Downloaded 10 times
Uploaded byPOSSCON
Cyber Security and Open Source
The document addresses the intersection of cyber security and open-source software, emphasizing the importance of knowledge to counter fear and misconceptions about open-source tools. It outlines common security threats, debunks myths surrounding open source, and advocates for the effective use of open-source resources and processes in software development. The speaker, Chad Cravens, shares insights from his experience and encourages embracing agile methodologies to enhance software security.
More Related Content
Similar to Cyber Security and Open Source
Cyber Security and Open Source
- 1. Cyber Security And OpenSource Managing Expectations, Reducing Fears and Understanding Reality Chad Cravens Open Source Systems www.ossys.com
- 2. About The Speaker 1OpenSource Systems – www.ossys.com 2007 - Graduate of New Mexico Institute of Mining and Technology (Scholarship for Service Recipient) 2007 – 2011 Federal Employee at SPAWAR (Space and Naval Warfare Systems Center) 2012 – Software Engineer at Small Wall St Firm 2014 – Founded Open Source Systems Chad Cravens Charleston, SC Software Fanatic Stickler for Software Quality and Security!
- 3. What Is CyberSecurity? 2Open Source Systems – www.ossys.com The state of being protected against the criminal or unauthorized use of electronic data, or the measures taken to achieve this. - Confidentiality - Availability - Integrity
- 4. Life in theday of a Program Manager 3Open Source Systems – www.ossys.com Walk a day in her shoes….. People Personalities Customers Burn Rates Teams Processes Budgets Implementation IntegrationHiring Stakeholders Deadlines Vendors Technology
- 5. What is theIssue with Open Source? 3Open Source Systems – www.ossys.com Who’s afraid of the Boogey Man? False Expectations Appearing Real What is this “Open Source” thing? -- A FEAR of the unknown --
- 6. Let’s Use thisOpen Source Tool! 3Open Source Systems – www.ossys.com Billy Bob from dev team 6 suggests We use this open source product What is the license? Is it supported? Who developed it? What’s the cost? Is it accredited?
- 7. We are yourSuper-Vendor! 3Open Source Systems – www.ossys.com Mr. Big-Name Vendor in a suit says we should use their product instead What is the license? Is it supported? Who developed it? What’s the cost? Is it accredited? YES YES YES YES YES YES YES YES YES YES YES YES YES YES
- 8. Turn FEAR intoKnowledge 3Open Source Systems – www.ossys.com The Right Tool for the Right Job
- 9. First, What arethe threats? 3Open Source Systems – www.ossys.com • Zero-day Exploits • Web-Based Attacks • Ransomware • Social Media Scams • Phishing • Internet of Things • Mobile Attacks http://www.symantec.com/content/en/us/enterprise/other_resources/b-istr_main_report_v19_21291018.en-us.pdf
- 10. Second, Debunk theMyths 3Open Source Systems – www.ossys.com First thing, “Open Source” is BIG: Operating Systems Enterprise Libraries Message Brokering Encryption Embedded Systems Programming Languages Front-End Development MVC Frameworks Network Devices Mobile
- 11. “Big Guys” GoingOpen Source 3Open Source Systems – www.ossys.com Tesla released all patents as open source Netflix custom software released as open source .NET Core is now open source Oracle acquired Sun, giving it Java and MySQL
- 12. Open Source inthe Government 3Open Source Systems – www.ossys.com http://www.data.gov/ https://government.github.com/community/ http://mil-oss.org/ http://code.nasa.gov/ April, 2009 Whitehouse Report
- 13. Debunking Myths 3Open SourceSystems – www.ossys.com “Open Source is Insecure” Reality: - Source code is not needed to circumvent security - Licensing has little effect on the security of software “Open Source is More Secure” Reality: - Open-sourcing bad / insecure code will not make it secure - Only good coding practices will create secure code - Having more reviewers may benefit the security of a project
- 14. Debunking Myths 3Open SourceSystems – www.ossys.com “Anyone Can Contribute Malicious Code” Reality: - Projects have a core team of contributors - Additions to the code are analyzed before merged “Hackers Can More Easily Exploit” Reality: - Tools allow tracing of binaries, the exploit is in the binary not the code - Hackers do not need source code to exploit
- 15. Exploit Example! 23Open SourceSystems – www.ossys.com Human Ingenuity Knows No Bounds <div style="background:url('javascript:alert(1)')"> The MySpace Worm – Samy Is My Hero <div id="mycode" expr="alert('hah!')" style="background:url('javascript:eval(document.all.mycode.expr)')"> JavaScript in a background CSS attribute in a <div> tag: Putting javascript in an expr attribute <div id="mycode" expr="alert('hah!')" style="background:url('javascript:eval(document.all.mycode.expr)')"> Putting javascript in an expr attribute <div id="mycode" expr="alert('hah!')" style="background:url('java script:eval(document.all.mycode.expr)')"> Using newlines to bypass filtering of “javascript”
- 16. Security is AboutManagement 23Open Source Systems – www.ossys.com Program Defensively! 1. Injection Flaws 2. Broken Authentication / Session Management 3. Cross-Site Scripting 4. Insecure Direct Object References 5. Security Misconfiguration 6. Sensitive Data Exposure 7. Missing Function Level Control Access 8. Cross-Site Request Forgery 9. Using Components with Vulnerabilities 10. Unvalidated Redirects and Forwards
- 17. Security is AboutKnowledge 23Open Source Systems – www.ossys.com
- 18. Security is AboutProcesses 23Open Source Systems – www.ossys.com Embrace Agile! What Agile Is Not: • A Buzzword for Companies • A Fad • A JIRA Account What Agile Is: • A Suite of Processes, Methodologies and Tools • Testing • Metrics • Automation
- 19. Use Open SourceEffectively 23Open Source Systems – www.ossys.com Use ORM tools to help mitigate SQL injection Use unit testing to build test suites against your code Use Jenkins for testing and build automation Use SonarQube for code quality testing (PMD / FindBugs)
- 20. Use Open SourceEffectively 23Open Source Systems – www.ossys.com Use OWASP Zap to dynamically scan web-based software Use picketlink for XACML policy enforcement Use OpenSSL for Cryptographic functions Use AspectJ for Logging and configuration management
- 21. Use Open SecurityStandards 23Open Source Systems – www.ossys.com
- 22. Use Mature OpenSource Projects 23Open Source Systems – www.ossys.com
- 23. Roots in OpenSource 23Open Source Systems – www.ossys.com Cyber Security has roots in Open Source
- 24. Open Source CyberLab 23Open Source Systems – www.ossys.com
- 25. Thank you! 23Open SourceSystems – www.ossys.com