Flaming Hot SLSA!

Copyright © AppSecEngineer 2022 abhaybhargav AppSecEngineer Flaming Hot SLSA! Abhay
Bhargav

abhaybhargav Yours Truly • Founder @ AppSecEngineer • Cloud and
AppSec Automation Junkie • Trainer/Speaker at DEF CON, BlackHat, OWASP Events, etc world-wide • Co-author of Secure Java For Web Application Development • Author of PCI Compliance: A De fi nitive Guide

Copyright © AppSecEngineer 2022 abhaybhargav AppSecEngineer Agenda • The Supply-Chain
Problem • Real-world examples of Supply-Chain Attacks • SLSA - A possible solution • SLSA Levels • Conclusions

Copyright © AppSecEngineer 2022 abhaybhargav AppSecEngineer Supply-Chain Lifecycle Dependency Confusion
Malicious Git Hooks Malicious Terraform Modules

Malicious Git Hooks Malicious Terraform Modules Poisoned Pipeline Build Manipulation Build System Compromise

Malicious Git Hooks Malicious Terraform Modules Poisoned Pipeline Build Manipulation Build System Compromise Dependency Confusion Dependency Tampering Tainted nested Dependencies

Malicious Git Hooks Malicious Terraform Modules Poisoned Pipeline Build Manipulation Build System Compromise Dependency Confusion Dependency Tampering Tainted nested Dependencies Package Integrity Attacks Malicious/Vulnerable Base Images Hash Switch Attacks

Risks - Unsigned Container Images

Malicious Terraform Modules

Copyright © AppSecEngineer 2022 abhaybhargav AppSecEngineer Purpose of SLSA •
Secure from tampering • Good practices • Incremental • Automatically veri fi able

Copyright © AppSecEngineer 2022 abhaybhargav AppSecEngineer Provenance • Describes HOW
an artifact/set of artefacts was produced

an artifact/set of artefacts was produced • Provenance goes stricter and deeper in higher SLSA Levels

an artifact/set of artefacts was produced • Provenance goes stricter and deeper in higher SLSA Levels • Single or Multiple Subjects being built

an artifact/set of artefacts was produced • Provenance goes stricter and deeper in higher SLSA Levels • Single or Multiple Subjects being built Provenance is an attestation that a builder produced one or more software artifacts or subjects,   using some other artifacts as input (materials) By executing some invocation that runs a buildCon fi g,   which is a record of what was executed.     The builder is trusted to have faithfully recorded the   provenance. It may even have been performed at the request   of an external, possibly untrusted entity. These parameters are   captured in the invocation’s parameters and   some of the materials The build may have depended on various environmental   parameters (environment) that are needed for reproducing the   build.

Copyright © AppSecEngineer 2022 abhaybhargav AppSecEngineer How does SBOM fit
in here?

in here? SBOM

in here? SBOM SBOM

in here? SBOM SBOM SBOM

in here? SBOM SBOM SBOM Sig

in here? SBOM SBOM SBOM Sig Sig

in here? SBOM SBOM SBOM Sig Sig Sig

Level 1 + • Authenticated Provenance: with Signatures • Provenance generated by Build Service • Build Service

Level 2+ • Build-as-code • Ephemeral Environment • Isolated • Non-Falsi fi able • Veri fi able History • Retained Inde fi nitely - 18 months

Level 3 + • Parameterless • Hermetic Builds • Completed Dependencies • Hardened Build Environments • Two Person Source Review

Flaming Hot SLSA!

Flaming Hot SLSA!

More Decks by Abhay Bhargav

Other Decks in Technology

Featured

Transcript