Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Vulnerabilities in Golang
Search
Carol
October 27, 2022
0
21
Vulnerabilities in Golang
Vulnerabilities in Golang - Supply chain security
Carol
October 27, 2022
Tweet
Share
More Decks by Carol
See All by Carol
Contribute to translate K8s Docs, Glossary and CNCF-whitepaper
krol3
1
90
DevSecOps em Aplicações, Cloud, Artefatos
krol3
2
130
Security in Cloud using Infrastructure as a Code (IaaS)
krol3
0
150
Compliance in Cloud Native
krol3
2
170
Security Opensource Tools in Cloud Native
krol3
1
190
Intro to Operators in Kubernetes
krol3
0
62
Container Security
krol3
4
300
Segurança em Kubernetes
krol3
1
190
Vault em Kubernetes
krol3
3
190
Featured
See All Featured
The Cult of Friendly URLs
andyhume
78
6k
Fashionably flexible responsive web design (full day workshop)
malarkey
405
65k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
16
2.1k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
28
9.1k
Imperfection Machines: The Place of Print at Facebook
scottboms
265
13k
GraphQLの誤解/rethinking-graphql
sonatard
67
10k
Testing 201, or: Great Expectations
jmmastey
38
7.1k
For a Future-Friendly Web
brad_frost
175
9.4k
How to Ace a Technical Interview
jacobian
276
23k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
8
860
Building a Modern Day E-commerce SEO Strategy
aleyda
38
6.9k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
126
18k
Transcript
© 2022 Aqua Security Software Ltd., All Rights Reserved Desmistificando
as Vulnerabilidades em Golang
2 in/carolgv krol3 @krol_valencia
3 • Intro • Vulnerabilities • Secure Golang in the
SDLC Agenda
4 Security is Hard Process, People and Technology
5 Container security? k8s security? Cybersecurity?
6
7 Who’ s to blame for the security breach ?
8 Maturity Model in my company – Agile process
9 Maturity Model in my company – Agile process
10 Applying Devops …. Where is the vulnerabilities in my
SDLC? ….
11 Vulnerabilities
12 A flaw or weakness that may allow harm to
occur to an IT system or activity.
13 Common Vulnerabilities and Exposures Is it an exploitable vulnerability?
14 Zero day CISO Chief Information Security Officer
15 Developing web applications … What are the common vulnerabilities?
16 Top 10 Open Web Application Security Project – Top
10
Go net library affected by critical ip address validation vulnerability
https://www.bleepingcomputer.com/news/security/go-rust-net-library-affected-by-critical-ip-address-validation-vulnerability/ SSRF - Server side request forgery
18 Secure Golang in the Software Development Lifecycle (SDLC)
19 Go vulnerability check
20 Go vulnerability check
21 Go vulnerability check https://go.dev/security/vuln/
22 Before vulncheck
23 How scanners work? How to find CVEs?
24 Golang Dependency Management
25 go.mod go.sum
26 Lock file ? - Dependency Confusion
27 Auditable Checksum database https://go.dev/blog/module-mirror-launch
28 Open Source Vulnerabilities https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html
29 Consumer / Producer Code – Supply chain
30 scala-network/GUI-miner dstellitecoin/gui-miner Supply Chain Attacks
31 Supply Chain Attacks
32 Supply Chain Attacks
34 Supply Chain Attacks
35 Supply Chain Security Tool
36
None
38 Applying Devops ….
39 New technology ... new security holes ... new security
best practices.
40 Applying DevSecOps ….
41 Pipeline sample https://github.com/krol3/demo-go-xss/
42 Pipeline sample – Detecting xss
43
© 2022 Aqua Security Software Ltd., All Rights Reserved Thanks
in/carolgv krol3 @krol_valencia