Rationalizing Security - Speaker Deck

Slide 1

Slide 1 text

Rationalizing Security Matt Konda Jemurai @mkonda [email protected] https://en.wikipedia.org/wiki/Rational_function

Slide 2

Slide 2 text

Introduction 1997 2006 2014 Consultant Engineer Software Architect Director of Engineering Rabble Rouser: Perl Java Applet C++ J2EE J2EE  Spring Analytics Certiﬁcate Authority Vulnerability Scanner Penetration Test Manager Pricing Retail Banking Manufacturing Pharma Healthcare Research Ruby Rails Chicago BSides 2011, 2012 Defcon Skytalk OWASP Chicago, MSP 2013 AppSec USA 2012, 2013 ChicagoRuby 2013 Secure 360 Lone Star Ruby 2013 WindyCityRails 2013 Chicago JUG 2014 RailsConf 2014 Converge 2014 ChicagoCoderConference 2015 MS in CS Founder Consultant Agile Clojure Graph Database Big Data Trying to hack a business model that succeeds while helping developers. Domains: Projects: DevOps / Automation Training Coaching Code Review Plugged in to SDLC Consulting Assessments @mkonda [email protected] Secure DevOps Growing OWASP Board Agile Security

Slide 3

Slide 3 text

Census?

Slide 4

Slide 4 text

What are you hoping to get out of this?

Slide 5

Slide 5 text

Metasploit Demo

Slide 6

Slide 6 text

Case Study 1 e-Commerce Fraud

Slide 7

Slide 7 text

“This year, organized crime became the most frequently seen threat actor for Web App Attacks.” Verizon 2015 DBIR

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

See • Botnets • Widespread use of harvested credentials • Account takeover • Credit card fraud • Dumps of passwords and sensitive data with SQLi • User pwnage with XSS

Slide 10

Slide 10 text

Case Study 2 Healthcare Fraud

Slide 11

Slide 11 text

“Two thirds of the incidents in this pattern had no attacker-attribution information whatsoever.” Verizon 2015 DBIR Cyber-Espionage

Slide 12

Slide 12 text

See • Long term investment • Systematic targeting • Phishing / Social Engineering • Pivoting

Slide 13

Slide 13 text

How long does it take for your host to get scanned / attacked on the open internet?

Slide 14

Slide 14 text

As a startup, you’re probably not an You’re in experimental mode …

Slide 15

Slide 15 text

You don’t want to worry about it

Slide 16

Slide 16 text

There are generally three things that force you to think about security.

Slide 17

Slide 17 text

No content

Slide 18

Slide 18 text

No content

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

Your user’s privacy is important.

Slide 21

Slide 21 text

So is your company’s privacy.

Slide 22

Slide 22 text

Maturity Scale • Opportunistic • Defensible • Serious • Paranoid

Slide 23

Slide 23 text

Opportunistic • Use platform provided security • Run tools yourself (eg. brakeman)

Slide 24

Slide 24 text

Defensible • Policy, including data classiﬁcation • Security assessments • Build servers to security standard

Slide 25

Slide 25 text

Serious • Active monitoring, log collection • Incident response • Security in SDLC (Static analysis, code review, training, automation) • Have a security team, app security team (Network, Desktop, Server controls)

Slide 26

Slide 26 text

Paranoid • Threat intelligence • Anti-Fraud • DDoS • Bug Bounty • Forensics

Slide 27

Slide 27 text

Things you can do now.

Slide 28

Slide 28 text

Use Services Provided • Use IAM to deﬁne groups users. Use MFA. • Limit Network Access, Use TrustedAdvisor • CloudTrail • Use encryption for S3, EBS, RDS, etc. • New: Inspector, WAF, Conﬁg Rules

Slide 29

Slide 29 text

• XSS is really code injection. • The distinction is that the code is running in your user’s browser. • This can have crippling signiﬁcance - because it bypasses network and other typical controls. Cross-site Scripting

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

beef demo

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

No content

Slide 35

Slide 35 text

No content

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

No content

Slide 38

Slide 38 text

OWASP Top 10

Slide 39

Slide 39 text

Flagship Projects Tools • ZAP • OWASP Dependency Check • Web Testing Environment Project • OWTF Code • ModSecurity • CSRFGuard • AppSensor Documentation • ASVS • SAMM • Top 10 • Testing Guide • Benchmark

Slide 40

Slide 40 text

OWASP ASVS

Slide 41

Slide 41 text

Tiers • 0 – Cursory – You have done something. You define. • 1 – Opportunistic – Adequately defends against easily discoverable items. • 2 – Standard – Adequately defends against items of moderate to serious risk. • 3 – Advanced – Defends against even advanced attacks and demonstrates good security design.