Glue Intro - Speaker Deck

Slide 1

Slide 1 text

OWASP Glue Matt Konda [email protected] [email protected] @mkonda

Slide 2

Slide 2 text

Introduction 90’s 2006 2014 Consultant Engineer Software Architect Director of Engineering Rabble Rouser: Perl, Java Java Applet C++ J2EE Spring Analytics Certiﬁcate Authority Vulnerability Scanner Penetration Test Manager Pricing Retail Banking Manufacturing Pharma Healthcare Research Ruby Rails Chicago BSides 2011, 2012 Defcon Skytalk OWASP Chicago, MSP 2013 AppSec USA 2012, 2013 ChicagoRuby 2013 Secure 360 MS in CS Founder Consultant Agile Cloud Clojure Graph Database Independent. Focus developers. Consulting. Domains: Projects: DevOps / Automation Training Coaching Code Review Plugged in to SDLC Consulting Assessments @mkonda [email protected] CEO Services. Product. Teaching Growing Teams Forward OWASP Board Lone Star Ruby 2013 WindyCityRails 2013 Chicago JUG 2014 RailsConf 2014 Converge 2014 Chicago Coder Conference 2015, 2016 Goto Chicago 2016 OWASP Chicago

Slide 3

Slide 3 text

Team • Omer Levi Hevroni • (Active Leader) • Brian Fore • Me • Alex Lock • Runako Godfrey • Rafa Perez • Reuben Swartz

Slide 4

Slide 4 text

Also … I’m term limited. ;)

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

Intended to make it easy to do security automation.

Slide 7

Slide 7 text

Task Target Findings

Slide 8

Slide 8 text

Findings Filter Report

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

Running Glue from Docker 1. docker run —rm owasp/glue -h 2. docker run —rm owasp/glue -t brakeman https://github.com/Jemurai/triage.git

Slide 11

Slide 11 text

Running Glue from Docker 1. docker run —rm owasp/glue -t sfl https://github.com/Jemurai/triage.git

Slide 12

Slide 12 text

Running Glue from Docker 1. docker run —rm owasp/glue -l code https://github.com/Jemurai/triage.git

Slide 13

Slide 13 text

JIRA Example glue -t retire,sfl —f jira --jira-api-url myjira.atlassian.net --jira-api-context '' --jira-username youruser --jira-password password -—jira-project JIRA_PROJECT https://github.com/jemurai/triage.git

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

No content

Slide 16

Slide 16 text

Mounter Currently: git repo, ﬁlesystem, iso, docker image

Slide 17

Slide 17 text

Mounter Currently: clamav, hashdeep Files

Slide 18

Slide 18 text

Mounter Currently: brakeman, bundler-audit, owasp-dependency-check, secrets in source, retire.js, scan.js, bandit Future: many more possible. Designed for extension. Files Code

Slide 19

Slide 19 text

Mounter Currently: ZAP (in progress) Future: guantlt, nmap. Files Code App

Slide 20

Slide 20 text

Mounter Currently: Prevents false positives in JIRA. Files Code App Filter

Slide 21

Slide 21 text

Mounter Currently: Reports to JIRA, TeamCity, csv, json, off, text. Files Code App Filter Reporter

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

Go live

Slide 24

Slide 24 text

Extension Points • Mounters: mount, supports? • Tasks: run, analyze, supported? • Filters: ﬁlter • Reporter: run_report Mounter Files Code App Filter Reporter “Tasks”

Slide 25

Slide 25 text

Other Internals • Within “Tasks”, each of the ﬁles, code and app phases of the pipeline can be run selectively. Mounter Files Code App Filter Reporter “Tasks”

Slide 26

Slide 26 text

ruby bin/glue -l code (Code analysis) -d (Turn on debug) -f text (Output format) /area53/app/

Slide 27

Slide 27 text

Some checks excellent and valid…

Slide 28

Slide 28 text

Others still noisy …

Slide 29

Slide 29 text

What if it just automatically ran against every company github project?

Slide 30

Slide 30 text

Jenkins

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

No content

Slide 35

Slide 35 text

No content

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

No content

Slide 38

Slide 38 text

No content

Slide 39

Slide 39 text

No content

Slide 40

Slide 40 text

Recap of “Tasks” • File: AV, FIM • Code: • Secrets: SFL, Trufﬂehog • Ruby/Rails: brakeman, bundler-audit • JavaScript: NodeSecurityProject, eslint, retire.js • Python: bandit • Java: owasp-dependency-check • Other: Checkmarx • Ingestors: Burp, Contrast • Live: ZAP

Slide 41

Slide 41 text

Using K8S

Slide 42

Slide 42 text

Using K8S

Slide 43

Slide 43 text

Help? What’s next? • Omer is working on dynamic tasks. • Better tests • Better documentation • More tasks • Additional JIRA ﬂows

Slide 44

Slide 44 text

Let’s do it live.