Practical appsec lessons learned in the age of agile and DevOps

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Zane Lackey
Practical AppSec Lessons Learned in the
Age of Agile and DevOps
ASD-R02
Co-Founde...

#RSAC
Who you’ll be heckling today
Started out in offense
Pentester / researcher at iSEC Partners / NCC Group
Moved to def...

#RSAC
So what is this talk about anyway?
Lessons learned adapting AppSec/SDLC from a Waterfall world to the
DevOps/Cloud w...

#RSAC
Spoiler: Security shifts from being a gatekeeper to enabling teams to be
secure by default

#RSAC
What has changed?

#RSAC
The new realities in a DevSecOps world
1. Changes happen multiple orders of magnitude faster than previously
 Deplo...

#RSAC
The new realities in a DevSecOps world
The combination of these two means security can no longer be
“outsourced” to ...

#RSAC
How do legacy AppSec approaches fare
in a DevSecOps world?

#RSAC
An example of legacy AppSec approaches in a DevOps world

#RSAC
Select components of common SDLCs
Developer Training
Threat modeling
Design Reviews
Static Analysis
Dynamic Scanning...

#RSAC
What pieces of the SDLC need to adapt the most?

#RSAC
Which components we’ll discuss today
Developer Training
Threat Modeling
Design Reviews
Static Analysis
Dynamic Scann...

#RSAC
Static Analysis: It’s not a party until the 32847326th page of
the report!

#RSAC
Static Analysis (legacy)
Traditionally done as heavyweight process:
— Run once a week/month resulting in a large out...

#RSAC
How do we adapt this control?

#RSAC
Static Analysis (modern)
Shift from from a top down model to a bottoms up one:
— Identify specific classes of vulner...

#RSAC
Static Analysis (modern)
Example: Rather than trying to start with static analysis for XSS, SQLi, Directory
Traversa...

#RSAC
Static Analysis (modern)
Identify use of certain primitives that should initiate a conversation with the security
te...

#RSAC
Static Analysis (modern)
Build proactive alerting to know when sensitive and rarely changed portions of the
codebase...

#RSAC
Dynamic Scanning

#RSAC
Dynamic Scanning (legacy)
Dynamic Scanning (legacy):
Used to meet a baseline standard of discovering vulnerabilities...

#RSAC
How do we adapt this control?

#RSAC
Dynamic Scanning (modern)
Applications architectures and functionality have changed significantly
since scanners wer...

#RSAC
Dynamic Scanning (modern)
1. Ensuring that security policies are being enforced
— Ex: TLS only supporting strong cip...

#RSAC
Security Visibility

#RSAC
Security Visibility (legacy)
Logs, customer service reports, outages
Each source of information was generally isolat...

#RSAC
How do we adapt this control?

#RSAC
Security Visibility (modern)
GOAL: Break down the previous silos of data isolation and empower
security, development...

#RSAC
This graph provokes wildly different assumptions from
Development, DevOps, and Security teams

#RSAC
Give everyone the data they need. Context is key, for *all*
groups
+

#RSAC
Feedback

#RSAC
Feedback (legacy)
Typically done as annual pentests
Unfortunately this really only answers the question “do I have
b...

#RSAC
How do we adapt this control?

#RSAC
Feedback (modern)
Combination of bug bounty + pentests
Bounty is not a replacement for pentest, it augments pentest
...

#RSAC
PENTEST
BOUNTY
DAST
HIGH COVERAGE
LOW FREQUENCY HIGH FREQUENCY
LOW COVERAGE

#RSAC
Break out the Thought Leader-hosen!
It’s time for some thoughts on where modern Application
Security should be heade...

#RSAC
The hallmark of a modern AppSec program is the combination of
continuous feedback + visibility

#RSAC
Or: To be successful against real attackers, you need to be able to
answer the question:
“How do I know when my atta...

#RSAC
Three pillars of effective visibility + continuous
feedback
1. Ability to detect attackers as early as possible in t...

#RSAC
Three pillars of effective visibility + continuous
feedback
3. Ability to continuously test and refine your incident...

#RSAC
Continuous feedback loop success story
“I discovered the vulnerability late Friday afternoon and wasn't
quite ready ...

#RSAC
Conclusions

#RSAC
The thesis of modern application security is about
shifting
From: A mindset of “Exclusively focus on gatekeeping con...

#RSAC
Thanks!
zane@signalsciences.com @zanelackey

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 44 Ad

View on Slideshare

1 of 44 Ad