Better Security Testing: Using the Cloud and Continuous Delivery

1© Copyright 2013 Coveros, Inc. All rights reserved.
Gene Gotimer, Senior Architect
gene.gotimer@coveros.com

 Coveros helps organizations accelerate the delivery of
business value through secure, reliable software
About Coveros

Security Testing
 Late in the cycle
 Issues are not remediated
 Needs ROI: lower cost, better results, or both

Security Testing
 Consider open-source and free tools
 Opportunities in Continuous Delivery and Cloud
Identify low effort opportunities using free
and open-source tools

Continuous Integration
 Merge work frequently
 Code commits to source control
 Unit tests run automatically
 No long integration cycle at the end
 Fix code when we find problems
 Build-Test-Commit cycle = rapid feedback

Continuous Delivery
 Every build potentially releasable
 Release is a business decision
 Extrapolation of Continuous Integration
– Deploys
– Functional tests
– Load and performance tests
– Security tests
 Build-Test-Commit-Deploy-Test-Release cycle

Cloud Computing
 Can’t wait for long procurement
 Public or Private clouds
 Works well with Continuous Delivery
– Easy to deploy
– New environments whenever

Maturity Model for Security Testing
 Level 0: No Security Testing
 Level 1: Unit Testing and Static Analysis
 Level 2: Automated Deploys and Functional Testing
 Level 3: Automated Configuration Management
 Level 4: Cloud Deployments
 Level 5: Continuous Delivery

Level 1: Unit Testing and Static Analysis
 Unit Tests:
– Confidence to make changes
– Error handling
– General logic errors
– Bounds checking
– Edge conditions

 Static Analysis:
– Common errors
– Unused variables
– SQL injection
– Cross-Site Scripting (XSS)
– Hard-coded passwords

 Unit testing:
 JUnit for Java
 NUnit for .Net
 PyUnit for Python
 PHPUnit for PHP
 Static Analysis:
 Sonar for many languages
 PMD for Java
 FindBugs for Java
 PHPMD for PHP
 FxCop for .Net
 PyChecker for Python
 pylint for Python

Level 2: Automated Deploys and Functional Testing
 Automated Deploys:
– Frequent security scans
– Rapid feedback
– Web application scanners:
 w3af
 wapiti
 Skipfish
– Start basic, add tuning

 Functional Testing:
– Access control
– Data protection
– Web Application testing:
 Selenium

 Proxies:
– Better coverage
– XSS and Cross-Site Request Forgery (XSRF)
– URLs for logs to augment spidering
– Data leakage
– Web application proxies:
 OWASP Zed Attack Proxy (ZAP) Project
 OWASP WebScarab
 Ratproxy

Level 3: Automated Configuration Management
 Deployment/Configuration:
 Puppet
 Chef
 Provisioning:
 Cobbler
 Kickstart
 Windows Deployment Services
 Completely new systems or build on templates
 Repeatable configuration management

Level 3: Automated Configuration Management
 Complete system scans
 OpenVAS
 Nmap
 Nikto2

Level 4: Cloud Deployments
 On-demand environments
– Long running scans in parallel
– Production-sized machines, even temporarily
– Failover and high-availability
 Multiple client systems in parallel
– Race conditions
– Multi-user interactions

Level 4: Cloud Deployments
 Web performance testing frameworks:
 Apache Jmeter: Java-based UI
• HTTP, HTTPS, SOAP, JDBC, LDAP, JMS, SMTP,
POP, IMAP
 ab, ApacheBench: command-line
 The Grinder: Jython and Clojure
 Gatling: Scala

Level 5: Continuous Delivery
 Release ready for production
 Continuous deployment
 High levels of automation
 Dashboards
– Custom development

Personal Experience
 Agile development grew into Continuous Delivery
 Automated deploys with Puppet
 Selenium functional tests
 JMeter performance tests

Personal Experience
 Security testing lagged
 Excuses:
– The “official” tool is expensive.
– It would take a lot of time to acquire and then to
configure it.
– We don’t have time.
– It isn’t our responsibility.
– The security team wouldn’t accept our scans anyway.
 Open-source tools
 Focus on security, not compliance
 Limited time

Personal Experience
 Web application scans with w3af
 Vulnerability assessments with OpenVAS
 Security standards checks with Openscap
 Initial implementation ~ a day each
 No more freebies

Conclusion
 Earlier security testing
– Less likely to skip
– More likely to remediate
 Open-source tools
 Other testing as foundation
 Gradually add more security tests
 Continuous Delivery and Cloud Computing give security
testing opportunities

Questions?
Gene Gotimer
Email: gene.gotimer@coveros.com
Twitter: @CoverosGene

Better Security Testing: Using the Cloud and Continuous Delivery

More Related Content

What's hot

Similar to Better Security Testing: Using the Cloud and Continuous Delivery

More from Gene Gotimer

Recently uploaded

Better Security Testing: Using the Cloud and Continuous Delivery