CONFidence 2015: Automated Security scanning - Frank Breedijk, Glenn ten Cate
•Download as PPTX, PDF•
0 likes•237 views
Speakers: Frank Breedijk, Glenn ten Cate Language: English Seccubus automates vulnerability scanning with: Nessus, OpenVAS, NMap, SSLyze, Burp, Medusa, SkipFish and SSLlabs. Anyone who has ever used a vulnerability scanner like Nessus or OpenVAS will be familiar with one of their biggest drawbacks. They a very valuable tools, but unfortunately they are also very noisy. The time needed to report on the findings of a scan is often two or three times the time needed to do the actual scan. Seccubus was created to more effectively analyze the results of regular vulnerability scans. It was designed with defenders in mind who have to scan the same infrastructure regularly. CONFidence: http://confidence.org.pl/pl/
Recommended
Recommended
More Related Content
Viewers also liked
Viewers also liked (12)
Similar to CONFidence 2015: Automated Security scanning - Frank Breedijk, Glenn ten Cate
Similar to CONFidence 2015: Automated Security scanning - Frank Breedijk, Glenn ten Cate (20)
Recently uploaded
Recently uploaded (20)
CONFidence 2015: Automated Security scanning - Frank Breedijk, Glenn ten Cate
- 1. CONFIDENCE CONFERENCE Analyzing Security Findigns the Easy Way 6 years later… SECCUBUS This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
- 2. CONFIDENCE CONFERENCE Frank Breedijk • Security Officer at Schuberg Philis • (Official) Security dude since 2000 • Author of Seccubus Coordinates: • fbreedijk@schubergphilis.com • https://www.linkedin.com/in/seccubus • @Seccubus on Twitter Glenn ten Cate • Mission Critical Engineer Security at Schuberg Philis • Security Dude • Author of Security Knowledge Framework Coordinates: • gtencate@schubergphilis • https://nl.linkedin.com/pub/glenn-ten-cate/3b/11a/117 WHO ARE WE?
- 3. CONFIDENCE CONFERENCE Frustration Being challanged To make my life easier WHY DID I START THE SECCUBUS PROJECT? Y ? A CC NC ND image by Tehmina Goskar https://www.flickr.com/photos/13114254@N00/119475590/
- 4. CONFIDENCE CONFERENCE C. Lueless Mission: • Mission: Perform a bi-weekly vulnerability scan of all our public IP addresses B. Rightlad A STORY ABOUT TWO GUYS These and all non-attributed photos of Frank Breedijk are taken by Jan Jacob Bos
- 5. CONFIDENCE CONFERENCE C. LUELESS – TAKES A CLASSIC APPROACH
- 6. CONFIDENCE CONFERENCE GETTING UP WAY TO EARLY…
- 7. CONFIDENCE CONFERENCE … STARTING THE SCANNER IN THE MAINTENANCE WINDOW…
- 10. CONFIDENCE CONFERENCE Scanners are written for consultants, not operations Scanners need to make a tradeoff between false positives and false negatives Most scanners produce an awfull lot of output Scanning takes time, tools are poorly automated WHAT IS C. LUELESS’ PROBLEM?
- 11. CONFIDENCE CONFERENCE B. RIGHTLAD CHOOSES SECCUBUS
- 12. CONFIDENCE CONFERENCE CONFIGURATION IN THE MORNING
- 15. CONFIDENCE CONFERENCE … THE SCAN RUNS AT NIGHT … Image: Orion's Umbra, a CC NC image from jahdakinebrah's photostream
- 16. CONFIDENCE CONFERENCE … IN THE MORNING …
- 17. CONFIDENCE CONFERENCE … ANALYZE AND REMEDIATE
- 18. CONFIDENCE CONFERENCE WHAT HAPPENED UNDER THE HOOD? Do-scan Nessus/sc an Nessus .nessus files nessus2ivilIvil file Load ivil Database
- 20. CONFIDENCE CONFERENCE Is the work in balance with the profit? BALANCE A fine balance a CC NC ND Image by Anish B George https://www.flickr.com/photos/22199070@N00/3311106984/
- 21. CONFIDENCE CONFERENCE TWO WEEKS LATER Image: 1/365, a CC NC ND image from cubedude27's photostream
- 22. CONFIDENCE CONFERENCE C. LUELESS – TAKES A CLASSIC APPROACH
- 23. CONFIDENCE CONFERENCE GETTING UP WAY TO EARLY…
- 24. CONFIDENCE CONFERENCE … STARTING THE SCANNER IN THE MAINTENANCE WINDOW…
- 27. CONFIDENCE CONFERENCE WAS IT REALLY WORTH IT?
- 28. CONFIDENCE CONFERENCE B. RIGHTLAD CHOOSES SECCUBUS
- 31. CONFIDENCE CONFERENCE … THE SCAN RUNS AT NIGHT … Image: Half Moon, a CC NC ND image from za3tooor's photostream
- 32. CONFIDENCE CONFERENCE … IN THE MORNING …
- 33. CONFIDENCE CONFERENCE … ANALYZE AND REMEDIATE
- 35. CONFIDENCE CONFERENCE Don’t bother users with non-actionable findings OK IS OK… Woo a CC NC SA image by Rick Harrison https://www.flickr.com/photos/81851211@N00/2682663297/
- 36. CONFIDENCE CONFERENCE ANOTHER TWO WEEKS PASS… Image: Cosas hechas, a CC ND image from srgblog's photostream
- 37. CONFIDENCE CONFERENCE C. LUELESS – TAKES A CLASSIC APPROACH
- 38. CONFIDENCE CONFERENCE GETTING UP WAY TO EARLY…
- 39. CONFIDENCE CONFERENCE … STARTING THE SCANNER IN THE MAINTENANCE WINDOW…
- 42. CONFIDENCE CONFERENCE B. RIGHTLAD CHOOSES SECCUBUS
- 45. CONFIDENCE CONFERENCE … THE SCAN RUNS AT NIGHT … Image: Himalayan Moonrise, a CC NC ND image from swamysk's photostream
- 46. CONFIDENCE CONFERENCE … IN THE MORNING …
- 47. CONFIDENCE CONFERENCE … ANALYZE AND REMEDIATE
- 49. CONFIDENCE CONFERENCE Monthly Seccubus runs means: Scans are scheduled via crontab Only the findings that need attention get it Less errors due to less repetitave work. The amount of effort is proportional to the amount of changes Risk is proportional to the amount of changes SO…
- 50. CONFIDENCE CONFERENCE COMPARE Image: Apples & Oranges - They Don't Compare, a CC image from thebusybrain's photostream
- 51. CONFIDENCE CONFERENCE REDUCE Image: Slimmer, a CC NC ND image from mkmabus's photostream
- 53. CONFIDENCE CONFERENCE ULTIMATE GOAL Image: StuttgargoalRobin, a CC image from dankamminga's photostream
- 54. CONFIDENCE CONFERENCE Name Seccubus chosen here at Confidence Added new scanners Wrote a new GUI SECCUBUS HAS EVOLVED Medusa SSLyze
- 55. CONFIDENCE CONFERENCE Intermediate Vulnerability Information Language Intermediate format that allows tools to interface and exchange findings A LITTLE IVIL GOES A LONG WAY Image: EVIL a CC NC SA image from krazydad's photostream
- 56. CONFIDENCE CONFERENCE It does not try to capture everything It does not try to fit each case The specification is not 63 pages Simple to read Simple to write Simple to use Simple License (MIT) Easy to integrate new tools into Seccubus IVIL
- 57. CONFIDENCE CONFERENCE Joined Schuberg Philis 2 years ago Main focus: Web Application Security We need to integrate this into our pipeline ENTER GLENN Enter here a CC NC ND image by Anne Petersen https://www.flickr.com/photos/60258967@N00/4183985730/
- 58. CONFIDENCE CONFERENCE Breaches are moving from layer 3 to layer 7 There’s only so many security dudes to drive the tools Integrate into continuous delivery WHY?
- 59. CONFIDENCE CONFERENCE Google’s web application security scanner Open Source Noisy Not very subtile Not production safe! FIRST WIN: SKIPFISH Skip w/ fish a CC NC ND image by AlBakker https://www.flickr.com/photos/45213160@N00/206944920/
- 60. CONFIDENCE CONFERENCE Open source Like Burp but free (as in speech) Actively developed and maintained OWASP Flag Ship Project SECOND WIN: OWASP ZAP IEEE Scrum a CC NC SA image by Jim Carson https://www.flickr.com/photos/44124442504@N01/2208956607/
- 61. CONFIDENCE CONFERENCE Help developers write better code Enable Security by Design • Knowledge system for risk analysis Code Securely • Code examples Check code before commit • OWASP Application Security Verification Standard Newly adopted as OWASP Project SECURITY KNOWLEDGE FRAMEWORK Moving Hacks a CC NC SA image by Brian Sawyer https://www.flickr.com/photos/45609637@N00/229360390/
- 62. CONFIDENCE CONFERENCE Coding • Perl • Angular Requirements • What do you want Testers • Challenge the quality of our crack ;) Documentation • Help us get new users Users SECCUBUS CAN USE YOUR HELP Image: Hang On, a CC NC ND image from brraveheart's photostream
- 63. CONFIDENCE CONFERENCE First public preview of new interface SNEAK PREVIEW "Celebs" a cc by nc sa licensed photo by Nick Sherman: http://flickr.com/photos/nicksherman/4145966095/
- 67. CONFIDENCE CONFERENCE New user interface (RSN) Start/schedule scans from the GUI Integration with Security Knowledge Framework Add user/rights management Track issues as well as findings Reporting More??? ROADMAP Albany NY 1950 a CC image by david https://www.flickr.com/photos/23465812@N00/6877290919/
- 68. CONFIDENCE CONFERENCE www.seccubus.com QUESTIONS Image: What now?, a CC ND image from laurenclose's photostream
- 69. CONFIDENCE CONFERENCE Frank Breedijk • Security Officer at Schuberg Philis • (Official) Security dude since 2000 • Author of Seccubus Coordinates: • fbreedijk@schubergphilis.com • https://www.linkedin.com/in/seccubus • @Seccubus on Twitter Glenn ten Cate • Mission Critical Engineer Security at Schuberg Philis • Security Dude • Author of Security Knowledge Framework Coordinates: • gtencate@schubergphilis • https://nl.linkedin.com/pub/glenn-ten-cate/3b/11a/117 WHO ARE WE?