Hi Everyone! My name is Jeff Williams Great to be back at SpringOne!
I’ve spent the last 25 years in software and security… and I’m incredibly excited to talk to you today about security instrumentation and what you can do with it today. Ultimately, I believe security observability is the key bringing security into DEVOPS.
TITLE: Practical DevSecOps Using Security Instrumentation
FORMAT: A 25 minute presentation + 15 mins questions in a separate room. ABSTRACT: The traditional “outside in” scanning and firewalling approach to application security has failed. After decades of attempts to improve software security, vulnerability rates are still staggering while attacks are increasing in volume and severity. We need a new approach to security that doesn’t slow development or hamper innovation. In this talk, we’ll show how you can ensure software security from the “inside out” by leveraging the power of software instrumentation. Unlike scanning and firewalling, this approach establishes a safe and powerful way for development, security, and operations teams to collaborate. In this talk, we’ll show how software security instrumentation works, how it’s being used in many organizations, and what the future holds for DevSecOps.
The CEO of a Fortune 100 insurance company recently said….they’re a data and technology company that happens to sell insurance.
But they were struggling with a ton of challneges around appsec.
SAST and DAST were fully automated, but scans still taking over two hours and producing “crappy” results No value despite spending immense hours to automate security
Their CIO shared with me that “security is limiting the speed of innovation.” He complained about security being “impedence” – and said security is adding story points to everything they do.
And it makes sense when you dig in.
Every tool you run All these scanners and firewalls – SAST, DAST, SCA, and WAF generate both true and false positives So you need an experts to review them ALL.
All those experts in the critical path slow innovation. SLOW the flow of value to customers. And so not surprisingly, most organizations do the minimum.
Security cannot keep up with software – the economics are BROKEN.
IT DOESN’T HAVE TO BE THIS WAY…. BUT WE HAVE TO FIX THIS PICTURE CHANGE THE ECONOMICS
This is the 94-50…. It’s an instrumented basketball. It tells you dribble speed, shot rotation, arc of your shot, makes/misses, and a bunch more. It also has a bunch of drills and metrics
I’ve been playing basketball for a LONG time. After one hour, 94-50 let me know I was shooting too flat. Amazing.
With an instrumented ball – the role of the coach changes. They’re not involved in every drill. They can be much more strategic. They can scale. All it took was a few sensors directly in the basketball. It’s the same in medicine and other fields – instrumentation changes the economics.
GREAT NEWS!! Instrumenting software IS EASY!! It’s amazingly powerful.
We add an agent to the application. Not an OS level agent. For Java it’s a jar file. As the code loads, the agent SURGICALLY adds sensors to exactly right methods. We can record and analyze the telemetry from these sensors to keep an eye on everything in the software. The only limit is your imagination.
I’m going to show you three things you can do today!
Imagine you have a friend that lives inside your code. They have access to the code, the HTTP traffic, the libraries, the configuration, the data flow, backend connections, everything.
Anytime your code steps out of line – your friend sends you an alert with ALL the details.
Here’s the cool thing. You don’t have to attack your application…. Just do normal testing. If your friend sees untrusted data flow through the application into a SQL query without being escaped or parameerized…. He shouts out “HEY SQL INJECTION” You don’t need to be an expert – you don’t need to exploit anything.
ANYONE can be a pentester with a smart enough agent!
It’s not that hard to write your own instrumentation…. But to make it easier,
I created an open source platform so that you can create sensors fast and easy without any coding.
The Java Observability
You just add this agent to your application No code changes. No experts. Just a heads up on EVERYWHERE you’re using a non-Parameterized query. And USE IT NORMALLY! You don’t need to know anything about security.
Simple, safe, and remarkably effective without any code changes for all the apps
You don’t have to write all this stuff yourself.
Although you certainly CAN
But there are many products in the market that use instrumentation for security testing and protection.
IAST is… RASP is…. DSCA too!!!
Detecting a vulnerability and preventing an exploit actually aren’t very diffiuclt. Like how seeing an open window isn’t that different from closing it when an attacker tries to break in. It’s totally insane to have two totally different technologies to do this same thing.
Modern Security is different. First, we will test the entire fully assembled application stack, not source code and components separately. We will use security instrumentation to inject sensors directly into the app, so we can measure what’s actually happening. This is entirely automated. No changes to code or process. This instrumentation allows us to accurately identify vulnerabilities in real time, so we can feed them to developers and they can fix them without breaking stride.
But it doesn’t stop there — the instrumentation continues to work right through the pipeline. Continuous security testing at every step. Feedback on open source libraries too. And when the app goes into production, you get visibility into who is attacking and what they’re trying. The instrumentation automatically prevents most vulnerabilities from being exploited too. That means you’re safe while you go back and fix vulnerabilities with no fire drill.
All this means that your pipeline can run full speed.
This is the essence of DEV-SEC-OPS. We’re using the power of security instrumentation to create harmony between security, development, and operations teams. We fixed the broken economics of software security and now security contributes to flow.
Application security isn’t hopeless
I’m not saying that technology alone can solve our security issues. Good security requires the right mix of culture, people, process, and technology.
But SECINST can create a PLATFORM where development and security can FINALLY work together. That’s the key to getting “SECURITY CODE” into your production apps And ultimately the key to delivering innovation and value faster
If you’re interested in trying security instrumentation on your apps...
I’m VERY proud to tell you that well over 2000 organizations are already using CONTRAST Community Edition
It’s fantastic for Spring apps and you can use our Pivotal tile.
It’s totally free and full strength forever – for ONE APP.
Please reach out and me know what you think.
Now I’d love to take any questions you might have about anything.
Practical DevSecOps Using Security Instrumentation
JEFF WILLIAMS, COFOUNDER AND CTO
“Security is limiting the speed of innovation”
CHALLENGE: DEVSECOPS IN A FORTUNE 100 COMPANY
CEO – “We are not running an insurance company
per se, but a data and technology company”
COMPLIANCE CLOUD &
(OUTSIDE – IN)
TRADITIONAL APPSEC IS KILLING INNOVATION
WHAT IS SECURITY INSTRUMENTATION?
Add sensors here!
Run instrumented code!
MEET YOUR NEW SECURITY “FRIEND” ON THE INSIDE!
FREE OPEN SOURCE
INJECTION ATTACKS WITH
In DEV and TEST
Security Testing is
USE IT IN
Runtime Application Self-
Protection is simply using
instrumentation to detect
attacks and prevent
USE IT IN PRODUCTION
Continuous automated security testing
and exploit prevention
(INSIDE – OUT)
(IAST, SCA, RASP)
SECURITY INSTRUMENTATION ACCELERATES INNOVATION
IN MTTR OVER
– IAST (BELOW AVERAGE BACKLOG)
* DATA FROM CONTRAST 2020 APPSEC OBSERVABILITY REPORT AND VERACODE 2020 SOSS REPORT
C O M M U N I T Y E D I T I O N
AVAILABLE NOW COMING SOON
A totally free and full-strength application security platform
Protect against attacks with RASP Find vulnerabilities with IAST Secure open-source with SCA
JEFF WILLIAMS, COFOUNDER AND CTO