Slide 1

Slide 1 text

Security Automation in Software Delivery: A Rugged DevOps Pipeline Matt Konda @mkonda

Slide 2

Slide 2 text

Prereqs • Docker Toolbox • http://prereqs.codemash.org/ • pipeline • http://prereqs.codemash.org/ • docker pull jemurai/pipeline:0.8 (or USB) • A project to analyze

Slide 3

Slide 3 text

Introduction 1997 2006 2014 Consultant Engineer Software Architect Director of Engineering Rabble Rouser: Perl Java Applet C++ J2EE J2EE
 Spring Analytics Certificate Authority Vulnerability Scanner Penetration Test Manager Pricing Retail Banking Manufacturing Pharma Healthcare Research Ruby Rails Chicago BSides 2011, 2012 Defcon Skytalk OWASP Chicago, MSP 2013 AppSec USA 2012, 2013 ChicagoRuby 2013 Secure 360 Lone Star Ruby 2013 WindyCityRails 2013 Chicago JUG 2014 RailsConf 2014 Converge 2014 Chicago Coder Conference 2015 MS in CS Founder Consultant Agile Clojure Graph Database Trying to hack a business model that succeeds while helping developers. Domains: Projects: DevOps / Automation Training Coaching Code Review Plugged in to SDLC Consulting Assessments @mkonda [email protected] DevOps Growing

Slide 4

Slide 4 text

What do I do? • Bug bounty • Breaking • Mostly SDLC • Training • Automation

Slide 5

Slide 5 text

Overview • Hands on with Pipeline for labs • Quick overview of security tools • DevOps / Continuous Delivery & Rugged • Leveraging security automation where possible

Slide 6

Slide 6 text

Lab 1: Running Pipeline from Docker 1. docker-machine create --driver virtualbox default 2. eval $(docker-machine env default) 3. docker pull jemurai/pipeline:0.8 (or: docker load < pipeline-0.8.tar.gz) 4. docker run —rm jemurai/pipeline:0.8 -h 6. docker run —rm jemurai/pipeline:0.8 \ https://github.com/Jemurai/triage.git

Slide 7

Slide 7 text

Checkpoint: 30?

Slide 8

Slide 8 text

Security Tools

Slide 9

Slide 9 text

Static Analysis

Slide 10

Slide 10 text

Static Analysis Live App Scanning

Slide 11

Slide 11 text

Static Analysis Live App Scanning Dynamic Analysis

Slide 12

Slide 12 text

Static Analysis Live App Scanning Dynamic Analysis Dependency Checks

Slide 13

Slide 13 text

Static Analysis Live App Scanning Dynamic Analysis Dependency Checks Web Application Firewall

Slide 14

Slide 14 text

Static Analysis Live App Scanning Dynamic Analysis Dependency Checks Web Application Firewall Runtime Security Monitoring

Slide 15

Slide 15 text

Static Analysis Live App Scanning Dynamic Analysis Dependency Checks Web Application Firewall Runtime Security Monitoring IP Reputation

Slide 16

Slide 16 text

Static Analysis Live App Scanning Dynamic Analysis Dependency Checks Web Application Firewall Runtime Security Monitoring IP Reputation Anti-Automation

Slide 17

Slide 17 text

Static Analysis Live App Scanning Dynamic Analysis Dependency Checks Web Application Firewall Runtime Security Monitoring IP Reputation Anti-Automation Penetration Testing

Slide 18

Slide 18 text

Static Analysis Live App Scanning Dynamic Analysis Dependency Checks Web Application Firewall Runtime Security Monitoring IP Reputation Anti-Automation Penetration Testing

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

B+ C B+ F D D F B A- C The items on the left are the OWASP Top 10. The grades are mine and are arbitrary. https://www.owasp.org/index.php/Top_10_2013-Top_10

Slide 21

Slide 21 text

No content

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

There is no substitute for people with knowledge.

Slide 24

Slide 24 text

But we can help ourselves by leveraging tools.

Slide 25

Slide 25 text

We just have to be smart and flexible about it.

Slide 26

Slide 26 text

Lab 2: Running Pipeline on Your Project docker run jemurai/pipeline:0.8 \ -d \ -f csv \ -v ~/code/location:/tmp/directory/ \ /tmp/directory/ * Due to docker ease of setup, please use a directory within your home directory. It is possible to do this in other ways, but it requires further setup of shared folders in virtual box which we want to avoid for the purposes of this workshop.

Slide 27

Slide 27 text

What are your results?

Slide 28

Slide 28 text

Checkpoint: 60?

Slide 29

Slide 29 text

DevOps / Continuous Delivery

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

Rugged

Slide 32

Slide 32 text

I recognize that software has become a foundation of our modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged.

Slide 33

Slide 33 text

I recognize that software has become a foundation of our modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged.

Slide 34

Slide 34 text

Understand lifecycle

Slide 35

Slide 35 text

Requirements Design Code Test Maintenance Classic Waterfall Delivery

Slide 36

Slide 36 text

Requirements Design Code Test Maintenance Classic Waterfall Delivery Security

Slide 37

Slide 37 text

continuous delivery

Slide 38

Slide 38 text

Classic security sees this and wants to …

Slide 39

Slide 39 text

continuous delivery

Slide 40

Slide 40 text

But we can embrace it.

Slide 41

Slide 41 text

Being able to deploy quickly is my #1 security feature. - Nick Galbreath

Slide 42

Slide 42 text

Think incremental

Slide 43

Slide 43 text

Story Continuous Delivery: The Unit of work is a story Requirements Design Code Test

Slide 44

Slide 44 text

Story Continuous Delivery: The Unit of Work is a Story Requirements Design Code Test Security Requirements Security Unit Tests Exploratory Testing Static Analysis on Commit Code Review Threat model / attack surface Checklists Understand Dependencies

Slide 45

Slide 45 text

continuous delivery Code Review Security Unit Tests Security Requirements

Slide 46

Slide 46 text

Automate security tools

Slide 47

Slide 47 text

continuous delivery Security Tool Automation: Code analysis Security unit tests Dynamic scanning etc.

Slide 48

Slide 48 text

continuous delivery Security Tests Run Exploratory Testing Includes Security

Slide 49

Slide 49 text

Lab 3: Getting into the Pipeline Docker Image 1. docker run -i -t —entrypoint=/bin/ bash jemurai/pipeline:0.8 2. cd lib 3. ../bin/pipeline -h Now you’re running from source. We can change anything …

Slide 50

Slide 50 text

Checkpoint: 80?

Slide 51

Slide 51 text

Case Study

Slide 52

Slide 52 text

Credit: Matt Tesauro at AppSecEU 2015 http://www.slideshare.net/mtesauro/mtesauro-keynote-appseceu

Slide 53

Slide 53 text

Pipeline Design

Slide 54

Slide 54 text

Overview • Pipeline is broken into different chunks to try to make it easy and straightforward to extend in expected ways. • These illustrate the challenges of security automation. Mounter Files Code Live Filter Reporter “Tasks”

Slide 55

Slide 55 text

No content

Slide 56

Slide 56 text

No content

Slide 57

Slide 57 text

Mounter git repo, filesystem, iso, docker image

Slide 58

Slide 58 text

No content

Slide 59

Slide 59 text

No content

Slide 60

Slide 60 text

Mounter clamav hashdeep Files

Slide 61

Slide 61 text

No content

Slide 62

Slide 62 text

Mounter brakeman, bundler-audit, owasp-dependency-check, secrets in source, retire.js, eslint/scan.js, nodesecurityproject. Files Code

Slide 63

Slide 63 text

No content

Slide 64

Slide 64 text

No content

Slide 65

Slide 65 text

No content

Slide 66

Slide 66 text

Mounter Currently: ZAP Future: guantlt, etc. Files Code Live

Slide 67

Slide 67 text

No content

Slide 68

Slide 68 text

Recap of “Tasks” • File: AV, FIM • Code: • Ruby/Rails: brakeman, bundler-audit • JavaScript: NodeSecurityProject, eslint, retire.js • Java: owasp-dependency-check • Checkmarx • Live: ZAP

Slide 69

Slide 69 text

Lab 4: Running JS Tools 1.docker run jemurai/pipeline:0.8 -t eslint https://github.com/OWASP/ NodeGoat.git Or interactively: 1.docker run -t -i —entrypoint=/bin/bash jemurai/pipeline:0.8 2.cd line/pipeline/lib 3.../bin/pipeline -t eslint https:// github.com/OWASP/NodeGoat.git Try: -t eslint,nodesecurityproject,retirejs

Slide 70

Slide 70 text

Here’s a secret…

Slide 71

Slide 71 text

I can’t tell you what’s going to work for you.

Slide 72

Slide 72 text

Mounter Prevents false positives in JIRA. Files Code Live Filter

Slide 73

Slide 73 text

No content

Slide 74

Slide 74 text

Mounter Reports to JIRA, csv, json, text. Files Code Live Filter Reporter

Slide 75

Slide 75 text

No content

Slide 76

Slide 76 text

No content

Slide 77

Slide 77 text

How would you do tsv?

Slide 78

Slide 78 text

How would you do github?

Slide 79

Slide 79 text

No content

Slide 80

Slide 80 text

Extension Points • Mounters: mount, supports? • Tasks: run, analyze, supported? • Filters: filter • Reporter: run_report Mounter Files Code Live Filter Reporter “Tasks”

Slide 81

Slide 81 text

Other Internals • Within “Tasks”, each of the files, code and app phases of the pipeline can be run selectively as stages. Mounter Files Code Live Filter Reporter “Tasks”

Slide 82

Slide 82 text

ruby bin/pipeline -l code (Code analysis) -d (Turn on debug) -f text (Output format) /area53/app/

Slide 83

Slide 83 text

ruby bin/pipeline -t brakeman (Tool) -d (Turn on debug) -f csv (Output format) /area53/app/

Slide 84

Slide 84 text

Lab 5: Adding a New Tool to Pipeline 1. docker run -i -t —entrypoint=/bin/ bash jemurai/pipeline:0.8 2. cd pipeline/lib/pipeline/tasks/ 3. cp bundler-audit.rb test.rb 4. Edit to always create a finding (or use the following example for grep) 5. cd /../../lib 6. …/bin/pipeline -t test /tmp/

Slide 85

Slide 85 text

No content

Slide 86

Slide 86 text

Checkpoint: 125?

Slide 87

Slide 87 text

Integrations

Slide 88

Slide 88 text

pre-commit

Slide 89

Slide 89 text

Lab 5: Running Pipeline on a Git Hook 1. Copy /hooks/pre-commit to your project in /.git/hooks 2. chmod +x pre-commit 3. Edit pre-commit to reflect your path and tools 4. Regular process: 1. Change a 2. git add 3. git commit -m “Testing”

Slide 90

Slide 90 text

No content

Slide 91

Slide 91 text

chat ops

Slide 92

Slide 92 text

No content

Slide 93

Slide 93 text

No content

Slide 94

Slide 94 text

https://github.com/OWASP/Owbot

Slide 95

Slide 95 text

Jenkins

Slide 96

Slide 96 text

No content

Slide 97

Slide 97 text

No content

Slide 98

Slide 98 text

No content

Slide 99

Slide 99 text

No content

Slide 100

Slide 100 text

No content

Slide 101

Slide 101 text

No content

Slide 102

Slide 102 text

No content

Slide 103

Slide 103 text

No content

Slide 104

Slide 104 text

No content

Slide 105

Slide 105 text

No content

Slide 106

Slide 106 text

Issue Tracking

Slide 107

Slide 107 text

Jira

Slide 108

Slide 108 text

Github (future)

Slide 109

Slide 109 text

Process images

Slide 110

Slide 110 text

spider docker registry

Slide 111

Slide 111 text

grab ami

Slide 112

Slide 112 text

Process chef, puppet, ansible config …

Slide 113

Slide 113 text

Custom Application

Slide 114

Slide 114 text

No content

Slide 115

Slide 115 text

No content

Slide 116

Slide 116 text

No content

Slide 117

Slide 117 text

No content

Slide 118

Slide 118 text

Chat + UI + Queue + Pipeline + Jenkins + JIRA

Slide 119

Slide 119 text

Checkpoint: 160?

Slide 120

Slide 120 text

Thank you.

Slide 121

Slide 121 text

References • https://github.com/owasp/pipeline • https://www.owasp.org/index.php/OWASP_AppSec_Pipeline • https://speakerdeck.com/garethr/maintaining-control-by-letting-go-security-and-devops • http://www.slideshare.net/nickgsuperstar/devopssec-apply-devops-principles-to-security • https://www.rsaconference.com/writable/presentations/file_upload/asd-t07r-continuous- security-5-ways-devops-improves-security.pdf • http://gotocon.com/goto-london-2015/ • http://gauntlt.org/ • https://github.com/PearsonEducation/bag-of-holding • https://www.ruggedsoftware.org/

Slide 122

Slide 122 text

Thank you. Bill Sempf Justin Collins Aaron Bedra Jim Manico Matt Tesauro Josh Corman CodeMash!