Dev Sec Oops: How Agile Security increases Attack Surface

In today's reality, security engineers are the guards of products and its users. But who guards the guards? Based on real scenarios of supply chain attacks, we'll demonstrate the weakest points of the “Agile Security” paradigm and redefine Code of Conduct for Security Engineer.

Transcript

1. DEV, SEC, OOPS: HOW AGILE SECURITY INCRESES ATTACK SURFACE Denis Makrushin https://twitter.com/makrushind
2. Red Team Blue Team
3. Blue Team Success Attacker’s Success
4. We showed that Healthcare fails as a Developer…
5. …but the Healthcare is a User! https://www.bsimm.com/
6. Agile Security: key principles • Don’t reinvent it • Do it incrementally • Automate it
7. Agile Security: key principles • Don’t reinvent it • Do it incrementally • Automate it • Process (CI/CD) • People (DevSecOps) • Tools
8. CI/CD from Researcher’s perspective
9. Automation from Researcher’s perspective
10. What is “attack surface”. Formally.
11. The attack graphs situations when the firewall is disabled (upper one) and enabled (lower one)
12. Example of the unknown attack graph
13. Product Security Touchpoints
14. Attack Surface Graph of Enterprise-network
15. Attack Surface Graph of Enterprise-network
16. Security activities during Product Development Stages
17. HOW TO COMPROMISE PRODUCT DEVELOPMENT PIPELINE USING COMMERCIAL SECURITY ASSETS?
18. SonarQube: code quality and security
19. SonarQube: Installations Shodan query: ”port:9000 sonarqube”
20. SonarQube: deployment with Secrets
21. SonarQube: CLI integration
22. SonarQube: CLI integration with Secrets
23. Checkmarx: Installations Shodan query: ”CxWebClient” Google dork: “inurl:CxWebClient”
24. “Try the Demo”
25. Checkmarx: CLI integration with Secrets
26. Control your Attack Surface. The pipeline.
27. WAIT. WHAT ABOUT OPEN SOURCE SOLUTIONS?
28. Task management for Microservices: Flower
29. Task management for Microservices: Flower
30. Flower: Installations Shodan query: ”port:5555 flower”
31. One field for user input…
32. One field for user input… dejavue
33. One field for user input… dejavue (#CVE20186210, #CVE20186213)
34. One field for user input… Stored XSS
35. PatrOwl: Security Operations Orchestration Platform
36. PatrOwl: RCE in NMAP container
37. PatrOwl: RCE in NMAP container
38. Host Header Injection in official Docker-image
39. Cache Poisoning via Host Header Injection
40. Security folks are humans too
41. Security folks are humans too
42. Security folks are humans too
43. Security folks are humans too
44. How to fix it • Secure SDLC • Educate your User • OSINT your product If you are Security Vendor: If you are Security Engineer: • Know your Attack Surface • Do not click on links • Follow your Code of Conduct • Scan your Open Source
45. CodeQL
46. IF YOU ARE ATTACKER, ONE DAY SOMEONE WILL PUT THE BASKET ON YOUR HEAD…
47. DENIS@MAKRUSHIN.COM TWITTER.COM/MAKRUSHIND THANK YOU.