Surface Security: The experience so far and the road ahead

At Paddy Power Betfair (Blip.pt), throughout the years, we have developed a tool to help us have an inventory of all internal assets, from servers to DNS records to endpoint devices, but to also integrate other tools in it, like open-source scanners to help us detect vulnerabilities, understand our exposure, weaknesses, and priorities, as well as leverage built-in notifications, a slack bot, and much more.
These slides were used in the OWASP Lisboa Chapter #2 meetup by me, to present and talk about the project.

Transcript

1. SURFACE SECURITY SECURITY INTELLIGENCE & AUTOMATION PLATFORM OWASP LISBON CHAPTER 28 FEBRUARY 2023
2. AGENDA WHAT IS SURFACE SECURITY? 3 WHY OPEN SOURCE? 9 DEMO 4 SURFACE SECURITY – OWASP LISBON CHAPTER 2
3. DOCUMENT TITLE 3 LEAST FAVORITE SLIDE
4. WHOAMI? Flutter UK & I InfoSec Engineer 3 Years 5 Years Security Developer Blip Porto, PT @gsilvapt (GitHub/GitLab/Twitter/LinkedIn/Mastodon) Open Source Advocate Traeffik, Ubuntu, Panther, pmz, shhbt, …
5. WHAT IS SURFACE SECURITY? SURFACE SECURITY – OWASP LISBON CHAPTER 5
6. WHAT IS SURFACE SECURITY? SURFACE SECURITY – OWASP LISBON CHAPTER 6 A Django-Python Platform that syncs and correlates data from internal and external sources. It can be extended with Django apps to achieve further automation. How it can be used Browser-based, REST APIs and/or Slack integration (app and webhooks) Business Adoption Started in 2017 in Application Security and got adopted by others due to usefulness, such as Auditors, Architects, Infrastructure, DevOps, Developers. More than 30 contributors to the project internally, 40 daily users, 150 weekly users and 1100 users since we released Surface Security. What is it
7. SURFACE SECURITY – OWASP LISBON CHAPTER 7
8. SECURITY INTEGRATIONS SURFACE SECURITY – OWASP LISBON CHAPTER 8
9. SECURITY AUTOMATION SURFACE SECURITY – OWASP LISBON CHAPTER 9
10. SURFACE SECURITY – OWASP LISBON CHAPTER 10 VULNERABILITY MANAGEMENT By centralizing data from multiple sources, we are able to understand the landscape of exposure, correlate data from multiple sources and more easily find the owners of components to track them down and prioritize security fixes.
11. WHY OPEN SOURCE? 28 FEBRUARY 2023
12. More contributors External and internal with fresh ideas and improvements Make a statement For customers and future employees. We care about Security Marketing Attract talent Advertisement Open Source usage We use a lots of OSS Similar Problems We are trying to solve the same issues SURFACE SECURITY – OWASP LISBON CHAPTER 12
13. https://ppb.technology/2021/01/21/the-power-of-open-source-in-cyber-security/ https://github.com/paddypowerbetfair/shhbt SURFACE SECURITY – OWASP LISBON CHAPTER 13 PREVIOUS INITIATIVES
14. SURFACE SECURITY – OWASP LISBON CHAPTER 14 SURFACE SECURITY Available at https://github.com/surface-security 22 Members 25 Public repositories
15. WHAT WE BRING WITH SURFACE 22 repositories, more to come with new features Modules All data in one place from your sources Inventory Framework is there, make it yours Engine & Start Point Different use cases, companies and tool sets. Sync only what you need! Sync your needs Already got the data so create stats, graphs, reports, sky is the limit Metrics & Score it! SURFACE SECURITY – OWASP LISBON CHAPTER 15
16. SCANNER FRAMEWORK DKRON ROOTBOXES SCANNERS SURFACE SECURITY – OWASP LISBON CHAPTER 16
17. SURFACE SECURITY – OWASP LISBON CHAPTER 17
18. BIG DISCLAIMERS Engineers to Engineers It’s not plug and play Data & Tools You need data to sync and fill platform Creativity What you can do with all the data Database Know How Data needs somewhere to go SURFACE SECURITY – OWASP LISBON CHAPTER 18
19. SURFACE SECURITY | OWASP LISBON CHAPTER 19 DEMO
20. SURFACE SECURITY | OWASP LISBON CHAPTER 20 THANK YOU FOR WATCHING
21. MASSIVE THANKS TO