Slide 1

Slide 1 text

Web App Security in an Agile World Nick Galbreath [email protected] 2016-06-17

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

Why We Started
 Signal Sciences 2014-01-31
 App Sec Cali
 Santa Monica, CA

Slide 5

Slide 5 text

Macro Trends Stacked Against Defenders Rate of internal change is increasing, general shift from fixed assets to dynamic.
 Security talent is in short supply and oversubscribed.
 
 Attack economics are getting better… for attackers. or are they?

Slide 6

Slide 6 text

Software Engineering is really new. App Sec is even newer

Slide 7

Slide 7 text

Software Development as a Physical Construction Process http://blog.in-sight.io/software-engineering-vs-civil-engineering/ Where’s security? The Web Is Different!

Slide 8

Slide 8 text

Maybe Civil Engineering
 isn’t the right model? http://www.infrastructurereportcard.org

Slide 9

Slide 9 text

From $250 Million to $6.5 Billion: 
 The Bay Bridge Cost Overrun http://www.citylab.com/politics/2015/10/from-250-million-to-65-billion-the-bay-bridge-cost-overrun/410254/

Slide 10

Slide 10 text

slide http://www.dw.com/en/berlins-new-airport-potentially-hit-by-yet-another-delay/a-19107260#

Slide 11

Slide 11 text

Every engineering organization in the world is trying to go faster by using cloud, devops, continuous integration, agile Or Planning To Do So, with Some Projects

Slide 12

Slide 12 text

Even the USA Government Delivery is the strategy. https://18f.gsa.gov

Slide 13

Slide 13 text

Even the State of California https://www.codeforamerica.org/blog/2015/11/30/a-new-approach-to-procuring-government-technology-in-california/ A New Approach to Procuring Government Technology in California What was going to be a business-as-usual procurement (a long, thousand- plus page contract for a complete solution, driven by requirements and a likely waterfall delivery) of a new Child Welfare System will now be a series of procurements for long-term services, not solutions, driven by understanding and meeting user needs, delivered iteratively. Child welfare services personnel in California investigate nearly half a million reports of severe maltreatment and life-threatening neglect to children a year. Of those half a million, around 80,000 reports are confirmed annually, 30,000 children must be removed from their homes, and at any time almost 100,000 children are living in foster care for their protection or live with their parents under close county protective supervision.
 The Child Welfare System was the perfect choice for a new approach because it’s too important to fail. NOVEMBER 30, 2015

Slide 14

Slide 14 text

And You

Slide 15

Slide 15 text

https://twitter.com/petecheslock/status/595617204273618944

Slide 16

Slide 16 text

100-10-1
 Dev-Ops-Sec

Slide 17

Slide 17 text

SF Bay Area:
 For every 1 person in infosec, there are 2 job postings

Slide 18

Slide 18 text

a brief discussion on attack economics

Slide 19

Slide 19 text

What Does
 Not Work

Slide 20

Slide 20 text

Treating Web App Security
 as if were Network Security

Slide 21

Slide 21 text

Machine
 Learning

Slide 22

Slide 22 text

SPOF SOLUTIONS

Slide 23

Slide 23 text

a different type of pen test:
 http://www.busybeecreations.biz/blog/2015/9/14/ink-and-pen-tests More
 Pen Tests

Slide 24

Slide 24 text

Data
 Hoarding

Slide 25

Slide 25 text

Going Slower

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

• Change is increasing • Hiring is challenging • Attack Economics is not look good • A bunch of stuff doesn't work

Slide 28

Slide 28 text

???

Slide 29

Slide 29 text

me “Security is not a binary state”

Slide 30

Slide 30 text

Fail Success How do we move away from this?

Slide 31

Slide 31 text

Embrace, 
 Demand,
 and Extend
 “Continuous Deployment” Make Security Visible 
 (to all)

Slide 32

Slide 32 text

Continuous Deployment:
 Moving Code from Dev to Production characterized by small changes, done more frequently, in a semi-automated way.

Slide 33

Slide 33 text

Does not preclude • Code reviews • Architecture reviews • Testing • Two-man rules • Audibility • Compliance

Slide 34

Slide 34 text

Does not require • 10,03894293842,00 pushes to prod today
 (i.e. do not chase the leaders)

Slide 35

Slide 35 text

Mechanism POLICY https://forbo.blob.core.windows.net/forboimages/3159/Forbo_Slider_Everyday_life_pastry.jpg

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

1. HEAD/Mainline/Trunk is always ready to ship. http://www.paulhammond.org/2010/06/trunk/ alwaysshiptrunk.pdf

Slide 38

Slide 38 text

Trunk is always ready to ship

Slide 39

Slide 39 text

Feature Flags

Slide 40

Slide 40 text

Automated Build/ Release Pipeline

Slide 41

Slide 41 text

✓ Formatting Checks ✓ Linting ✓ Static Analysis ✓ Security Checks ✓ Unit Tests ✓ Integration Tests ✓ Spelling Checks ✓ Login / Auth

Slide 42

Slide 42 text

Security can make
 patches as needed Require developers to do
 so in a timely manner or

Slide 43

Slide 43 text

Average time to fix a vulnerability is 150 days after being reported…. you think that is due to technical reasons?

Slide 44

Slide 44 text

No content

Slide 45

Slide 45 text

No content

Slide 46

Slide 46 text

Lessons from Manufacturing MTTD, MTTR

Slide 47

Slide 47 text

Mean Time To Detect Mean Time To Resolve
 (bonus MTBF:
 Mean Time Between Failure)

Slide 48

Slide 48 text

https://speakerdeck.com/ngalbreath/ continuous-deployment-1

Slide 49

Slide 49 text

https://www.nps.gov/media/photo/gallery.htm?id=F865DA8A-155D-4519-3E66BBFECC74C707 No, that’s not going to work

Slide 50

Slide 50 text

Visibility and Realtime Monitoring http://spectrumscoreboards.com/2014-04-01-15-02-36/softball

Slide 51

Slide 51 text

Continuous Deployment Doesn't Change This Fact

Slide 52

Slide 52 text

— Zane Lackey “If you are on the Internet,
 you are already getting a free pen test. 
 
 You just aren’t getting the report.”

Slide 53

Slide 53 text

Get The Report
 Who are you attacker What is their goal Are they successful

Slide 54

Slide 54 text

Get The Report • Who are you attackers • What is their goal • Are they successful

Slide 55

Slide 55 text

Cosmic Background Noise of Attacks

Slide 56

Slide 56 text

Cloud-based scanner

Slide 57

Slide 57 text

Attack Tooling

Slide 58

Slide 58 text

What are they looking at Using SQLMap, on this URL, focused on 'guests'

Slide 59

Slide 59 text

Anomalies

Slide 60

Slide 60 text

http://the-toast.net/2014/02/04/in-defense-of-art-history/ That’s great but what does it mean?

Slide 61

Slide 61 text

An AppSec Love Story from Verona, Italy

Slide 62

Slide 62 text

Security is Empowered

Slide 63

Slide 63 text

Developers are interested in security

Slide 64

Slide 64 text

It’s the Call to Action Slide! http://i.huffpost.com/gen/799454/images/o-CLARK-ATLANTA-UNIVERSITY-MARCHING-PANTHERS-facebook.jpg Embrace Continuous Deployment
 Make Security Visible

Slide 65

Slide 65 text