Vulnerabilities in Golang

Vulnerabilities in Golang - Supply chain security

Transcript

1. © 2022 Aqua Security Software Ltd., All Rights Reserved Desmistificando as Vulnerabilidades em Golang
2. 2 in/carolgv krol3 @krol_valencia
3. 3 • Intro • Vulnerabilities • Secure Golang in the SDLC Agenda
4. 4 Security is Hard Process, People and Technology
5. 5 Container security? k8s security? Cybersecurity?
7. 7 Who’ s to blame for the security breach ?
8. 8 Maturity Model in my company – Agile process
9. 9 Maturity Model in my company – Agile process
10. 10 Applying Devops …. Where is the vulnerabilities in my SDLC? ….
11. 11 Vulnerabilities
12. 12 A flaw or weakness that may allow harm to occur to an IT system or activity.
13. 13 Common Vulnerabilities and Exposures Is it an exploitable vulnerability?
14. 14 Zero day CISO Chief Information Security Officer
15. 15 Developing web applications … What are the common vulnerabilities?
16. 16 Top 10 Open Web Application Security Project – Top 10
17. Go net library affected by critical ip address validation vulnerability https://www.bleepingcomputer.com/news/security/go-rust-net-library-affected-by-critical-ip-address-validation-vulnerability/ SSRF - Server side request forgery
18. 18 Secure Golang in the Software Development Lifecycle (SDLC)
19. 19 Go vulnerability check
20. 20 Go vulnerability check
21. 21 Go vulnerability check https://go.dev/security/vuln/
22. 22 Before vulncheck
23. 23 How scanners work? How to find CVEs?
24. 24 Golang Dependency Management
25. 25 go.mod go.sum
26. 26 Lock file ? - Dependency Confusion
27. 27 Auditable Checksum database https://go.dev/blog/module-mirror-launch
28. 28 Open Source Vulnerabilities https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html
29. 29 Consumer / Producer Code – Supply chain
30. 30 scala-network/GUI-miner dstellitecoin/gui-miner Supply Chain Attacks
31. 31 Supply Chain Attacks
32. 32 Supply Chain Attacks
33. 34 Supply Chain Attacks
34. 35 Supply Chain Security Tool
37. 38 Applying Devops ….
38. 39 New technology ... new security holes ... new security best practices.
39. 40 Applying DevSecOps ….
40. 41 Pipeline sample https://github.com/krol3/demo-go-xss/
41. 42 Pipeline sample – Detecting xss
43. © 2022 Aqua Security Software Ltd., All Rights Reserved Thanks in/carolgv krol3 @krol_valencia