Put yourself in the appsec pipe - Paolo Perego - Codemotion Milan 2016

•

2 likes•409 views

Create secure software is more than run a penetration test or a code review, just before the deploy and having some automatism can help you in have a low error rate process. In this talk we will go through the pipeline building process, explaining how to automate some boring tasks dedicating ourself to having fun, playing tricks like pros. At the end of our journey both tech people than security managers, will have the feeling that using the pipeline approach, they can lower vulnerabilities, with an affordable time to market so to make the bosses happy.

Putyourselfinthe#appsecpipeline
Paolo Perego - thesp0nge
MILAN 25-26 NOVEMBER 2016

$whoami
• 15 anni nell’industria #itsec
• Tech blogger @codiceinsicuro
• ❤ sviluppare security source
code scanners (Owasp Orizon,
dawnscanner)
• ❤ tenere talk su temi di
#appsec
• Seguimi su @thesp0nge

Agenda
• Talk about testing scenarios
• Talk about what an appsec pipe is and what do you
need to create one
• Be inspired, go home and do some homework

Wedon’tdoanytest
(and we are aware of it)

Wedosecuritytest
(but I want to learn more about the pipeline)

Theunacceptablesolution…
• Tests must be done:
• in production environment
• before going live
• Testers need:
• the code being frozen
• some “fake” accounts
• a couple of week to do the job

…foradifficulttask
• Products can not delay time to market
release to allow security tests
• Tests must be performed on each
release
• Often companies do releases on a
weekly basis
• There are no fake accounts on a
production server
• Code is never on a frozen state
• This applies to web properties and
mobile applications
• Tests are not sawn as investment

#appseccan’tbedonethisway
and we’re the first talking our science to the next level

Beforewestart
• We need
• Commitment
• An organised SDLC
• A development team aware
about #appsec topic
• An #appsec team (with patience
and some coding skills)

Thenwecanbuildthe#appsecpipeline
(https://www.owasp.org/index.php/OWASP_AppSec_Pipeline)

Thecollectortool
A way for our customer to ask for services, keep track about the progress and
having results back

Yourfavouritecollectionof#appsectools
You may want to cover vulnerability assessment, penetration test, web application
penetration test and code review at least. Keep calm and let’s go shopping.

TheOrchestrator
Your customers ask for services, you need an automatic dispatcher mechanism to
the appropriate tool. Of course you need also something retrieving results too.

Theticketingsystem
You need something to keep track about vulnerabilities, about their history and
their state.

AGrapebasedorchestratortoruntoolinourpipeline
Very alpha - Opensource - Integrates Nmap, Dawnscanner and Owasp ZAP

Sometoolstocheck
• Sinatra with Grape (create HTTP API
endpoints)
• Owasp ZAP (WAPT on steroids)
• Owasp DeepViolet (check your SSL config)
• Nexpose + nexpose gem (automate
vulnerability assessment)
• Brakeman/Dawnscanner (ultimate ruby
code review)
• Owasp Orizon (Java security code review)
• Owasp GLUE gem (pipeline related tool)
• Canaveral (a Grape based orchestrator for
your pipeline)

This document discusses testing microservices in distributed systems. It describes the challenges of the traditional testing pyramid for monoliths when applied to distributed systems. It then introduces consumer-driven contract testing using PACT as an approach that allows independent development while preventing breaking changes. Key aspects of PACT include defining expectations between services, enabling early detection of issues, and facilitating communication between teams. The document also discusses reshaping the testing pyramid with a focus on integration testing and post-deployment monitoring and verification for safe rollouts.

Peeling the Onion: Making Sense of the Layers of API Security

Matt Tesauro

This document provides an overview of API security from multiple perspectives: API security posture, runtime security, and security testing. It discusses the complex API ecosystem involving various stakeholders. The document also outlines common API attack classes like DDoS, data breaches, and abuse of functionality. Finally, it provides key takeaways that APIs have complex interconnected systems, require coordination across teams, and need to be evaluated from different security perspectives.

Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...

Matt Tesauro

You’ve probably heard many talks about DevSecOps and continuous security testing but how many provided the tools needed to actually start that testing? This talk does exactly that. It provides an overview of the open source AppSec Pipeline tool which has been used in real world companies to do real security work. Beyond a stand alone tool, the OWASP AppSec Pipeline provides numerous docker containers ready to automate, a specification to customize with the ability to create your own implementation and references to get you started. The talk will also cover how to add an AppSec Pipeline to your team’s arsenal and provide example templates of how best to run the automated tools provided. Finally, we’ll briefly cover using OWASP Defect Dojo to store and curate the issues found by your AppSec Pipeline. The goal of this talk is to share the field-tested methods of two AppSec professionals with nearly 20 years of experience between them. If you want to start your DevSecOps journey by continuously testing rather then hear about it, this talk is for you.

Automated Security Testing (2)

Srikanth Nellore

This document discusses automated security testing. It begins with an agenda that includes what security testing is, why testers need to worry about it, why automate it, how to automate it, a demo, and resources. Security testing reveals flaws in security mechanisms and is part of software testing. Automated security testing can detect vulnerabilities early, reduce costs by lessening the need for security professionals, and use existing automated functional tests with attack proxies and scans. The document demonstrates how attack proxies work and provides resources for security testing tools.

ASP.NET SignalR 2.0

John Patrick Oliveros

Continuous Security: Using Automation to Expand Security's Reach

Matt Tesauro

Any optimization outside the critical constraint is an illusion. In DevSecOps , the size of the security team is always the most scarce resource. The best way to optimize the security team is automation. This talk provides an overview of key DevSecOps automation principles and provide real world experiences of creating DevSecOps Pipeline’s augmented with automation in multiple enterprises. Getting started can feel overwhelming but this talk provides coverage of the fundamental building blocks of adding automation to an DevSecOps program including API integration, webhooks, Docker, ChatOps and a vulnerability repository to manage all the issues discovered. The talk covers how DevSecOps automation has provided significant increases in productivity at several different companies in different verticals. Multiple potential architectures for DevSecOps automation will be covered with the goal of inspiring the audience to adopt one of these for their program. By taking an example, customizing it to fit their situation, attendees will have a roadmap to start their security automation journey.

Intro to DefectDojo at OWASP Switzerland

Matt Tesauro

This document introduces Fred Blaise and provides information about OWASP DefectDojo. DefectDojo is an open-source application vulnerability correlation and security orchestration tool that consolidates findings from multiple tools, tracks vulnerabilities, and enables automation through its REST API. It can ingest reports from many common security tools and helps automate previously manual processes to improve security and allow small teams to manage large application security programs. The document demonstrates how DefectDojo can be deployed in various environments and discusses its features, community, and recent improvements.

OWASP DefectDojo - Open Source Security Sanity

Matt Tesauro

Since the Kickstarter campaign in August 2012, Oculus Rift targeted games for Virtual Reality. "If a game works, then everything will work". Even though VR has been used a lot for business and industrial purposes, the community of VR and game developers pushed forward the platform and the limits of this new medium. In this talk I will analyze the process of design and development of Yon Paradox, sharing our results on what went good and what didn't work.

Pronti per la legge sulla data protection GDPR? No Panic! - Stefano Sali, Dom...

Codemotion

Keynote: Community Innovation Alaina Percival - Codemotion Milan 2016

Codemotion

Alaina Percival is the founder of Women Who Code, an organization with over 80,000 members across 60 cities and 20 countries that aims to inspire women to pursue technology careers. She discusses how the tech industry is facing a shortage of hundreds of thousands of jobs that the current market is unprepared to fill, and how women leave tech careers in disproportionately high numbers. Her presentation provides strategies for how companies can improve their diversity by changing practices related to hiring, interviews, management, and advancement.

Keynote: The Most Important Thing - Mike Lee - Codemotion Milan 2016

Codemotion

Steve Jobs used to always talk about the "most important thing," what he sometimes called the "high-order bit," the thing we should be working on, and thinking about, to the exclusion of others. What does it mean? How do we recognize it? Why is it important? What is our "most important thing," and what is the most important "most important thing"? This might sound trivial, but it’s not. This talk will be inspiring, but it will also be upsetting. Often the most important thing is not what we wish it was, and finding it can be like Armageddon, as your entire future is destroyed.

The game design behind Redout - Giuseppe Enrico Franchi - Codemotion Milan 2016

Codemotion

The development of our AG racing game Redout has been quite a ride. Started in 2014, when 34BigThings was still a bunch of friends working in a living room, it has gone through many epiphanies and revolutions before taking its final shape. In this talk I will go through the development stages of the Redout game product: I'll talk about track design and game flow, interface design, vehicle handling, community management, talking to publishers and the press, attending events, observing players play, and how all this influenced the overall design of the game and my own knowledge of game design.

Milano Chatbots Meetup - Paolo Montrasio - Codemotion Milan 2016

Codemotion

Elixir and Lambda talk with a Telegram bot - Paolo Montrasio - Codemotion Mil...

Codemotion

The talk demonstrates a working system made of an Elixir program running on a Raspberry Pi that scans the Wi-Fi spectrum and collects presence data; an AWS Lambda JavaScript function that receives those data and stores them into a DynamoDB instance; a Telegram bot, also running on Lambda, which sends alerts based on the number of presences. The focus will be on the overall architecture and the most important parts of the code. We'll show some Lambda automation tools and how to test the components locally. All the source code will be on GitHub. Ideal talk to get started with those technologies.

Games of Simplicity - Pozzi; Molinari - Codemotion Milan 2016

Codemotion

The document announces a games of simplicity event hosted by We Are Müesli on November 25-26, 2016 in Milan. We Are Müesli is an Italian game design and visual design studio founded by Claudia Molinari and Matteo Pozzi. The event will explore simplicity in game design based on John Maeda's six laws of simplicity from his 2006 book, which are reduce, organize, focus, efficiency, empathize and trust. A number of simple, minimalist games will be presented as examples that demonstrate Maeda's laws.

Universal JavaScript Web Applications with React - Luciano Mammino - Codemoti...

Codemotion

Since we started to see JS on the server side, the dream of developers has been to reduce the gap and the cost of switch between frontend/backend. Today with Node.js, React and a whole ecosystem of tools, this dream is becoming true! In this talk I am going to discuss about Universal (a.k.a. Isomorphic) JS and present some practical example regarding the major patterns related to routing, data retrieval and rendering. I will use Node, React, Webpack, Babel and React Router and give you a series of example to get you started easily with this new technology trend.

Public speaking 4 geeks - Lorenzo Barbieri - Codemotion Milan 2016

Codemotion

Speaking in public is not easy, especially for geeks, that tend to be too technical, or too shy, or too something... In this session we'll start with some basic tips and we'll see how to dramatically improve our results using well defined techniques. We'll also see (with practical examples) how to deal with problems during speeches, elevator pitches, product presentations, interviews, and so on. Public speaking skills are not useful to conference speakers only, everybody needs to improve them, especially geeks!

Big Data, Small Dashboard - Andrea Maietta - Codemotion Milan 2016

Codemotion

Big data is the new black. We have more data than we could use, but what we really need is information. The typical dashboard is completely crammed with colourful 3D pies, uncountable lines and tons of extra-thick tables. And nobody understands anything. Knowledge is power. But to be able to know you first have to understand. In this talk we shall see how to transform a terribile mess into a clean and informative dashboard, moving step by step and explaining the reasonings between each passage. At my signal... unleash knowledge!

Microservices done right or SOA lessons learnt - Sean Farmar - Codemotion Mil...

Codemotion

Come rendere il proprio prodotto una bomba creandogli una intera community in...

Codemotion

This document provides tips for building a community around a product. It emphasizes that community is key to long-term success and going far with a product. Some tips include starting small and growing organically, being inclusive, listening to the community, being transparent in development, and creating rituals and events to foster interaction and belonging. The overall message is that community is about bringing people together in shared experiences and goals, not just about the product itself.

Understanding Angular 2 - Shmuela Jacobs - Codemotion Milan 2016

Codemotion

Angular 2 is a complete rewrite of the AngularJS framework, which introduces new approaches and leverages the latest technologies. Simplifying and generalizing core concepts, the performance is improved and the range of capabilities is broadened. In this session Shmuela will help you understand the core concepts of Angular 2 apps: the component-based architecture, dependency injection, change detection, and more.

SASI, Cassandra on the full text search ride - DuyHai Doan - Codemotion Milan...

Codemotion

Apache Cassandra is a scalable database with high availability features. But they come with severe limitations in term of querying capabilities. Since the introduction of SASI in Cassandra 3.4, the limitations belong to the pass. Now you can create performant indices on your columns as well as benefit from full text search capabilities with the introduction of the new LIKE %term% syntax. To illustrate how SASI works, we'll use a database of 100 000 albums and artists.

Sviluppare applicazioni cross-platform con Xamarin Forms e il framework Prism...

Codemotion

Xamarin Forms consente di sviluppare applicazioni cross-platform utilizzando C# e di condividere non solo la business logic (come consente già di fare l’approccio tradizionale), ma anche l’interfaccia utente, grazie ad un linguaggio basato sullo XAML, i cui elementi vengono poi convertiti in tempo reale in controlli nativi, garantendo perciò una user experience coerente con quella attesa dall’utente su Android, iOS e Windows. Nel corso di questa sessione vedremo come strutturare al meglio un progetto Xamarin Forms, grazie al pattern MVVM e al framework open source Prism.

Sviluppare applicazioni nell'era dei "Big Data" con Scala e Spark - Mario Car...

Codemotion

Scala è un linguaggio di programmazione general purpose multi-paradigma pensato per realizzare applicazioni ad alte prestazioni che girano all'interno della Java Virtual Machine. Spark è il framework "Big Data", basato su Scala, più flessibile e performante disponibile oggi sul mercato. Durante il talk verrà introdotto il linguaggio Scala e verranno mostrate le potenzialità legate al suo utilizzo nell'ambito dello sviluppo di applicazioni web di ultima generazione compresa la possibilità di processamento parallelo di grandi quantità di dati attraverso l'utilizzo del framework Spark.

DevOps in Cloud, dai Container all'approccio Codeless - Gabriele Provinciali,...

Codemotion

Un approccio moderno allo sviluppo software dovrebbe sfruttare linguaggi ed ambienti appartenenti a diverse tipologie di innovazione: DevOps per automatizzare continuous integration e continuous delivery, il Cloud per gestire il ciclo di vita del software in qualsiasi momento, i Software Containers per raggiungere livelli di scalabilità adeguati alle dimensioni dell’audience e un approccio Codeless per confezionare applicazioni e cruscotti ad uso dell’utenza business. Il talk sarà articolato intorno a queste quattro aree mostrando principalmente esempi pratici.

How To Structure Go Applications - Paul Bellamy - Codemotion Milan 2016

Codemotion

1. The document discusses various ways to structure Go applications, including grouping code by domain, using interfaces to define dependencies, and separating applications into modules that can be tested independently. 2. It recommends creating packages for different parts of an application, such as an API, email provider, database adapter, and defining interfaces to abstract dependencies. 3. A sample application structure is shown with packages for the domain objects, API, email provider, database adapter, and a command package containing the executable.

Milano Chatbots Meetup - Vittorio Banfi - Bot Design - Codemotion Milan 2016

Codemotion

Put yourself in the #appsec pipeline

Paolo Perego

This document discusses building an application security (appsec) pipeline. It begins by outlining common unacceptable testing scenarios where tests are done in production without proper preparation. It then introduces the concept of an appsec pipeline, highlighting the need for commitment, an organized software development lifecycle, and an appsec-aware development team. The document recommends key components of an appsec pipeline including a collector tool to manage requests and results, a set of appsec testing tools, an orchestrator to dispatch tests, a ticketing system to track vulnerabilities, and a workflow to integrate all components. It also provides examples of useful tools that could be included in the pipeline.

App sec and quality london - may 2016 - v0.5

Dinis Cruz

This document provides an overview of a 103 slide presentation on application security and software quality by Dinis Cruz. The presentation covers topics such as unit testing, threat modeling, containers, security testing tools, and techniques for building a modern security engineering organization. It emphasizes the importance of test-driven development, code coverage, and automation to both improve software quality and enable effective application security. The overall thesis is that application security can be used to define and measure software quality.

Viewers also liked

Virtual Reality gaming: analysis of Yon Paradox development - Fabio Mosca - C...

Codemotion

Pronti per la legge sulla data protection GDPR? No Panic! - Stefano Sali, Dom...

Codemotion

Keynote: Community Innovation Alaina Percival - Codemotion Milan 2016

Codemotion

Keynote: The Most Important Thing - Mike Lee - Codemotion Milan 2016

Codemotion

The game design behind Redout - Giuseppe Enrico Franchi - Codemotion Milan 2016

Codemotion

Milano Chatbots Meetup - Paolo Montrasio - Codemotion Milan 2016

Codemotion

Elixir and Lambda talk with a Telegram bot - Paolo Montrasio - Codemotion Mil...

Codemotion

Games of Simplicity - Pozzi; Molinari - Codemotion Milan 2016

Codemotion

Universal JavaScript Web Applications with React - Luciano Mammino - Codemoti...

Codemotion

Public speaking 4 geeks - Lorenzo Barbieri - Codemotion Milan 2016

Codemotion

Big Data, Small Dashboard - Andrea Maietta - Codemotion Milan 2016

Codemotion

Microservices done right or SOA lessons learnt - Sean Farmar - Codemotion Mil...

Codemotion

Come rendere il proprio prodotto una bomba creandogli una intera community in...

Codemotion

Understanding Angular 2 - Shmuela Jacobs - Codemotion Milan 2016

Codemotion

SASI, Cassandra on the full text search ride - DuyHai Doan - Codemotion Milan...

Codemotion

Sviluppare applicazioni cross-platform con Xamarin Forms e il framework Prism...

Codemotion

Sviluppare applicazioni nell'era dei "Big Data" con Scala e Spark - Mario Car...

Codemotion

DevOps in Cloud, dai Container all'approccio Codeless - Gabriele Provinciali,...

Codemotion

How To Structure Go Applications - Paul Bellamy - Codemotion Milan 2016

Codemotion

Milano Chatbots Meetup - Vittorio Banfi - Bot Design - Codemotion Milan 2016

Codemotion

Viewers also liked (20)