Take aways from AppSec USA 2016

Some takeaways from AppSec USA 2016

Transcript

1. TAKEAWAYS FROM APPSECUSA 2016 Michael Xin
2. OWASP AppSec USA 2016 2
3. Schedule 3 •Day one & Day Two: –Developer Summit –Project Summit –Training •Day Three & Day Four –Talks –Keynotes –Lightning Talks –Career Fair
4. Developer Summit 4 Join other Developers at this event for some fun-filled, interactive, hands-on, bug squashing sessions. All Developers are welcome to attend! Individuals may choose to participate in as many sessions as they would like. Bring your laptop, energy and be ready to code!!
5. Real Developer Summit 5
6. Meet Matt Konda 6 https://speakerdeck.com/mkonda
7. Agile Security
8. Agile Security
9. OWASP Glue Project 9 Glue is a framework for running a series of tools. Generally, it is intended as a backbone for automating a security analysis pipeline of tools. The purpose of the project is to make it easy to run static analysis tools, live analysis tools (ZAP) etc. as part of an automated build process and to report the findings to JIRA or other tracking systems. https://www.owasp.org/index.php/OWASP_Glue_Tool_Project https://github.com/OWASP/glue
10. Current Tasks 10
11. Features 11 •GitHub Hook •Chat Ops •Docker packaged Tasks •Jenkins Integration •Jira Integration •Checklists
12. Security Tasks 12
13. Integration with QE 13
14. Security Test Case 14
15. Security Test Case in Action 15
16. Other interesting points 16
17. Quiz! 17 •How many OWASP projects are there?
18. Answer 18 101
19. OWASP Projects 19 •OWASP Flagship mature projects –Zed Attack Proxy –Top Ten •OWASP LAB Medium Level Projects –Mantra Security Framework –Code Review Project •OWASP Incubator new projects –Java Encoding project –Defect Dojo project https://www.owasp.org/index.php/Category:OWASP_Project#tab=Project_Inventory
20. OWASP Project Challenges 20
21. Solution! 21
24. KEYNOTE 24
25. FAIL 25
27. Dev+Ops+Sec 27 Everything is Terrible: Three Perspectives on Building, Configuring, and Securing Software --- Puppet
28. Takeaway 28 ”People finally realize that we are working for the same company!”
29. 29 Practical Static Analysis for Continuous Application Security Justin Colins (creator of Brakeman)
31. Takeaway 31 •Start small: identify single issue to solve •Tailor solution to your environment •Automate enforcement
32. 32 Next Gen Web Pen Testing: Handling Modern Applications in a Penetration Test Kevin Johnson, Jason Gillam
33. Talk points 33 •HTTP/2 •Websockets •CORS •Restful API •SamuraiWTF 4.0
34. Takeaway 34 •HTTP/2.0, Web sockets are difficult to test •CORS is everywhere •Restful API security testing –Authentication –Session Management –Data –Fuzzing
35. 35 Cleaning Your Applications' Dirty Laundry with Scumblr Scott Behrens, Andrew Hoernecke Netflix
36. Talk points 36
37. Talk points 37
38. Talk points 38
39. Talk points 39
40. Talk points 40
41. Takeaways 41 •All Security teams have staff problem •Continuous improvement •Automation, automation and automation •Dream Big & Be practical
42. Keynote 42
44. 44 International Spy Museum
45. 45 International Spy Museum
46. Summary 46 •DevOps + Sec is the trend •Automation is the key for Security team •OWASP has lots of useful resources •Communication, teamwork •Think big, start small
47. Q&A 47
48. THANK YOU RACKSPACE® | 1 FANATICAL PLACE, CITY OF WINDCREST | SAN ANTONIO, TX 78218 US SALES: 1-800-961-2888 | US SUPPORT: 1-800-961-4454 | WWW.RACKSPACE.COM © RACKSPACE LTD. | RACKSPACE® AND FANATICAL SUPPORT® ARE SERVICE MARKS OF RACKSPACE US, INC. REGISTERED IN THE UNITED STATES AND OTHER COUNTRIES. | WWW.RACKSPACE.COM