Building application security with 0 money down

@intralinks
@intralinks
© 2018 Intralinks, Inc. l All Rights Reserved l 1
Building application security with 0
money down
Mushegh Hakhinian| VP, Security Architecture| November 9, 2018

Why this talk?
Share experience:
• “Everything-as-code” means “most-of-the-things” can be fixed in code
• A good program can be started without major investment in tooling
• A good program cannot be established without smart investment in tooling

Introduction
01

Microsoft SDL Steps
1. Training 2. Requirements 3. Design 4. Implementation
1. Core Security Training 1. Security and Privacy
Requirements
2. Quality Gates
3. Security And Privacy
Risk Assessments
1. Design Requirements
2. Attack Surface
Reduction
3. Threat Modeling
1. Use Approved Tools
2. Deprecate Unsafe
Functions
3. Static Analysis

Microsoft SDL Steps (continued)
5. Verification 6. Release 7. Response
1. Dynamic Analysis
2. Fuzz Testing
3. Attack Surface
Review
1. Incident Response
Plan
2. Final Security Review
3. Release Certification
1. Execute Incident
Response Plan

Application Security Stages -
Coming of Age
02

Beginning State
Sincere ignorance

Next State
Vicious Cycle
First assessment
Fix critical issues
Second assessment
Fix critical issues
Third assessment
Fix critical issues
…
…
N-th assessment
Fix critical issues

Application Security Process Inception
03

Attainable Goal 1 - Find Glaring Issues
Step 1 - Test Production Instances
Free Tools:
- OWASP Zed Attack Proxy
- Openssl.com for quick check of TLS profiles
5. Verification
1. Dynamic Analysis
2. Fuzz Testing
3. Attack Surface
Review

Attainable Goal 2 – Fix Issues Under Own Control
Step 2 - Check Own Code
Free Tools:
- Dependency Checker for 3-rd party components (weekly)
- SonarQube for code analysis (nightly)
- Clair for docker container analysis (weekly)
4. Implementation
2. Deprecate Unsafe
Functions
3. Static Analysis

Attainable Goal 3 – Catch Issues Before Coding Starts
Step 3 – Define Required Security Controls When Designing
and Perform Architectural Risk Analysis
Free Tools:
- Microsoft Threat Modeling Tool
3. Design
1. Design Requirements
2. Attack Surface
Reduction
3. Threat Modeling

Process Inception Checklist
Use special tickets to track vulnerabilities – it takes
some research to understand at which layer the fix
needs to be applied
Get stakeholder commitment to fix Critical issues
immediately
Get commitment to patch 3-rd party components

Steps to Maturity and Scaling
04

Maturity Goal 1 – Establish Continuous Assessment
Budget for Commercial Tooling
Evaluate and Implement 24/7 Dynamic Assessment Product
Scan Test Environments Before Promoting to Production
5. Verification
1. Dynamic Analysis
2. Fuzz Testing
3. Attack Surface
Review

Maturity Goal 2 – Integrate With Commercial Code Analysis Tools
Budget for Commercial Tooling
Scan for Viral Licenses
Scan for non-patched components
Perform Static code analysis for each build
4. Implementation
2. Deprecate Unsafe
Functions
3. Static Analysis

Maturity Goal 3 – Enforce Security Gates
Define thresholds and fail builds for critical items
2. Requirements
1. Security and Privacy
Requirements
2. Quality Gates
3. Security And Privacy
Risk Assessments

Maturity Goal 4 – Invest in Training
Establish Formal Security Training for Engineers With
Yearly Re-certification
Train and Certify Security Champions to Scale The Security
Program
1. Training
1. Core Security Training

Process Maturity Checklist
Establish Cross-team committee to review security
issues
Establish Timelines for fixing all security issues
Low to Critical
Automate 3-rd party component patching
Establish metrics for executive level reporting
(Risk Management Committee)

Conclusion
05

Customized SDL Steps With Little Initial Investment
1. Production
Scanning
6. Security
Gates
Enforcement
3. Threat
Modeling
2. Code Analysis
4. Continuous
Assessment
5. Automated
Code Analysis
7. Secure
Coding Training

Ultimately, People Make The Program Work

Useful Links to Free Tools
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
https://www.owasp.org/index.php/OWASP_Dependency_Check
https://www.sonarqube.org/
https://github.com/coreos/clair
https://www.microsoft.com/en-us/download/details.aspx?id=49168

@intralinks
@intralinks
SonarQube Demo
Bogdan Petru-Ungureanu| Security Architect| November 9, 2018

Thank You!
@intralinks
@intralinks
intralinks.com

Building application security with 0 money down

More Related Content

What's hot

Similar to Building application security with 0 money down

More from DefCamp

Recently uploaded

Building application security with 0 money down