The document discusses security testing for containerized applications. It outlines different layers of containerized apps including code, dependencies, and Docker images. It then describes various security testing techniques that can be applied to each layer, including static analysis tools for code scanning, dependency scanning, and Docker image scanning. It also covers dynamic/runtime testing using passive and active scanning with tools like OWASP Zap. The document advocates building these security tests into the CI/CD pipeline and only deploying container images that pass all tests through a process of image certification. It demonstrates some of these techniques on a sample Lolcode application.

1. Join the conversation #DevSecCon
Security Testing for
Containerized Apps
@omerlh
@SolutoEng

2. http://lolcode.org/

3. - Helping people get the most out of their technology
https://www.solutotlv.com/

5. You Can’t Do it Alone

6. Letting Go Responsibly
AppSec @ Soluto:
● Threat Modeling
● Empowering
● Education
● Automation

7. Our Quest: Securing Containerized Apps

8. Code
Dependencies
Docker Image
Layers of Containerized App

9. What kind of security tests?
● Static
● Dynamic
● Integrated (which will be ignored)
By Using ONLY FOSS tools

10. Static Analysis

11. What?
● Scanning static assets (e.g. source code)
● Language aware
● Different Tools for different layer
● Point where is the issue
Code
Dependencies
Docker Image

12. Code Layer
● Scan the code for vulnerabilities
● Different tools for different languages
● Bandit – Python
● Brakeman – Ruby on Rails
● Find Security Bug - Java
● TSLint - TypeScript
● OWASP Source Code Analyzers list
Code
Dependencies
Docker Image

13. Example
https://snyk.io/blog/node-js-timing-attack-ccc-ctf/

14. Dependencies Layer
● 3rd party code used by the app
● Usually installed by a package manager
● PyPi, Gem, NuGet, NPM
● Each dependency might include known vulnerability
● OWASP Top 10 A9
● OWASP Dependency Track
Code
Dependencies
Docker Image

15. https://snyk.io/stateofossecurity/

17. NPQ

18. Docker Image Layer
● Contains the “OS”
● 3rd party software installed
● App engine (NodeJS/.NET Core etc)
● Each one could contain known vulnerabilities
● Multiple open source solutions
● Clair, Anchore, OWASP Dependency Track
Code
Dependencies
Docker Image

19. https://www.banyanops.com/pdf/BanyanOps-AnalyzingDockerHub-WhitePaper.pdf

20. Playing with Anchore-Engine

21. Dynamic Analysis

22. What?
● Scanning live app
● Language agnostic, protocol aware
● Only detect issues, not what cause to them
● Simple by using OWASP Zap
● Passive
● Active
● Leveraging Docker for local run
Code
Dependencies
Docker Image

26. Passive Scan
● Proxy black box tests
● Scan HTTP requests/responses
● HTTP static analysis
● Looks for security issues
● Fast, not risky
Code
Dependencies
Docker Image

27. Active Scan
● Discover all endpoint
● Craft malicious requests
● Test that the server can handle those request
● Slow, could cause damage
Code
Dependencies
Docker Image

28. Bringing it All Together

29. Building our CI/CD Pipeline
❑ Break the build or it didn’t happen
❑ False positives
❑ Keep it DRY
❑ Ownership

30. Let’s add some Glue
The ”DevSecOps Tool”

31. Building our CI/CD Pipeline
✓ Break the build or it didn’t happen
✓ False positives
✓ Keep it DRY
✓ Ownership

32. Image Certification
Only images that passed all the tests should be used on production
● Build dependency
● Image labels
● Image signing
● Image policy

33. What we have @ Soluto?
● Static analysis
✓ Source code scan
❑ Dependencies scan (in progress)
❑ Image scan
● Dynamic analysis
✓ Passive
❑ Active (in progress)

34. Demo Time
All the code is on GitHub

36. Testing LolCode App
● Static analysis?
✕ Nothing for source code
✕ No package manager (which is good?)
❑ Image scanning
● Dynamic analysis
✓ Passive
❑ Active

37. Let’s see it Live!
Hope it will work
… else I’ll show you slides with screenshots 

38. Wrapping Up

39. What we discussed
● Layers of Containerized Applications
● Kind of Tests & FOSS Tools
○ Static (OWASP Dependency Track)
○ Dynamic (OWASP Zap)
● Building the pipeline
○ OWASP Glue
○ Image Certification

40. Where Do I Start?

41. Our Quest: Securing Containerized Apps

44. Questions?

45. Resources
• TechBeacon: Security Tests for Containarized Applications
• Guide: Dynamic Security Testing with OWASP Zap
• Post: Dynamic Security Testing Made Easy
• Slides: Getting Started with OWASP Glue

46. Join the conversation #DevSecCon
Thank You!
@omerlh
@SolutoEng