Application Security Landscape

A talk about application security in the scope of an overall security program ..

Transcript

1. Rocky Mountains
   The Application Security Landscape
   

   View Slide

2. Introduction
   1997 2006 2014
   Consultant
   Engineer
   Software
   Architect
   Director of
   Engineering
   Rabble Rouser:
   Perl
   Java Applet
   C++
   J2EE
   J2EE

   Spring
   Analytics
   Certificate Authority
   Vulnerability Scanner
   Penetration Test Manager
   Pricing
   Retail
   Banking
   Manufacturing
   Pharma
   Healthcare
   Research
   Ruby
   Rails
   Chicago BSides 2011, 2012
   Defcon Skytalk
   OWASP Chicago, MSP 2013
   AppSec USA 2012, 2013
   ChicagoRuby 2013
   Secure 360
   Lone Star Ruby 2013
   WindyCityRails 2013
   Chicago JUG 2014
   RailsConf 2014
   Converge 2014
   ChicagoCoderConference 2015
   MS in CS
   Founder
   Consultant
   Agile
   Clojure
   Graph Database
   Big Data
   Trying to hack a
   business model that
   succeeds while
   helping developers.
   Domains:
   Projects:
   DevOps / Automation
   Training
   Coaching
   Code Review
   Plugged in to SDLC
   Consulting
   Assessments
   @mkonda
   mkonda@jemurai.com
   Secure
   DevOps
   Growing
   OWASP
   Board
   Agile Security
   

   View Slide

3. Census?
   

   View Slide

4. Case Study 1
   e-Commerce Fraud
   

   View Slide

5. “This year, organized crime became
   the most frequently seen threat
   actor for Web App Attacks.”
   Verizon 2015 DBIR
   

   View Slide

6. View Slide

7. See
   • Botnets
   • Widespread use of harvested credentials
   • Account takeover
   • Credit card fraud
   • Dumps of passwords and sensitive data with SQLi
   • User pwnage with XSS
   

   View Slide

8. Case Study 2
   Healthcare Fraud
   

   View Slide

9. “Two thirds of the incidents in this
   pattern had no attacker-attribution
   information whatsoever.”
   Verizon 2015 DBIR
   Cyber-Espionage
   

   View Slide

10. See
    • Long term investment
    • Systematic targeting
    • Phishing / Social Engineering
    • Pivoting
    

    View Slide

11. 90% of security
    investments focus on
    network security.
    75% of attacks focus on
    vulnerable applications.
    From industry advertisement. Original source not cited.
    

    View Slide

12. View Slide

13. Product Landscape
    

    View Slide

14. Static Analysis
    

    View Slide

15. Static Analysis Live App Scanning
    

    View Slide

16. Static Analysis Live App Scanning
    Dynamic Analysis
    

    View Slide

17. Static Analysis Live App Scanning
    Dynamic Analysis Dependency Checks
    

    View Slide

18. Static Analysis Live App Scanning
    Dynamic Analysis Dependency Checks
    Web Application Firewall
    

    View Slide

19. Static Analysis Live App Scanning
    Dynamic Analysis Dependency Checks
    Web Application Firewall Runtime Security Monitoring
    

    View Slide

20. Static Analysis Live App Scanning
    Dynamic Analysis Dependency Checks
    Web Application Firewall Runtime Security Monitoring
    IP Reputation
    

    View Slide

21. Static Analysis Live App Scanning
    Dynamic Analysis Dependency Checks
    Web Application Firewall Runtime Security Monitoring
    IP Reputation Anti-Automation
    

    View Slide

22. Static Analysis Live App Scanning
    Dynamic Analysis Dependency Checks
    Web Application Firewall Runtime Security Monitoring
    IP Reputation Anti-Automation
    Penetration Testing
    

    View Slide

23. Static Analysis Live App Scanning
    Dynamic Analysis Dependency Checks
    Web Application Firewall Runtime Security Monitoring
    IP Reputation Anti-Automation
    Penetration Testing
    

    View Slide

24. View Slide

25. B+
    

    View Slide

26. B+
    C
    

    View Slide

27. B+
    C
    B+
    

    View Slide

28. B+
    C
    B+
    F
    

    View Slide

29. B+
    C
    B+
    F
    D
    

    View Slide

30. B+
    C
    B+
    F
    D
    D
    

    View Slide

31. B+
    C
    B+
    F
    D
    D
    F
    

    View Slide

32. B+
    C
    B+
    F
    D
    D
    F
    B
    

    View Slide

33. B+
    C
    B+
    F
    D
    D
    F
    B
    A-
    

    View Slide

34. B+
    C
    B+
    F
    D
    D
    F
    B
    A-
    C
    

    View Slide

35. View Slide

36. View Slide

37. Understanding Our
    Attack Surface
    

    View Slide

38. We need to understand applications: data flow, fraud
    scenarios and data sensitivity to build an appropriately
    focused security program.
    

    View Slide

39. Application Security is
    moving from a niche
    to a pillar of security
    programs.
    

    View Slide

40. Limited Resources
    

    View Slide

41. Developers
    

    View Slide

42. Application security teams need time
    and flexibility to implement automation
    and processes that work.
    

    View Slide

43. Data
    

    View Slide

44. View Slide

45. View Slide

46. What are we measuring?
    

    View Slide

47. OWASP
    OWASP
    

    View Slide

48. Organizational Health
    • 2184 members, 45 corporate.
    • Financially sound.
    • Excellent conference results including for AppSecUSA, AppSecEU and
    LATAM tour.
    • ED is full time employee (started summer 2014, full time Spring 2015)
    • Recently hired community manager - Noreen Whysel (November 2014)
    • Recently hired project co-ordinator - Claudia Casanovas (May)
    • Kate Hartmann and Kelly Santalucia continue to handle operational and
    membership awesomeness.
    

    View Slide

49. Active Work
    • Funded OWASP summer of code.
    • Increased activity in project summits.
    • Conference planning
    • All the background work of sponsors, elections,
    membership, project support…
    

    View Slide

50. DevOps and Security
    

    View Slide

51. Credit: Matt Tesauro at AppSecEU 2015
    http://www.slideshare.net/mtesauro/mtesauro-keynote-appseceu
    

    View Slide

52. App Inventory
    Pipeline
    CSV, JSON, Text
    Git webhooks
    Jenkins
    

    View Slide

53. View Slide

54. Data Platform
    

    View Slide

55. Training
    

    View Slide

56. Flagship Projects
    Tools
    • ZAP
    • OWASP Dependency Check
    • Web Testing Environment Project
    • OWTF
    Code
    • ModSecurity
    • CSRFGuard
    • AppSensor
    Documentation
    • ASVS
    • SAMM
    • Top 10
    • Testing Guide
    • Benchmark
    

    View Slide

57. ASVS
    

    View Slide

58. Tiers
    • 0  –  Cursory  –  You  have  done  
    something.    You  define.  
    • 1  –  Opportunistic  –  Adequately  defends  
    against  easily  discoverable  items.  
    • 2  –  Standard  –  Adequately  defends  
    against  items  of  moderate  to  serious  
    risk.  
    • 3  –  Advanced  –  Defends  against  even  
    advanced  attacks  and  demonstrates  
    good  security  design.
    

    View Slide

59. View Slide

60. Thank you
    

    View Slide