Building Your House on Sand

Transcript

1. house on building your sand
2. @miscsecurity
4. Security in stuff third-party
5. Security in software third-party
6. Security in libraries third-party
7. Security in sdks third-party
8. Security in apis third-party
9. Security in open source third-party
10. let’s get real
11. security is hard.
12. security is hard. application
13. security is hard. network
14. security is hard. product
15. There is a lot of stuff to do.
16. mailing lists. bugtraq. xss vectors. news sites. blended threats. snort rules. hiring. process. SDLC. vulnerability reports. email. 0-day threats. okcupid profile. APT. lol. j/k.
17. optimize the right thing.
18. what about third-party libraries?
19. Question: How do you keep your Third-party libraries patched?
20. Question: How do you keep your Third-party libraries patched? We’ll be right back.
21. let’s take a step back
22. The Parable
23. Jesus
24. buddy Jesus
25. died for your sins
26. wise dude
27. HOUSE
28. “Therefore everyone who hears these words of mine and puts them into practice is like a wise man who built his house on the rock. The rain came down, the streams rose, and the winds blew and beat against that house; yet it did not fall, because it had its foundation on the rock. But everyone who hears these words of mine and does not put them into practice is like a foolish man who built his house on sand. The rain came down, the streams rose, and the winds blew and beat against that house, and it fell with a great crash.” Matthew 7: 24-27
29. paraphrased parable
30. paraphrased parable
31. a man builds his house on When bad comes, the house rock won’t fail. wise paraphrased parable
32. paraphrased parable a man builds his house on When bad comes, the house sand crashes. foolish
33. don’t be foolish sandTM
34. for the visual learners
35. good
36. bad
37. Jesus and software?
38. the point: strong foundation means survival
39. An Analogy
40. then
41. carmakers were craftsman.
42. each part custom made.
43. no standards
44. now
45. carmakers are system integrators.
46. designed separately and reused.
47. standard process
48. Applications then
50. hackers coded everything.
51. each function individually coded.
52. little code reuse.
53. Applications now
54. good developers borrow
55. great developers steal
56. github& frameworks& open source& stack exchange& standard libraries.
57. standard patterns & process.
58. code is reused.
59. Take-Away 1 your product contains other’s parts
60. you’re down with P P O
61. you’re down with ther eople’s arts P P O
62. backing up...
63. Question: How do you keep your Third-party libraries patched?
64. first attitude
65. “We don’t third-party libraries.” USE
66. oh?
67. yes.
68. yes. you do.
69. third-party libraries 80% Source: Aspect Security
70. business critical 90% Source: Gartner
71. “We don’t third-party libraries.” USE RESPONSE
72. don’t be foolish sandTM
73. second attitude
74. “I don’t know.”
75. ignorance
76. ignorance means...
77. no current visibility
78. no current visibility means...
79. unknown threats
80. unknown threats means...
81. APT
82. don’t freak out.
83. ask questions.
84. don’t be foolish sandTM
85. other’s parts aren’t being monitored Take-Away 2
86. I’m not talking about open source licenses!
87. third-party updates.
88. code review.
89. we aren’t looking at application libraries.
90. managing is measuring.
91. continuing with the car analogy.
92. defective car parts are recalled.
93. know when parts are recalled.
95. no visibility
96. no visibility means...
97. threats.
98. unknown threats.
99. on a LARGE attack surface.
100. no visibility means...
101. APT
102. don’t be foolish sandTM
103. get visibility into third-party code.
104. It’s a full-time job.
105. protip: outsource it.
106. update other’s parts you use Take-Away 3
107. you use other’s parts.
108. Those parts are the foundation.
109. what happens when the foundation changes?
110. what do you do?
111. it depends.
112. whoa!
113. we’re security peeps.
114. optimize the right thing.
115. your app uses lib 1.0
116. if (newest version == lib 1.7) { do what? }
117. 1.1 ... What’s changed? 1.7
118. “can’t I just update everything?”
119. you can.
120. but you’ll kill yourself.
121. or
122. your developers will kill you.
123. updates can break things.
124. updates can break things.
125. updates can break things. will
126. deprecation.
127. each update is different.
128. optimize the right thing.
129. performance & security.
130. so...
131. Question: How do you keep your Third-party libraries patched? We’re back.
132. Question: How do you keep your Third-party libraries patched?
133. Let’s Review
134. Take-Away 1 your product contains other’s parts
135. other’s parts aren’t being monitored Take-Away 2
136. update other’s parts you use Take-Away 3
137. for the visual learners
138. Do this
139. not this
140. don’t be foolish sandTM
141. thanks.
142. brett hardin @miscsecurity http://bretthard.in Photo Credits: The Henry Ford, O En, Edgar Barany, Sprengben, Maurizio Scorianz, Håkan Dahlström, Maks Karochkin, wouter_kersbergen, Lourdes Nightingale, ohhector, Funky64, skeggy, josef.stuefer