Interact Differently: Get More From Your Tools Through Exposed APIs
Download as PPTX, PDF1 like279 views
This document summarizes a presentation about automating application security tools and customizing their outputs. It discusses automating simple tests that tools can detect quickly and accurately. It also discusses customizing dashboards and reports to track desired metrics and see results from different tools in one place. The presentation encourages attendees to integrate tools through their APIs and code their own plugins and parsers to solve problems with their workflows.
![Application security that just works
AUTOMATE SIMPLE TESTING
©2015 Aspect Security. All Rights Reserved 8
Cross-domain configurations vs policy: CSP, Framing, etc.
HTTPS page accessible via HTTP
File metadata (ex. Exif data) scanner
Obviously verbose error messages (ex. ORA-#####)
PII Displayed on Screen (ex. SSN, CCs)
Cookie security flags, cache controls, autocomplete enabled
Outdated [JavaScript] libraries
Insecure encryption algorithm/mode detected
Hard-Coded encryption key
POST=GET](https://image.slidesharecdn.com/interact-differently-get-more-from-your-tools-through-exposed-apis-shared-161104181057/85/Interact-Differently-Get-More-From-Your-Tools-Through-Exposed-APIs-8-320.jpg)
Interact Differently: Get More From Your Tools Through Exposed APIs
- 1. Aspect Security | 9175 Guilford Road, Suite 300 | Columbia, MD 21046 | www.aspectsecurity.com Interact Differently: Get More from your Tools through Exposed APIs OWASP LASCON Austin, TX Nov. 4, 2016
- 2. Application security that just works ABOUT ME Kevin Fealey Principal Consultant & Practice Lead, Automation & Integration Services Never a “developer” Key Interests: • Process efficiency/effectiveness (Sec + Dev + Ops) • Learning about cool tools ©2015 Aspect Security. All Rights Reserved 2
- 3. Application security that just works SLIDES WILL BE AVAILABLE… ©2015 Aspect Security. All Rights Reserved 3 We may never finish… https://www.linkedin.com/in/kfealey http://www.slideshare.net/kfealey
- 4. Application security that just works APPLICATION SECURITY LANDSCAPE ©2015 Aspect Security. All Rights Reserved 4
- 5. Application security that just works APPLICATION SECURITY LANDSCAPE ©2015 Aspect Security. All Rights Reserved 5
- 6. COMMON PROBLEMS INVOLVING APPSEC TOOLS ©2015 Aspect Security. All Rights Reserved 6
- 7. Application security that just works FIRST WORLD PROBLEMS ©2015 Aspect Security. All Rights Reserved 7
- 8. Application security that just works AUTOMATE SIMPLE TESTING ©2015 Aspect Security. All Rights Reserved 8 Cross-domain configurations vs policy: CSP, Framing, etc. HTTPS page accessible via HTTP File metadata (ex. Exif data) scanner Obviously verbose error messages (ex. ORA-#####) PII Displayed on Screen (ex. SSN, CCs) Cookie security flags, cache controls, autocomplete enabled Outdated [JavaScript] libraries Insecure encryption algorithm/mode detected Hard-Coded encryption key POST=GET
- 9. Application security that just works AUTOMATE SIMPLE TESTING ©2015 Aspect Security. All Rights Reserved 9
- 10. Application security that just works AUTOMATE SIMPLE TESTING ©2015 Aspect Security. All Rights Reserved 10 If a tool can find it quickly and with high accuracy, detection should be automated.
- 11. Application security that just works AUTOMATE SIMPLE TESTING ©2015 Aspect Security. All Rights Reserved 11 Allows login.jsp?username=hacked&password=whocares
- 12. Application security that just works AUTOMATE SIMPLE TESTING ©2015 Aspect Security. All Rights Reserved 12
- 13. Application security that just works AUTOMATE SIMPLE TESTING ©2015 Aspect Security. All Rights Reserved 13
- 14. Application security that just works AUTOMATE SIMPLE TESTING ©2015 Aspect Security. All Rights Reserved 14
- 15. Application security that just works AUTOMATE TOOL EXECUTION ©2015 Aspect Security. All Rights Reserved 15 • When evaluating tools, consider if there is a CLI/SDK – even if you don’t plan to automate today • Make integration as fool-proof as possible or
- 16. Application security that just works CUSTOM DASHBOARDS ©2015 Aspect Security. All Rights Reserved 16 Bulky installations Non-intuitive UIs Lack of flexibility for tracking metrics that matter to you Limited support for 3rd party tools Results from pen test and SAST don’t go in the same place •Unless it’s a huge, ugly, spreadsheet Most dashboards have:
- 17. Application security that just works CUSTOM DASHBOARDS ©2015 Aspect Security. All Rights Reserved 17
- 18. Application security that just works CUSTOM DASHBOARDS ©2015 Aspect Security. All Rights Reserved 18
- 19. Application security that just works CUSTOM DASHBOARDS ©2015 Aspect Security. All Rights Reserved 19
- 20. Application security that just works CUSTOM REPORTS/VIEWS ©2015 Aspect Security. All Rights Reserved 20 • If the dashboard/view you want does not exist, have you tried to create it?
- 21. GOTO: <CODE> ©2015 Aspect Security. All Rights Reserved 21
- 22. Application security that just works CUSTOM REPORTS/VIEWS ©2015 Aspect Security. All Rights Reserved 22 • If the dashboard/view you want does not exist, have you tried to create it?
- 23. Application security that just works CUSTOM TOOL INTEGRATIONS ©2015 Aspect Security. All Rights Reserved 23
- 24. GOTO: <CODE> ©2015 Aspect Security. All Rights Reserved 24
- 25. I’M ON BOARD.. HOW DO I BEGIN? ©2015 Aspect Security. All Rights Reserved 25
- 26. Application security that just works GETTING STARTED • Doesn’t have to be a good idea Have an idea • Use existing Parsers Clone an existing plugin/configuration • Vendor documentation • Mailing lists • Dev forums • Blog posts Use ©2015 Aspect Security. All Rights Reserved 26
- 27. Application security that just works KEY TAKEAWAYS You have the power to solve your own problems • It’s probably easier than you think Don’t start from scratch XPath is beastmode Contribute your stuff to GitHub so I can use it ©2015 Aspect Security. All Rights Reserved 27
- 28. Application security that just works CODE FROM TODAY https://github.com/aspectsecurity/ImageLocationScanner https://github.com/kevinfealey/PMDRuleForLASCON2016 https://github.com/kevinfealey/PMDCodeExampleForLASCON2016 https://github.com/jenkinsci/ibm-security-appscansource-scanner-plugin https://github.com/kevinfealey/ELK-for-AppSec https://github.com/kevinfealey/vagrant-ELK-stack https://github.com/kevinfealey/XSLT_AppScan_Standard_Report https://github.com/kevinfealey/Burp_Custom_Site_Exporter ©2015 Aspect Security. All Rights Reserved 28
- 29. Thank you! ©2015 Aspect Security. All Rights Reserved Kevin Fealey Kevin.Fealey@aspectsecurity.com @secfealz
Editor's Notes
- #11: https://github.com/aspectsecurity/ImageLocationScanner
- #12: https://github.com/aspectsecurity/ImageLocationScanner
- #13: https://github.com/aspectsecurity/ImageLocationScanner
- #15: https://github.com/kevinfealey/PMDRuleForLASCON2016 https://github.com/kevinfealey/PMDCodeExampleForLASCON2016
- #16: https://github.com/jenkinsci/ibm-security-appscansource-scanner-plugin
- #17: https://github.com/kevinfealey/ELK-for-AppSec https://github.com/kevinfealey/vagrant-ELK-stack
- #18: https://github.com/kevinfealey/ELK-for-AppSec
- #19: https://github.com/kevinfealey/ELK-for-AppSec
- #20: https://github.com/kevinfealey/ELK-for-AppSec
- #21: https://github.com/kevinfealey/XSLT_AppScan_Standard_Report
- #23: https://github.com/kevinfealey/XSLT_AppScan_Standard_Report
- #24: https://github.com/kevinfealey/Burp_Custom_Site_Exporter