Security and Data Breach by Bobby Limitra

1. PAGE1
DEVOPS INDONESIA
PAGE
1
Bobby Limitra
Solutions Engineer, F5
Jakarta, 10 Juni 2020
Security and Data Breach

2. Security and Data Breach
What & How it Happened? How to Mitigate?
Bobby Limitra
Solutions Engineer, F5 Networks

3. “Data Breach is a security violation in which
sensitive, protected or confidential data is copied,
transmitted, viewed, stolen or used by an individual
unauthorized to do so”

4. Source: Verizon 2020 DBIR

5. | ©2019 F5​5 CONFIDENTIAL
Data Breach: What Tactics are Utilized?
Verizon 2020 DBIR

6. | ©2019 F5​6 CONFIDENTIAL
Top Hacking Varieties & Vectors in Breaches

7. Data Breaches
In the last 8 years more than
7.1 billion identities have been
exposed in data breaches
70
MILLION
accounts
427
MILLION
accounts
150
MILLION
accounts
3
BILLION
accounts
117
MILLION
accounts
1. Symantec Internet Security Threat Report, April 2017
2. https://www.entrepreneur.com/article/246902#
Nearly 3 out of 4 consumers
use duplicate passwords,
many of which have not been
changed in five years or more.
3 out of 4

8. | ©2019 F5​8
https://haveibeenpwned.com

9. USERNAME Credit Card
Data
USERNAME Intellectual
Property
USERNAME Healthcare
Data
USERNAME Passport
Data
USERNAME Financial
Data
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
USERNAME
Credentials from
Previous Breaches

10. • Educate employees / customers and boost security awareness
• Bot detection & prevention
• Design your login form so that it is impossible for the attacker’s bot to
recognize the fields
• Use multifactor authentication
• Monitor for failed authentication attempt

11. • Formjacking uses code injected by an attacker to
siphon payment card information from an online
form and deliver it to the attacker
• The recent rise of formjacking indicates that any
organization that accepts payment card information
over the web is going to have their shopping cart
targeted, regardless of sector

12. Confidential / / Part of F5
Formjacking / Magecart
https://cdn.appdynamics.com/adrum/adrum-latest.js
https://cdn.gladly.com/assets/chat-sdk/fece5b8abfb/main.js
https://cdn.krxd.net/ctjs/controltag.js
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/md5.js
https://connect.facebook.net/en_US/fbevents.js
https://d1fc8wv8zag5ca.cloudfront.net/2.10.2/sp.js
https://d2wy8f7a9ursnm.cloudfront.net/bugsnag-2.min.js
https://fullstory.com/s/fs.js
https://js.stripe.com/v2/
https://s.btstatic.com/tag.js
https://secure.flyr.io/v3/js/flyr.js
https://tag.bounceexchange.com/1907/i.js
https://uwhfgjlv.micpn.com/p/js/1.js
https://vt.myvisualiq.net/2/tDogjioRT72xXtfNK23F7A%3D%3D/vt-77.js
Typical Add Payment page loads JS from a dozen sources

13. Confidential / / Part of F5
Magecart on British Airways (facing US$230M fine)
SOURCE: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/
Compromised file: https://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js

14. • Injection Detection
• Inventory
• Patching
• Scanning
• Change Control
• Multi-Factor Authentication (MFA)
• Web Application Firewall (WAF)
• Server Tools (e.g: CSP, SRI)
• Monitor (for newly registered domains
and certificates of your brand)

16. • DevOps adoption is increasing, but Security typically remain afterthoughts.
• Security has largely been divorced from software development.
Security in DevOps ?

17. | ©2019 F5​17
Cultural shift
In a DevOps mentality,
security is everybody’s
RESPONSIBILITY.
FROM TO
A shift away from security is the
TRAFFIC COP / GATEKEEPER
mentality.

18. | ©2018 F5 NETWORKS​18
Collaborative Model
Development Operations
Security
• Avoid security at the end
• Greater collaboration with security
“in the room” at the beginning.
• Move to a risk based model rather
than being a traffic cop.
• Collaboration brings understanding.
• Understanding shapes how we
react.

19. | ©2018 F5 NETWORKS​19
The DevSecOps way
Business
Requirement
New Code ProductionTesting
Security
SHIFT LEFT
Risk based
security as
part of
normal
business.
Develop
initial sprint
with security
in mind
Deploy to
production
with regular
security
reviews
Test security
in an
automated
way
Shifting left refers to moving security earlier in the development process.
This means that security becomes everyone’s responsibility.
It also denotes a move to a risk based approach as opposed to a traffic cop approach.
It is not just about the speed, but also the safety
The earlier that security requirements can be addressed in the Software
Development Lifecycle, the lower the cost and impact.

20. | ©2019 F5​20
Wrap Up: DevSecOps Principles
​Breaking down
the silos
​Shifting Left ​Nurturing security
champions
​Continuous
Testing/Test
automation
​Making the
secure path the
easy path

21. | ©2019 F5​21
Join us virtually for ASEAN CES 2020!
SIGN UP AT: GO.F5.NET/ASEANCES
​Join industry-leading experts
in multi-cloud application
and gain insights on
developing and delivering a
modern apps architecture
leveraging APIs, DevOps,
SRE and Microservices!

22. | ©2019 F5​22
Connect with us!
JOIN IN THE CONVERSATION ON SOCIAL MEDIA
CONFIDENTIAL STATE OF APPLICATION SERVICES, 2020
Find us on Facebook
@f5asiapacific
Add us on LinkedIn
F5
Follow us on Twitter
@F5_AsiaPacific

24. PAGE24
DEVOPS INDONESIA
Stay Connected
@devopsindonesia
http://www.devopsindonesia.com
@IDDevOps
@DevOpsIndonesia
@IDDevOps DevOps Indonesia

25. PAGE25
DEVOPS INDONESIA
Alone We are smart, together We are brilliant
THANK YOU !
Quote by Steve Anderson