This document summarizes a presentation about security testing for containerized applications. It discusses performing static analysis on code, dependencies, and Docker images using open source tools like Bandit, Brakeman, Find Security Bugs, TSLint, OWASP Dependency Track, and Clair. It also covers dynamic analysis using passive and active scanning with OWASP Zap. The presentation demonstrates running these security tests on a sample Lolcode application and integrating the tests into a CI/CD pipeline using OWASP Glue. It provides resources for learning more about security testing of containerized apps.

1. Join the conversation #DevSecCon
Security Testing for
Containerized Apps
@omerlh
@SolutoEng

2. http://lolcode.org/

3. - Helping people get the most out of their technology
https://www.solutotlv.com/

5. You Can’t Do it Alone

6. Letting Go Responsibly
AppSec @ Soluto:
● Threat Modeling
● Empowering
● Education
● Automation

7. Our Quest: Securing Containerized Apps

8. Code
Dependencies
Docker Image
Layers of Containerized App

9. What kind of security tests?
● Static
● Dynamic
● Integrated (which will be ignored)
By Using ONLY FOSS tools

10. Static Analysis

11. What?
● Scanning static assets (e.g. source code)
● Language aware
● Different Tools for different layer
● Point where is the issue
Code
Dependencies
Docker Image

12. Code Layer
● Scan the code for vulnerabilities
● Different tools for different languages
● Bandit – Python
● Brakeman – Ruby on Rails
● Find Security Bug - Java
● TSLint - TypeScript
● OWASP Source Code Analyzers list
Code
Dependencies
Docker Image

13. Example
https://snyk.io/blog/node-js-timing-attack-ccc-ctf/

14. Dependencies Layer
● 3rd party code used by the app
● Usually installed by a package manager
● PyPi, Gem, NuGet, NPM
● Each dependency might include known vulnerability
● OWASP Top 10 A9
● OWASP Dependency Track
Code
Dependencies
Docker Image

15. https://snyk.io/stateofossecurity/

17. NPQ

18. Docker Image Layer
● Contains the “OS”
● 3rd party software installed
● App engine (NodeJS/.NET Core etc)
● Each one could contain known vulnerabilities
● Multiple open source solutions
● Clair, Anchore, OWASP Dependency Track
Code
Dependencies
Docker Image

19. https://www.banyanops.com/pdf/BanyanOps-AnalyzingDockerHub-WhitePaper.pdf

20. Playing with Anchore-Engine

21. Dynamic Analysis

22. What?
● Scanning live app
● Language agnostic, protocol aware
● Only detect issues, not what cause to them
● Simple by using OWASP Zap
● Passive
● Active
● Leveraging Docker for local run
Code
Dependencies
Docker Image

26. Passive Scan
● Proxy black box tests
● Scan HTTP requests/responses
● HTTP static analysis
● Looks for security issues
● Fast, not risky
Code
Dependencies
Docker Image

27. Active Scan
● Discover all endpoint
● Craft malicious requests
● Test that the server can handle those request
● Slow, could cause damage
Code
Dependencies
Docker Image

28. Bringing it All Together

29. Building our CI/CD Pipeline
❑ Break the build or it didn’t happen
❑ False positives
❑ Keep it DRY
❑ Easy

30. Let’s add some Glue
The ”DevSecOps Tool”

31. Building our CI/CD Pipeline
✓ Break the build or it didn’t happen
✓ False positives
✓ Keep it DRY
✓ Easy

32. Image Certification
Only images that passed all the tests should be used on production
● Build dependency
● Image labels
● Image signing
● Image policy

33. What we have @ Soluto?
● Static analysis
✓ Source code scan
❑ Dependencies scan (in progress)
❑ Image scan
● Dynamic analysis
✓ Passive
❑ Active (in progress)

34. Demo Time
All the code is on GitHub

36. Testing LolCode App
● Static analysis?
✕ Nothing for source code
✕ No package manager (which is good?)
❑ Image scanning
● Dynamic analysis
✓ Passive
❑ Active

37. Let’s see it Live!
Hope it will work
… else I’ll show you slides with screenshots 

40. Wrapping Up

41. What we discussed
● Layers of Containerized Applications
● Kind of Tests & FOSS Tools
○ Static (OWASP Dependency Track)
○ Dynamic (OWASP Zap)
● Building the pipeline
○ OWASP Glue
○ Image Certification

42. Where Do I Start?

43. Our Quest: Securing Containerized Apps

46. Questions?

47. Resources
• TechBeacon: Security Tests for Containarized Applications
• Guide: Dynamic Security Testing with OWASP Zap
• Post: Dynamic Security Testing Made Easy
• Slides: Getting Started with OWASP Glue

48. Join the conversation #DevSecCon
Thank You!
@omerlh
@SolutoEng