A journey into Application Security

1. A Journey into Application Security Christian Martorella ISACA Italy 2014 Venezia, 3rd October

2. Who am I • Principal Program Manager, Product Security Skype – Microsoft • Edge-‐Security: Wfuzz, theHarvester, Metagoofil, Webslayer • Presented in many Security conferences: Hack.lu, BlackhatArsenal, Source, OWASP Summit, OSIRA • CIS(A,M,SP), OPS(T,A)

3. My background • Started as internal security auditor (Offensive) • System and network security responsible of a small ISP (Defensive) • Penetration tester -‐> Team leader (Offensive) • Practice lead for Threat and Vulnerability in EMEA (Offensive) • Product Security Analyst in Skype (Defensive)

4. Introduction This presentation is about the evolution of software development and the relation with Applicationsecurity. How application security teams adapted over time and the challenges we are facing

5. Waterfall development

6. Waterfall development • Originated from the manufacturing and construction industries. • Hardware oriented model adapted to Software development • Sequential design process • Introduced by Winston Royce in the ’70

7. Waterfall development • Make sure each phase is 100% complete and absolutely correct before proceeding to the next phase • Emphasis on documentation • Project span across long period of time • Time spent early on making sure requirements and design are correct saves much time and effort later.

8. Application Security Microsoft Secure Development Lifecycle (SDL) Set of software development process improvements Born in 2002 and established in 2004, as result of MS Trustworthy Computer (TWC) initiative. More than 50% less vulnerabilities in shipped code

9. SDL Methodologies

10. SDL evolution

11. Security approach Influence in the Design phase: • All functional and design specifications, regardless of document size, should contain a section describing how the component impacts security • Threat Modeling: Understand assets to protect, threats and vulnerabilities to the product and how will be mitigated. Critical to create a secure software Most important phase in Waterfall

12. Security approach Development phase: Implement security tools: • Static analysis, Banned Apis, FxCop, /Analyze Implement security checklist Secure coding best practices Verification / Release phase: Fuzzing Verify / validate Threat Model Final security review (FSR) Security testing by another team or third party

13. Challenges • Lack of security requirementsin design phase will make it difficult to add them in later stages • Non iterative nature makes difficult to fix issues identified in advanced stages of development • Issues detected in the Final review, will be expensive to fix

14. Agile development

15. Agile development • Cross functional teams, self organizing • Short time boxed development iterations • Delivery of small functional stories • Listen to customer needs and adapt • Usually low in documentation

16. Agile Manifesto Individuals and interactionsover processes and tools Working software over comprehensive documentation Customer collaboration over contract negotiation Responding to change over following a plan That is, while there is value in the items on the right, we value the items on the left more.

17. Challenges • SDL too complex to fit in each release/Sprint • Design, requirements evolve over time • New interactions with third parties are not known in advance • Teams usually don’t have an Application Security specialist • Teams move faster than Waterfall • New code is being pushed to production every week or even days. • Low on documentation

18. SDL for Agile

19. SDL for Agile The categorization of SDL requirements into: • every-‐sprint • one-‐time • Three bucket groups (Verification, design, Response) is the SDL-‐Agile solution for dealing with SDL in Agile environments

20. Recommendations • Training the teams and providing them with tools is the most important aspect in order to implement SDL in Agile teams • Security specialist assigned to a few teams, to provide consultancy • Useful to participate in Sprint planning to understand what is going on • Sprint Security Checklist (FSR), after Sprint planning • Get familiar with Agile tools, backlog.

21. SDL for Agile • Continuous Integration (Automation): Secure Code analysis Security unit test Vulnerability scanning Secure configuration

22. Happiness

23. Cloud fotos

24. Cloud • “We want to start using Cloud services”

25. Challenges • Security of the data • Security of the servers • Who is responsible for the servers • Where is the data located • Encryption at rest • Disks reutilization

26. Security Approach • New Security policy for Cloud services • Security Onboarding for teams • Inventory of cloud services

27. DEVOPS

28. Why Devops? • Continuous software delivery • Faster delivery of features • Faster resolution of problems • Less complex problems to fix More Deploys Means Faster Time to Market and Continual Improvement

29. Challenges • Rapid releases cycles (every day, multiple times a day) • Autonomous teams • Teams are doing development and operations now • Infrastructure also changes fast

30. Development cycles Waterfall Agile Devops

31. Surviving Devops • Providing security training to teams • Provide security policies, guidelines • Security and abuse stories, driven by business • Situational awareness: • What do we have? • Changes, alerts. • Attack surface, priorities

32. Surviving Devops • Automation: • Integrate testing into continuous integration and release process (Chef & Puppet) • Integrate and extend production configuration monitoring • Develop your own security testing tools, more focused and adapted to your particular needs

33. Surviving Devops Situational awareness & Automation example: -‐Source code Product attack surface analyzer, alerts, prioritization of efforts. -‐Internet footprint, scanning and inventory. Updated every hour.

34. Surviving Devops • Integrate InfoSec and IR into the Ops/Devs escalation process • Harden the production environment • Provide guidelines/baselines on what is a hardened environment • Automate hardening (Chef/Puppet) • Tolerate failure in production environments (Chaos Monkey)

35. Surviving Devops • Metrics: • Identify if teams are repeating certain type of vulnerabilities, train them to prevent repeating again. • Prioritize training • Modify policies and baselines • Tune tools • Interact more closely with teams, attend to standups • Be more flexible and adapt to team processes • mesh with the unique development cultures of individual teams

36. The Future? Rugged software “Rugged” describes software development organizations which have a culture of rapidly evolving their ability to create available, survivable, defensible, secure, and resilient software Rugged is NOT a technology, process model, SDLC, or organizational structure. It’s not even a noun.

37. Rugged software Rugged describes staying ahead of the threat over time “We are convinced that negative and reactive approaches to application security cannot scale and are doomed to fail. These approaches primarily rely on finding vulnerabilities and fixing them.”

38. Rugged Manifesto I am rugged and, more importantly, my code is rugged. I recognize that software has become a foundation of our modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged. I am rugged because I refuse to be a source of vulnerability or weakness. I am rugged because I assure my code will support its mission. I am rugged because my code can face these challenges and persist in spite of them. I am rugged, not because it is easy, but because it is necessary and I am up for the challenge.

39. Conclusion • Development methodologies and processes changed considerably over time • More things happening in shorter period of time • Security tools and techniques needs to adapt to this situation • Automation is key in Devops environment • Security professionals need to be flexible and engage more than ever with development teams

41. Thank you cmartorella@edge-‐security.com

42. Resources • Microsoft SDL -‐ http://www.microsoft.com/security/sdl/default.aspx • Rugged Software -‐ https://www.ruggedsoftware.org/ • http://labs.securitycompass.com/appsec-‐2/the-‐cultural-‐challenges-‐of-‐ application-‐security/ • http://devops.com/features/the-‐unexpected-‐benefits-‐of-‐devops/ • http://newrelic.com/devops/benefits-‐of-‐devops