Phillip Maddux gave a presentation on application security and deception in the cloud. He discussed the modern web landscape of microservices, APIs, and cloud platforms. He noted challenges with legacy security solutions like limited visibility, false positives, and lack of scalability. Maddux advocated for solutions that provide strategic and tactical visibility, dynamic detection without tuning, and leveraging cloud platform security features. He also discussed deception techniques like honeypots, lures, and automation to detect threats and collect intelligence on attackers in cloud environments. The goal is to make networks and clouds dangerous for attackers through deception.

1. Application Security &
Deception in the Cloud
Cloud Security Alliance - Raleigh
01/17/2018

2. Who Am I?
Phillip Maddux
Principle AppSec Researcher & Advisor
@SignalSciences
https://signalsciences.com
Career Summary
AppSec in Financials, EY & GS (~9 yrs)
WebDev, DBA, SA, IT Auditor (~7 yrs)
Online
Twitter: @foospidy
Blog: http://pxmx.io
LinkedIn: http://linkedin.pxmx.io
Github: http://github.com/foospidy
Honeypot Enthusiast
HoneyDB.io
HoneyPy

3. Deception
● What is deception?
● Honeypots 101
● What does all this provide?
● Having a deception program
● Goal
● Making your cloud dangerous
● Cloud specific considerations
Agenda
AppSec
● Modern Web
● Observations of Secure SDLC
● Legacy Visibility
● Moving Forward in the Modern
Web

4. AppSec
● Modern Web
● Observations of Secure SDLC
● Legacy Visibility
● Moving Forward in the Modern
Web

5. Describing the Modern Web
Frameworks & Architecture
● Client side: Angular, React, etc.
● Server side: API gateways & Microservices - API driven
Process
● Agile development cycles
● CI/CD
● DevOps
Platforms
● Cloud, e.g. IaaS, PaaS, FaaS
● Containers and Container orchestration (e.g. Kubernetes)
@foospidy

6. The modern web...
...is about services, frequent deployments,
and scalability.
@foospidy

7. AppSec
● Modern Web
● Observations of Secure SDLC
● Legacy Visibility
● Moving Forward in the Modern
Web

8. Secure SDLC Evolution
@foospidy

9. ML4 - Ultimate Secure SDLC Fantasy...
@foospidy

10. Agile!
@foospidy
Develop, test/verify, deploy to production. All
developers…
● Can have a copy of etsy.com on their laptops.
● Have access to deploy to production.
● Can deploy to production whenever they need to.
https://www.etsy.com

11. Agile!
@foospidy

12. However, Agile!
If we can deploy faster we can respond to threats faster.
But, visibility of threats is required.
A shift in thinking...
RSA Conference (2017) - “Tidal Forces: The changes ripping apart security as we know it”, by Rich Mogull.
@foospidy

13. AppSec
● Modern Web
● Observations of Secure SDLC
● Legacy Visibility
● Moving Forward in the Modern
Web

14. Shift Left!
Shift Left?
We’ve been doing that for years...
@foospidy

15. Shift Right
With the rapid adoption of cloud, it’s time we focused on
shifting right.
Read…
Security’s Shift Right by James Wicket
@foospidy

16. What happens after prod?
@foospidy

17. Log Challenges
@foospidy

18. WAF Challenges
@foospidy

19. Summary of Challenges
● We operate in silos (security, development, operations)
● Limited visibility into what is actually happening (e.g. threats).
● Static signatures resulting in false positives and disrupting the
development cycle, and even breaking production.
● Resource spend on maintaining/tuning, rather than on what is important -
mitigating threats.
● Existing solutions don’t scale well, not architected for cloud, not built for
the modern web.
@foospidy

20. AppSec
● Modern Web
● Observations of Secure SDLC
● Legacy Visibility
● Moving Forward in the Modern
Web

21. To Shift Right in the Modern Web
@foospidy

22. Visibility that is Strategic
@foospidy
● What type of attack traffic are
your apps experiencing?
● Which apps, and which parts of
your apps are being targeted?
● What type of anomalous traffic
are your apps experiencing?
We need to be able to answer
these questions as the answers
are feedback for your AppSec
program’s resources & priorities.

23. Visibility that is Tactical
@foospidy
We need the ability to
expose security data to
DevOps to foster
involvement.
● Dashboards on display.
● Integration into devops
tool chain.
● API for automation and
integration into other
monitoring solutions.

24. Detection & Blocking
@foospidy
We need detection that does not
require tuning and enables agile
development.
● Dynamic detection of attacks.
● Throttled blocking.
● Only block requests containing
attacks.
● Complete decision transparency.

25. Business Risk
@foospidy
We need the ability to go
above and beyond the typical
OWASP injection attacks.
● Account Takeover.
● High Risk Transactions.
● Bots.
We need to instrument our
applications for security!

26. Instrumentation & Correlation
@foospidy
● Attacks + anomalous responses
● Attacks + sensitive transactions
● Distinct changes in traffic patterns
● Automation (Bots) + user actions

27. Defending the Modern Web
@foospidy
We need…
Visibility that enables defending applications in real time.
You can’t defend against threats you can’t see.

28. Scalability
@foospidy
Any app layer security solution
must…
● Be scalable across cloud,
multi-cloud, and on-prem.
● Be a frictionless deployment.
● Work regardless of app stack
or language.
● Be performant and reliable.

29. Modern Cloud Platforms
@foospidy
We should leverage security features of modern cloud platforms…
Rotate, Repave, and Repair
https://builttoadapt.io/the-three-r-s-of-enterprise-security-rotate-repave-and-repair-f64f6d6ba29d
Cloud Foundry
https://www.cloudfoundry.org/
We need to be agile in production, keep moving!
Credentials
Disable Persistence
Patch Immediately

30. AppSec in the Modern Web
@foospidy
We need to continuously increase the cost for attackers.

31. Solution Options
@foospidy
Engineer application instrumentation.
https://codeascraft.com/2011/02/15/measure-anything-measure-everything/
https://vimeo.com/54107692
Start with Open Source and engineer around it.
https://github.com/nbs-system/naxsi
http://appsensor.org/

32. Deception
● What is deception?
● Honeypots 101
● What does all this provide?
● Having a deception program
● Goal
● Making your cloud dangerous
● Cloud specific considerations

33. What is deception?
@foospidy
Automation03
● Deployment
● Configuration
● Management
Lures
a.k.a. breadcrumbs02
● Files on endpoints w/server names or
credentials
● Browser history / bookmarks
● Database connection strings
Honeypot sensor01
● Service emulation
● Application layer - feature emulation
● Honey tokens - files or data

34. Honeypots 101
@foospidy
A networked system or application that appears to be of production use, but it’s
actual purpose is to detect malicious actors on the network.
● Types
○ Production
○ Research
● Interaction Levels
○ Low - less risk to operate
○ Medium - less risk to operate
○ High - more risk to operate

35. What does all this provide?
@foospidy
Primarily: High fidelity alerts
● Additional layer in your defense-in-depth strategy
● Detect intruders in cases of
○ Control failures
○ Detection / response failures
Secondarily: Intelligence
● Collect information on threat actor’s Techniques, Tactics & procedures.
● Motivation and targets.

36. Having a deception program
@foospidy
Considerations
● Scope - intruder vs. insider, or both?
● Output - alerts vs. intelligence, or both?
● Coverage - internal vs. external, or both?
● Assets - network, application, data?
● Validation - metrics and testing?
● Incident response - integration and prioritization?
● Audit & compliance?

37. Goal
@foospidy
Make your network dangerous,
for the attacker.
Desired Result

38. Making your cloud dangerous
@foospidy

39. Making your cloud dangerous
@foospidy
Maturity Level 1: Dedicated deception instances.

40. Making your cloud dangerous
@foospidy
Maturity Level 2: Blend deception in with production.

41. Cloud VPC Example
@foospidy
ML 1

42. Cloud VPC Example
@foospidy
ML 2

43. Cloud Specific Deception Considerations
@foospidy
○ App layer deception (taylored)
○ Legit services on non-standard ports, and deception services on standard
ports.
○ Storage buckets
○ Honey token documents
○ Access Accounts
○ Cloud log monitoring for honey tokens & accounts
Ultimately, think about instrumenting your cloud ecosystem for deception as that
will be targeted just as much as your applications.

44. Questions?
Twitter: @foospidy
Blog: http://pxmx.io
LinkedIn: http://linkedin.pxmx.io
Github: http://github.com/foospidy
Thank you!