Using OWASP Security Bot
(OSBot) to make Fact
Based Security Decisions
Sep 2019, @DinisCruz
Lightning talk (15m)

What can OSBot do for me?

Make sense of reality

Be your friend (that automates you)

Graph your CISO’s world

CLI (Command Line Interface) to your data

REPL your world (Read Evaluate Print Loop)

Threat Models (in a scalable way)

DataScience your data

Screenshots of OWASP Pages

Screenshots of Jira issues

Graph project’s to outcomes and threats

Incident workflow automation
Real-word example

Workflow
Person
Credentials Application
uses
to access
conditions
generate
Alert
acknowledged in Slack by
entered in
action updates status of alert in

Slack as UI , Jira as Database

Jira as (graph) database

Ask user if they were the ones login in
https://twitter.com/DinisCruz/status/1153591757290057733

GSBot Commands

graph expand GSP-181 1 delivers,is needed by
graph expand GSP-181 2 delivers,is needed by

graph expand GSP-181 3 delivers,is needed by
graph expand GSP-181 3 delivers,is needed by,fixes,achieves

Security Team
Data Science Tech Stack

Serverless stack

Scalable data creation workflow

JIRA

Elastic (ELK)

Slack

Jupyter notebooks

Other Key Components

Jira Schema

Create schema that represents the business

Map reality

Workflow everything

Risk workflows

Scale using Workflows
RISK Workflow VULN Workflow

Global Dashboards that actually are FACT based

Hyperlinked RISKs (from R1s to R4s to V1s to V3s)

Modern approach to managing security RISKs
https://www.soa.org/globalassets/assets/Files/Research/Projects/research-new-approach.pdf

Linked Security Policies
=
Fact based
Security Decisions

Hyperlinked policies in Jira
Policy’s pdfs
do not scale
because it is not
possible to link real-world
data to the respective policy

Convert policy into an graph

Policies Links to Facts Links to Vulns Links to Risks

Context specific Jira projects (for example FACTs)

Wardley Maps

Meet Simon ….

Using Wardley Maps on Healthcare
https://wardle.org/strategy/2018/07/19/mapping.html

Maps help to visualise strategy (and bias)

Metadata use in Maps is very powerful
https://medium.com/@erik_schon/the-art-of-strategy-811c00a96fad

Advanced Wardley Mapping

Create Wardley maps using OSBot

OSBot via Jupyter

Where is the code?

How do I learn more?

Jon Hawes BSides Vegas 2019 presentation
https://www.slideshare.net/JonHawes3/building-an-enterprise-security-knowledge-graph-to-fue
l-better-decisions-faster

Other presentations (in slideshare)
https://www.slideshare.net/DinisCruz/creating-a-graph-based-security-organisation-apr-2019-owasp-london-
chapter-meeting
https://www.slideshare.net/DinisCruz/osbot-data-transformation-workflow-from-gsheet-to-jupyter-156132054https://www.slideshare.net/DinisCruz/osbot-jira-data-import-from-gsheet-to-jira-via-jupyter-v09
https://www.slideshare.net/DinisCruz/gsbot-commands-slack-bot-used-to-access-jira-data

Thanks