Make it Fixable (CppCon 2018)

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

@pati_gallardo
T
S

Make it Fixable
Living with Risk
Patricia Aas
CppCon 2018
T
S
@pati_gallardo

Patricia Aas - Consultant
Programmer, Application Security
Currently : T S
Previously : Vivaldi, Cisco Systems, Knowit, Op...

Security is Hard @pati_gallardo
5

Just Remember :
- You live in the real world
- Take one step at a time
- Make a Plan
@pati_gallardo
6

You Need A Security
“Hotline”
security@example.com
Symbiotic relationship
Be polite
Be grateful
Be professional
Be efficie...

- What is a System? - What is a vulnerability? -
@pati_gallardo
8

1. Unable to Roll Out Fixes
2. No Control over Dependencies
3. The Team is Gone
4. It’s in Our Code
5. My Boss Made Me Do ...

Unable to Roll Out Fixes
1
@pati_gallardo
10

Unable to
Roll out Fixes
Unable to Update
Unable to Build
@pati_gallardo
11

Internet of Things
Toys: My Friend Cayla, i-Que Intelligent
Robots, Hello Barbie
Mirai: Botnets created with IOT
devices, ...

Internet of Things
- Auto-update
- Different default passwords
- Unboxing security (make the user
change the password)
“Sh...

Fix : Ship It!
Holy Grail : Continuous Deployment and
Auto Update
- A Build Environment
- Update Mechanism
Unable to Roll ...

Some systems
should not be “fixed”
A major election software maker
allowed remote access on its systems
for years
Exceptio...

No Control over Dependencies
2
@pati_gallardo

No Control over
Dependencies
No inventory
No update routines
No auditing
@pati_gallardo
17

Equifax Breach
Known vulunerability in Apache
Struts 2
Heartbleed
Bug in openssl
Left-Pad
Developer unpublished a
mini-Js ...

Equifax Breach
Continuous Dependency Auditing
Heartbleed
Control over production
environment
Left-Pad
Remove unnecessary d...

Fix: Control It!
Goal : Largely Automated Dependency
Monitoring
Remember transitive
dependencies
Monitor and Update
No Con...

The Team is Gone
3
@pati_gallardo
21

The Team Is Gone
- Team were consultants
- They were downsized
- The job was outsourced
- “Bus factor”
- “Binary blob”
- A...

Fix : Own It!
Goal : Complete Build Environment
Fork it, own it
The Team Is Gone.
@pati_gallardo
23

Use It!
@pati_gallardo
24

It’s in Our Code
4
@pati_gallardo
25

It’s in Our Code
Congratulations!
This is Actually
the
BEST CASE SCENARIO
@pati_gallardo
26

Keeper Password Manager
- Reporter: Tavis Ormandy
(@taviso)
- “allowing any website to
steal any password”
- Browser plugi...

gitlab.com
- “rm -rf”
- Sysadmin maintenance
- Cascading errors as backups
fail
- All logged Publicly in real
time
Transpa...

Fix : Live It!
Goal : Prevent & Cure
Prevention is great,
but
the Cure is to Ship
It’s In Our Code
29
@pati_gallardo

My Boss Made Me Do It
5
@pati_gallardo
30

My Boss Made Me Do It
The Feature
is the Bug
How?
- Security Problem
- Privacy Problem
- Unethical
- Illegal @pati_gallard...

Capcom's Street Fighter V
- Installed a driver
- “anti-crack solution”
“...disables supervisor-mode execution
protection a...

KrebsOnSecurity: "For
2nd Time in 3 Years,
Mobile Spyware Maker
mSpy Leaks Millions of
Sensitive Records"
@pati_gallardo
33

Fix : Protect It!
Goal : Protect your user
Prevent : Protect your team
- Workers rights
- Team can diffuse blame
Cure : Pr...

Google: DragonFly
- "A plan to launch a censored search
engine in China"
- Employee authors a memo
- Internal protests
Mae...

Ship It, Control It, Own It, Live It & Protect It
@pati_gallardo
36

- You need a Security Hotline
- You Have to Ship
Recap
@pati_gallardo
37

Designing the User Experience of Security
6
@pati_gallardo
38

@pati_gallardo
39

The Users Won’t Read
Error blindness
“Just click next”
“Make it go away”
40
@pati_gallardo

Fix : Less is More
Don’t leave it to the user
Have good defaults
Be very explicit when
needed
41
@pati_gallardo

They Trust You
With Personal Information
With Data
With Money
42
@pati_gallardo

Fix : Be Trustworthy
Only store what you have to
Back up everything
Use third party payment
Be loyal to your end user
43
@...

Ship It, Control It, Own It, Live It & Protect It
Design For It
@pati_gallardo
44

T
S
P f .
Patricia Aas, T S
@pati_gallardo

@pati_gallardo
T
S

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1030405 views
Storytelling For The Web: Integrate... by Chiara Aliotta 941265 views
Artificial Intelligence, Data and C... by OECD Directorate ... 859475 views
How to Leverage AI to Boost Employe... by SocialHRCamp 360179 views
2024 State of Marketing Report – by... by Marius Sescu 204862 views
Everything You Need To Know About C... by Expeed Software 225716 views

View on Slideshare

1 of 46 Ad

View on Slideshare

1 of 46 Ad