Slide 1

Slide 1 text

Copyright © we45 2020 abhaybhargav Practical DevSecOps Pipelines Abhay Bhargav, we45

Slide 2

Slide 2 text

Copyright © we45 2020 abhaybhargav Yours Truly • Founder @ we45 • Chief Architect - Orchestron • Avid Pythonista and AppSec Automation Junkie • Trainer/Speaker at DEF CON, BlackHat, OWASP Events, etc world-wide • Lead Trainer - we45 Training and Workshops • Co-author of Secure Java For Web Application Development • Author of PCI Compliance: A Definitive Guide

Slide 3

Slide 3 text

Copyright © we45 2020 abhaybhargav Virtual Training • DevSecOps MasterClass => 1 & 2 July 2020 • Attacking and Defending Containers, Kubernetes and Serverless => June 22-25 2020 • Significant Discount on all courses • URL: store.we45.com • Get Live Training + Access to Labs + Access to Videos + Certification =

Slide 4

Slide 4 text

Copyright © we45 2020 abhaybhargav Conference Training

Slide 5

Slide 5 text

abhaybhargav we45 Community Initiatives Youtube Channel: youtube.com/we45-appsec Blog: we45.com/blog Talks/Workshops at several OWASP Events

Slide 6

Slide 6 text

Copyright © we45 2020 abhaybhargav Agenda • CI Problems with Security Tools • Security Problems with CI Tools • Developments in Static Analysis • Cloud-Native Pipelines - A New Hope • Demos • FIN

Slide 7

Slide 7 text

Copyright © we45 2020 abhaybhargav Pray to the Demo Gods

Slide 8

Slide 8 text

Copyright © we45 2020 abhaybhargav CI Problems with Security Tools • “Run MY tool. See MY Dashboard” • Inconsistent APIs • Long-running jobs

Slide 9

Slide 9 text

Copyright © we45 2020 abhaybhargav Security Tools - Its all about me!

Slide 10

Slide 10 text

Copyright © we45 2020 abhaybhargav Security Tool Narcissism

Slide 11

Slide 11 text

Copyright © we45 2020 abhaybhargav Long-running jobs

Slide 12

Slide 12 text

Copyright © we45 2020 abhaybhargav Blocking Good Feedback a.k.a Security(-Usability) Issues with CI Tools

Slide 13

Slide 13 text

Copyright © we45 2020 abhaybhargav –Several unsung security heroes “Jenkins is the Wordpress of CI”

Slide 14

Slide 14 text

Copyright © we45 2020 abhaybhargav –Abhay Bhargav “There’s something very ironic about finding RCEs in a RCE platform”

Slide 15

Slide 15 text

Copyright © we45 2020 abhaybhargav Let’s play Outcome Jeopardy! • Authentication Bypass => RCE! • AuthZ Bypass => RCE! • XSS => RCE! • RCE => RCE!

Slide 16

Slide 16 text

Copyright © we45 2020 abhaybhargav On top of that… • Not very CD friendly - Especially for “born in cloud” services • Not very cloud/container-native friendly • Not very micro-services friendly

Slide 17

Slide 17 text

Copyright © we45 2020 abhaybhargav And in many cases ….

Slide 18

Slide 18 text

Copyright © we45 2020 abhaybhargav Better (more Practical) DevSecOps Pipelines

Slide 19

Slide 19 text

Copyright © we45 2020 abhaybhargav Areas of Focus • A More effective world of Static Analysis • Test Automation weds DAST/IAST • Cloud-Native DevOps Pipelines

Slide 20

Slide 20 text

Copyright © we45 2020 abhaybhargav SAST Tools •Multi-Language (Typically Commercial) SAST Tools •Multi-Language and Platform •Combination of AST and Regex •Source-Sink and linked usage functionality •Single Language/Platform (Typically OSS) SAST Tools •Single Language or Platform •Typically AST based Scanning Tools •No Source-Sink. Typically File and Line-based analysis •Semantic Grep/QL Tools •New Category of SAST Analysis •Semantic Grep or Queries against Source Code (like SQL) •Aims at uncovering flaws at scale

Slide 21

Slide 21 text

Copyright © we45 2020 abhaybhargav SAST Test Approaches •Good ol’ Regular Expressions •Abstract Syntax Trees •Semantic Grep or QL

Slide 22

Slide 22 text

Copyright © we45 2020 abhaybhargav Errors Code Comments: # Don’t use this!! jwt.decode(something, secret, verify=False)

Slide 23

Slide 23 text

Copyright © we45 2020 abhaybhargav SAST with AST

Slide 24

Slide 24 text

Copyright © we45 2020 abhaybhargav AST example with Python call nil jwt.decode args local “verify”

Slide 25

Slide 25 text

Copyright © we45 2020 abhaybhargav Semgrep and CodeQL

Slide 26

Slide 26 text

Copyright © we45 2020 abhaybhargav Demo

Slide 27

Slide 27 text

Copyright © we45 2020 abhaybhargav A New Hope

Slide 28

Slide 28 text

Copyright © we45 2020 abhaybhargav A (Better) alternative? • No Persistent Compute => Typically with Orchestration (Container) • Cloud-Native: • Integrated Secrets Management • Centralized IAM Implementation • Object Storage • Query Tools (Athena)

Slide 29

Slide 29 text

Copyright © we45 2020 abhaybhargav In addition… • Closer to developer workflows => Github, Gitlab, AWS • Container-Native workflows

Slide 30

Slide 30 text

Copyright © we45 2020 abhaybhargav Existing Options

Slide 31

Slide 31 text

Copyright © we45 2020 abhaybhargav Some unconventional approaches • Test Automation Frameworks for Security Workflows • Step Functions (State Machines) • Flows with Container Orchestration

Slide 32

Slide 32 text

Copyright © we45 2020 abhaybhargav Test Automation Driven Workflows • Test Automation Frameworks can be used to trigger all kinds of security workflows • Frameworks like Robot Framework and Gauge are low-maintenance and low- code • Much more suited to developer and QA workflows

Slide 33

Slide 33 text

Copyright © we45 2020 abhaybhargav Robot Framework *** Test Cases *** Clone repo from Github clone repository from url ${GIT_URL} ${TO_PATH} Run NodeJSScanner run nodejsscan against source ${TO_PATH} ${RESULTS_PATH} nodejsscan write to orchy ${RESULTS_PATH}/nodejsscan.json ${SECRET} ${ACCESS} ${HOOK} Run NPM Audit against packageJSON run npmaudit against source ${TO_PATH} ${RESULTS_PATH} npmaudit write to orchy ${RESULTS_PATH}/npm_audit.json ${SECRET} ${ACCESS} ${HOOK} Initialize ZAP [Tags] zap_init start gui zap ${ZAP_PATH} sleep 10 zap open url http://${TARGET_URI} Authenticate to Cut the Funds as Admin [Tags] walk_web_service &{res}= POST /users/login {"email": "[email protected]", "password": "spiderman"} Integer response status 200 Boolean response body auth true set suite variable ${TOKEN} ${res.body["token"]} log ${TOKEN}

Slide 34

Slide 34 text

Copyright © we45 2020 abhaybhargav Gauge Demo

Slide 35

Slide 35 text

Copyright © we45 2020 abhaybhargav Github Actions

Slide 36

Slide 36 text

Copyright © we45 2020 abhaybhargav Step Functions • Coordinate AWS services into Serverless Workflows • Can be used for: • AWS Lambda • Fargate • Sagemaker

Slide 37

Slide 37 text

Copyright © we45 2020 abhaybhargav Step Functions States • Task • Choice • Fail/Succeed • Pass • Wait • Parallel • Map

Slide 38

Slide 38 text

Copyright © we45 2020 abhaybhargav Benefits • Modeling complex workflows • Event-driven => Invoked only as required • No Persistent Compute/Service • Engineering/Developer-first workflow

Slide 39

Slide 39 text

Copyright © we45 2020 abhaybhargav

Slide 40

Slide 40 text

Copyright © we45 2020 abhaybhargav Demo

Slide 41

Slide 41 text

Copyright © we45 2020 abhaybhargav DAST/IAST Workflows

Slide 42

Slide 42 text

Copyright © we45 2020 abhaybhargav Data Consumption Possibilities • Orchestron/Other Vulnerability Management tool • Athena (equivalent) to query and render results • Slack/JIRA push, etc

Slide 43

Slide 43 text

Copyright © we45 2020 abhaybhargav Conclusions • Think Feedback more than force-fitting into Pipelines • Think beyond CI tools to run CIs. There are some significant constraints • Speed and High Signal Ratio is very important for you to be more effective • Leverage Cloud-Native tooling for “born in cloud/ container-dependent” services abhaybhargav we45