1. SpringOne
@pwntester / @atorralba
A DevSecOps approach
Security as code
SpringOne
@pwntester / @atorralba

2. > whoami
Alvaro Muñoz
@pwntester
Staff Security Researcher
Tony Torralba
@_atorralba
CodeQL Software Engineer

3. https://securitylab.github.com
GitHub Security Lab

4. Let’s start with a space odyssey
SpringOne
@pwntester / @atorralba

5. 9 years ago in our galaxy
double vectors[12] does not actually prevent to pass
an array of different size as argument
Unpredictable behaviour if this code is called with an
array that is too short
Pseudo-code. Not the actual NASA code

6. 9 years ago in our galaxy

9. The specific challenges of shifting
security left
SpringOne
@pwntester / @atorralba

10. Shifting Left

11. #1 — It’s not just “automate and run earlier”
#2 — Go left(er), don’t stop at coding!
Requirements, design, architecture …
SpringOne
@pwntester / @atorralba

12. What motivates us?
● Autonomy
● Mastery
● Purpose
SpringOne
@pwntester / @atorralba

13. What motivates us?
Autonomy You are in control Another team runs the tool and
generates a deluge of Jira issues for you
Mastery You are good at what
you’re doing!
The expertise stays in that team, you
don’t learn anything in the process
Purpose You know why you are
doing it!
You are just fixing a bug because the
experts said so in the issue
👍 👎
SpringOne
@pwntester / @atorralba

14. DevSecOps specificities
➢ What is common?
○ Misalignment, different goals
○ Antagonism
SpringOne
@pwntester / @atorralba

15. DevSecOps specificities
➢ What is common?
○ Misalignment, different goals
○ Antagonism
➢ What is specific?
○ Criticality / urgency of the bugs
○ Scarcity of security researchers
○ Perception that security researchers
have bad intentions
SpringOne
@pwntester / @atorralba

16. DevSecOps specificities
The divide is at another level
SpringOne
@pwntester / @atorralba

17. Lessons learned from DevOps
SpringOne
@pwntester / @atorralba

18. Lesson #1: Align goals
SpringOne
@pwntester / @atorralba

19. Lesson #2: Autonomy, Mastery
SpringOne
@pwntester / @atorralba

20. Security as Code
SpringOne
@pwntester / @atorralba

21. SpringOne
@pwntester / @atorralba
What is SaC
• Everyone should be responsible for security
• Provide developers with policies and tools integrated into their IDEs and
pipelines
• More Guardrails and fewer Gates
Security as Code is the methodology of codifying security and
policy decisions and socializing them with other teams.
https://cyral.com/white-papers/what-is-security-as-code/

22. SpringOne
@pwntester / @atorralba
What can be covered with SaC
• Security policies
• (e.g. https://github.com/ossf/allstar)
• Security testing
• (Unit/Integration/Functional tests focused on security)
• Vulnerability scanning
• We’ll be focusing on this!

23. SpringOne
@pwntester / @atorralba
Benefits of SaC
• Uses the developer’s same language
(code), encouraging collaboration and
boosting morale
• Easily auditable/reviewable (more
visibility, changes can be tracked)
• Automates checks, allowing
self-assessments

24. • CodeQL lets you query code as
though it were data.
• CodeQL extracts your code into
a special database
- AST
- Semantics
- Control Flow Graph
• You can query this DB with an
optimized OO declarative
language
CodeQL

25. Demo

26. SpringOne
@pwntester / @atorralba
Demo repository
https://github.com/atorralba/springone-demo

32. Taint tracking
SpringOne
@pwntester / @atorralba
SOURCE
POST /users
username={payload}
&pasword=secret
&repeatedPassword=secret
APPLICATION
UserForm userForm parseExpression(
expression
);
UserController SINK

34. Security As Code: Code Scanning
✓ Automation
✓ Developer tool
✓ Sharing knowledge
✓ Bonus: Community-powered
SpringOne
@pwntester / @atorralba

35. Support
SpringOne
@pwntester / @atorralba
● Sources of taint:
○ Web
○ MVC
○ REST
● Specific Spring Sinks:
○ Spring Web: Open Redirects, Open Forwards, XSS, CSRF disabling
○ Spring REST: SSRF
○ Spring LDAP: LDAP manipulation
○ Spring JDBC: SQL Injection
● Specific Spring categories:
○ Spring View manipulation
○ Spring EL Injection

36. Contribute your own queries and make some 💰
https://securitylab.github.com/get-involved
SpringOne
@pwntester / @atorralba

37. Thank you!
Reach out on twitter:
@pwntester
@_atorralba
@ghsecuritylab
SpringOne
@pwntester / @atorralba