Understanding how data flows into, across components, and out of an application is critical for security and performance. Yet, modern software development is making data flow and data leakage identification increasingly complex. Faster release cycles, leveraging modular architectures/microservices, open source libraries and APIs makes it harder to understand the totality of how critical data is handled. For example, is personally identifiable information or device tokens being logged in Splunk? Are hard-coded credentials being pushed to GitHub? Is a microservice storing decrypted payment card information in S3? Lastly, for organizations with EU resident data, GDPR has significantly expanded the definition of what sensitive information is. Thus, the challenge of managing flows is further exacerbated.

1. Mapping Data Flows Across
Apps, Microservices & APIs
Presented by:
Etan Lightstone, VP of Product Design

2. Agenda
• Mapping Data Flows is Getting Harder
• Common Leakage Scenarios
• Mapping Flows with Semantic Graphing
• Demo
• Q&A

3. 2.5 quintillion bytes of data is created every day

4. Mapping Data Flows is Getting Harder
Faster releases
Less time to
understand code
Modular
architectures
More siloed
knowledge
Open source & 3rd
Party APIs
More complexity &
external leakage
GDPR & CA Privacy
Act 2018
More types of data
become critical

5. CRM
Logs
Data Flows & Leakage
Storage Buckets
Database
Customer
Microservice
A
Microservice
B
Microservice
C
Microservice
D
Code Repository

6. Virtual Machine (Java VM)
Web Framework (Spring Boot)
Open Source Dependencies
Your Application
Logic
Your Application Stack’s Code Property Graph
SemanticGraphing

7. Example information flow

8. Querying the graph for visibility & security issues
Semantic
Graph
Exit Points
Entry Points
Vulnerabilities
Dependencies
Custom code
Data Leaks
Security DNA

9. Demo

10. Free Data Leakage Assessment
• Discovery & classification of sensitive data
• Handling across microservices & exit points
• GDPR compliance readiness
• Discovery of known & unknown vulnerabilities
Sign-up here:
• https://go.shiftleft.io/data-leakage-assessment

13. Free Data Leakage Assessment
• Classification
• Handling
• GDPR
• Vulnerabilities
Sign-up:
• https://go.shiftleft.io/data-
leakage-assessment