Rationalizing Security

Discussion around security for startups.

Transcript

1. Rationalizing Security
   Matt Konda
   Jemurai
   @mkonda
   mkonda@jemurai.com
   https://en.wikipedia.org/wiki/Rational_function
   

   View Slide

2. Introduction
   1997 2006 2014
   Consultant
   Engineer
   Software
   Architect
   Director of
   Engineering
   Rabble Rouser:
   Perl
   Java Applet
   C++
   J2EE
   J2EE

   Spring
   Analytics
   Certificate Authority
   Vulnerability Scanner
   Penetration Test Manager
   Pricing
   Retail
   Banking
   Manufacturing
   Pharma
   Healthcare
   Research
   Ruby
   Rails
   Chicago BSides 2011, 2012
   Defcon Skytalk
   OWASP Chicago, MSP 2013
   AppSec USA 2012, 2013
   ChicagoRuby 2013
   Secure 360
   Lone Star Ruby 2013
   WindyCityRails 2013
   Chicago JUG 2014
   RailsConf 2014
   Converge 2014
   ChicagoCoderConference 2015
   MS in CS
   Founder
   Consultant
   Agile
   Clojure
   Graph Database
   Big Data
   Trying to hack a
   business model that
   succeeds while
   helping developers.
   Domains:
   Projects:
   DevOps / Automation
   Training
   Coaching
   Code Review
   Plugged in to SDLC
   Consulting
   Assessments
   @mkonda
   mkonda@jemurai.com
   Secure
   DevOps
   Growing
   OWASP
   Board
   Agile Security
   

   View Slide

3. Census?
   

   View Slide

4. What are you hoping
   to get out of this?
   

   View Slide

5. Metasploit Demo
   

   View Slide

6. Case Study 1
   e-Commerce Fraud
   

   View Slide

7. “This year, organized crime became
   the most frequently seen threat
   actor for Web App Attacks.”
   Verizon 2015 DBIR
   

   View Slide

8. View Slide

9. See
   • Botnets
   • Widespread use of harvested credentials
   • Account takeover
   • Credit card fraud
   • Dumps of passwords and sensitive data with SQLi
   • User pwnage with XSS
   

   View Slide

10. Case Study 2
    Healthcare Fraud
    

    View Slide

11. “Two thirds of the incidents in this
    pattern had no attacker-attribution
    information whatsoever.”
    Verizon 2015 DBIR
    Cyber-Espionage
    

    View Slide

12. See
    • Long term investment
    • Systematic targeting
    • Phishing / Social Engineering
    • Pivoting
    

    View Slide

13. How long does it take for your
    host to get scanned / attacked
    on the open internet?
    

    View Slide

14. As a startup, you’re
    probably not an
    You’re in experimental mode …
    

    View Slide

15. You don’t want to worry about it
    

    View Slide

16. There are generally three
    things that force you to
    think about security.
    

    View Slide

17. View Slide

18. View Slide

19. View Slide

20. Your user’s privacy is
    important.
    

    View Slide

21. So is your company’s
    privacy.
    

    View Slide

22. Maturity Scale
    • Opportunistic
    • Defensible
    • Serious
    • Paranoid
    

    View Slide

23. Opportunistic
    • Use platform provided security
    • Run tools yourself (eg. brakeman)
    

    View Slide

24. Defensible
    • Policy, including data classification
    • Security assessments
    • Build servers to security standard
    

    View Slide

25. Serious
    • Active monitoring, log collection
    • Incident response
    • Security in SDLC (Static analysis, code review,
    training, automation)
    • Have a security team, app security team (Network,
    Desktop, Server controls)
    

    View Slide

26. Paranoid
    • Threat intelligence
    • Anti-Fraud
    • DDoS
    • Bug Bounty
    • Forensics
    

    View Slide

27. Things you can do now.
    

    View Slide

28. Use Services Provided
    • Use IAM to define groups users. Use MFA.
    • Limit Network Access, Use TrustedAdvisor
    • CloudTrail
    • Use encryption for S3, EBS, RDS, etc.
    • New: Inspector, WAF, Config Rules
    

    View Slide

29. • XSS is really code injection.
    • The distinction is that the code is running in
    your user’s browser.
    • This can have crippling significance -
    because it bypasses network and other
    typical controls.
    Cross-site Scripting
    

    View Slide

30. View Slide

31. beef demo
    

    View Slide

32. View Slide

33. View Slide

34. View Slide

35. View Slide

36. View Slide

37. View Slide

38. OWASP Top 10
    

    View Slide

39. Flagship Projects
    Tools
    • ZAP
    • OWASP Dependency Check
    • Web Testing Environment Project
    • OWTF
    Code
    • ModSecurity
    • CSRFGuard
    • AppSensor
    Documentation
    • ASVS
    • SAMM
    • Top 10
    • Testing Guide
    • Benchmark
    

    View Slide

40. OWASP ASVS
    

    View Slide

41. Tiers
    • 0  –  Cursory  –  You  have  done  
    something.    You  define.  
    • 1  –  Opportunistic  –  Adequately  defends  
    against  easily  discoverable  items.  
    • 2  –  Standard  –  Adequately  defends  
    against  items  of  moderate  to  serious  
    risk.  
    • 3  –  Advanced  –  Defends  against  even  
    advanced  attacks  and  demonstrates  
    good  security  design.
    

    View Slide

42. View Slide

43. Discussion …
    

    View Slide

44. Technical questions?
    Eg. I’m using … what do I need to
    worry about?
    

    View Slide

45. Get a partner and talk
    about what data you have
    that people might want …
    

    View Slide

46. Villain persona
    

    View Slide

47. Future topics?
    

    View Slide