(Threat metric, analysis tools)
Delivery cycles are short
Update regularly with
well-defined process
(Agile, CI)
Conclusions

Q&A

See us in action:
www.roguewave.com

Continuous security: Bringing agility to the secure development lifecycle

Related slideshows

More Related Content

Continuous security: Bringing agility to the secure development lifecycle