Recommended
More Related Content
What's hot
What's hot (20)
Similar to Software Security by Glenn Wilson
Similar to Software Security by Glenn Wilson (20)
More from Alex Cachia
More from Alex Cachia (20)
Recently uploaded
Recently uploaded (20)
Software Security by Glenn Wilson
- 1. Software Security With Glenn Wilson
- 2. @Dynaminet /glennwilson Glenn Wilson Cybersecurity specialist, CTO & Founder
- 3. February 2020 @Dynaminet 2 © Alamy (https://www.alamy.com/)
- 4. How secure is my software? February 2020 @Dynaminet 3
- 5. The 5 key practices for more secure software: Good design Security Testing Dependency checking Protect your Source Code Education February 2020 @Dynaminet 4
- 6. Good design doesn’t cost, but it pays! February 2020 @Dynaminet 5
- 7. February 2020 @Dynaminet 6 Produce Clean Maintainable Code
- 8. NEVER STORE PASSWORDS IN PLAIN TEXT…. EVER! • Use STRONG hashing • Use Salted values (randomised!!) Build in Multifactor Authentication (MFA) • Something your user knows • Something your user has • Something your user is Enforce Password policies • Password rotation • Password strength February 2020 @Dynaminet 7
- 9. Use STRONG Encryption… EVERYWHERE • No excuse for weak encryption • Encrypt Data at Rest and Data in Transit Asymmetric Encryption • Used for authentication and confidentiality • Public key can be shared • Private key must be kept secret / stored securely Symmetric Key • Sender and user use same key • Use with HMAC February 2020 @Dynaminet 8
- 10. Validate ALLinput • User input • Query string parameters • API parameters • Validate EVERY VALUE (zero trust) Use Whitelisting • IP Addresses • Trusted Domain Names (be explicit) • Valid Characters Avoid Implicit Serialisation • Explicitly define object state February 2020 @Dynaminet 9 ✓ ✗
- 11. Always Enable / Configure Security Related Headers • Control your response / request headers Content Security Policy (CSP) • Set policies in Content-Security-Policy header • Defend against Cross Site Scripting (XSS) • Prevents packet sniffing Cross-Origin Resource Sharing (CORS) • Set Access-Control-Allow-Origin headers appropriately • Set CDN / external JavaScript / CSS libraries and public API endpoints February 2020 @Dynaminet 10
- 12. Always Log Security Events • Authentication / Authorisation Failures • Application / System Errors • Suspicious / Unexpected Behaviour Keep Logs Secure • Prevent Attackers from Hiding Their Tracks • Prevent Data Leaks Do NOT Log Data Illegally / Unnecessarily, such as: • Access Tokens • Personally Identifiable Information (PII) • Secrets / Encryption Keys • Payment Data February 2020 @Dynaminet 11
- 13. All Code Is Guilty Until Proven Innocent February 2020 @Dynaminet 12
- 14. February 2020 @Dynaminet 13 Unit Tests Pen Tests Static Application Security Tests Integration Security Tests slower faster more expensive cheaper
- 15. Write Security Unit Test Cases: • Identity, Authentication & Access Control • Input Validation & Encoding • Encryption • User and Session Management • Error and Exception Handling • Auditing and Logging February 2020 @Dynaminet 14 ✓✗ ✓ ✓ ✓ ✓ ✓ ✓
- 16. Use Static Code Analysis Tools • Integrate into IDE / CI/CD Pipeline • Identifies Most Common Source Code Vulnerabilities • Scans Source Code or Binaries Top SAST Tools Include: • Checkmarx • Veracode • Fortify on Demand • SonarQube • HCL AppScan BUT… • Can Generate Many False Positives • Bound to Specific Technologies February 2020 @Dynaminet 15
- 17. Automate Tests Beyond Source Code Using DAST, IAST and RASP • Dynamic Application Security Testing • Simulates Real Attacks • Integrates into CI/CD Pipeline • Interactive Application Security Testing • Runtime instrumentation used in TESTING • Identifies Events at Runtime that may have Security Relevance • Runtime Application Self Protection • Runtime Instrumentation used in PRODUCTION • Prevents Exploitation of Common Vulnerabilities February 2020 @Dynaminet 16
- 18. Use Penetration Testers Exploit Vulnerabilities in your Code • They use complex chains of vulnerabilities not Identified by Automated Tests • Imitate Hackers and use Hacker Tools • Provide a Report of Vulnerabilities BUT… • Do NOT rely EXCLUSIVELY on Pen Testing • Usually Performed TOO LATE in the SDLC for developers February 2020 @Dynaminet 17
- 19. “Before software can be reusable it first has to be usable” - Ralph Johnson February 2020 @Dynaminet 18
- 20. Check that your Free Open Source Software are not Vulnerable • Use Scanning Tools to Scan your Dependencies • Known Vulnerabilities are Exploited by Hackers • CVEs are Publicly Available (mitre.org) • Patch!!! • Use Scanning Tools Directly in your IDE – UPDATE LIBS QUICKLY in DEV • SCAN CONTAINERS – they bring a whole bunch of vulnerabilities with them!!!! February 2020 @Dynaminet 19
- 21. ”It’s not enough for code to work” – Robert C. Martin February 2020 @Dynaminet 20
- 22. Secure your Source Code… ALWAYS • Secure the Development Environment • Keep it separate from Production • Flexible Security – don’t Hinder Development • Protect the Source Code Repository • Access Controls • Monitor for Unusual Code Changes (e.g. external) • Secure the Build and Deployment Pipeline • Control Secrets and Credentials • Automate • Only Promote TRUSTED Branches February 2020 @Dynaminet 21
- 23. “Knowledge is a weapon. I intend to be formidably armed.”― Terry Goodkind February 2020 @Dynaminet 22
- 24. February 2020 @Dynaminet 23
- 25. February 2020 @Dynaminet 24 &
Editor's Notes
- We’re all familiar with the dangers of being hacked: Data exfiltration Ransomware Sabotage
- As software engineers, architects, tester, we are all responsible for securing software. But what does this entail?
- Good software starts with good design “Good design doesn’t cost, but it pays”
- Cannot say this loud enough or clear enough!!!!
- Randomised = use cryptographically safe random generators such as CryptGenRandom in Windows and uRandom in UNIX Something your user knows = pin / password Something your user has = mobile device / hardware token Something your user is = facial recognition / fingerprint
- Data in Transit = avoid using SSL or older versions of TLS. You should use TLS 1.2 as a minimum know when and how to use asymmetric keys versus symmetric keys Never share a private key used for encryption HMAC = Hash-based Message Authentication Code (used to verify integrity and authenticity of a message)
- Whitelisting = ensure that only characters that are permitted can be used Centralise validation within domain primitives (Domain primitives gives greater control on how the application behaves e.g. an age is not an Integer unless someone lives to 2 billion years of age and also has negative age!
- Logging is a huge topic so will not cover it in this slide, other factors to mention: Create a central log or at least keep logs consistent Do not log everything – too much noise Use a Security Information and Event Management (SIEM)
- Mike Cohn = three layers 1) Unit Tests 2) Service Tests 3) UI Tests Unit Tests = happy and unhappy paths based on logic (e.g. can I order -2 billion items?) Static application tests = automated source code analysis. Scan source code for potential bad security practice (e.g. SQLi, XSS, unencrypted passwords etc). Lots of false positives if not configured correctly. Integration Security tests = automated dynamic code analysis. Validates that integrated services are secure using fuzz testing. Grey testing Pen testing = full black box testing. Usually carried out by skill penetration testers. Look for all sorts of issues. Traditional testing for many projects and carried out at end of SDLC
- Build security into the unit testing tools
- SAST = Static Application Security Testing
- Pen testing can come too late in the SDLC for developers
- Alternative quote = “A chain is only as long as its weakest link”
- Dependencies probably make up between 80% and 90% of your code base CVE = Common Vulnerability Enumeration
- You are under attack… constantly. Arm yourself with knowledge
- OWASP - Open Web Application Security Project Top 10 Security vulnerabilities (https://owasp.org/www-project-top-ten/) SANS - SANS is the most trusted and by far the largest source for information security training in the world Top 25 Most dangerous coding error (https://www.sans.org/top25-software-errors/) Centre for Internet Security (CIS) CIS Benchmarks for a raft of different technologies (https://www.cisecurity.org/cis-benchmarks/) National Cyber Security Centre (https://www.ncsc.gov.uk/collection/developers-collection) UK NIST – National Institute of Standards and Technology USA Cybersecurity resources (https://www.nist.gov/topics/cybersecurity) Mozilla Web Security page (https://infosec.mozilla.org/guidelines/web_security)