Automating Security Tests in Development with Docker
0 likes13 views
The document discusses automating security tests in development using Docker, emphasizing the importance of shifting left in the software lifecycle to enhance security. It covers various tools, techniques, and the advantages of using containers for security testing, such as speed and efficiency. The presentation also highlights application-specific attacks and encourages developers to incorporate security practices into their continuous integration and deployment processes.
Automating Security Tests in Development with Docker
- 1. Gabe Schuyler @gabe_sky LASCON 2022 Automating security tests in development with Docker (an introduction)
- 2. Gabe Schuyler LASCON 2022 @gabe_sky Who am I? Gabe Schuyler • Operations • Cybersecurity • Dev(Sec)Ops • Now: Wiz, Inc. • Past: Palo Alto Networks, PuppetLabs, Sony Playstation ...
- 3. Gabe Schuyler LASCON 2022 @gabe_sky Why bother? framing the problem • Use the same tools as attackers • An ounce of prevention • Shift-left • Developers know what to double-down on in an attack • Continuously shifting attacks -- don't just scan once and forget it • Avoid gating before production • Pen tests take weeks, a Docker run takes seconds
- 4. Gabe Schuyler LASCON 2022 @gabe_sky Containers in a very small nutshell • Tiny • Prepackaged • Single purpose • Virtual machines
- 5. Gabe Schuyler LASCON 2022 @gabe_sky Docker in a nutshell shrinking it down • Overview • Images • Volumes • Ports • Web apps • Attack platforms apps tools games kernel
- 6. Gabe Schuyler LASCON 2022 @gabe_sky Docker in a nutshell shrinking it down • Overview • Images • Volumes • Ports • Web apps • Attack platforms apps tools games kernel app fi les ports
- 7. Gabe Schuyler LASCON 2022 @gabe_sky Docker in a nutshell shrinking it down • Overview • Images • Volumes • Ports • Web apps • Attack platforms kernel app fi les ports
- 8. Gabe Schuyler LASCON 2022 @gabe_sky Docker in a nutshell shrinking it down kernel attack fi les ports web server • Overview • Images • Volumes • Ports • Web apps • Attack platforms
- 9. Gabe Schuyler LASCON 2022 @gabe_sky Readme.txt relax, it's all here • Requirements • Commands to run • We're trying to help • "Pull requests welcome!"
- 10. Gabe Schuyler LASCON 2022 @gabe_sky Caveat haX0r you break it you bought it • Virtualize • Snapshot • Embrace destruction
- 11. Gabe Schuyler LASCON 2022 @gabe_sky Launching broad attacks it's not just for script kiddies • ZAProxy • nikto • Ask your developers what to try!
- 12. Gabe Schuyler LASCON 2022 @gabe_sky Application-specific attacks know your enemy • wpscan • SQLmap
- 13. Gabe Schuyler LASCON 2022 @gabe_sky Fuzzing what's that you say? • ff uf • wfuzz • API security
- 14. Gabe Schuyler LASCON 2022 @gabe_sky General purpose toolkits generic linux as a container • Kali • Some assembly required • Versatile • Docker fi les and layers
- 15. Gabe Schuyler LASCON 2022 @gabe_sky Continuous attack in the software lifecycle • Research • Development • Deployment • Production • Share results • Borrow knowledge
- 16. Gabe Schuyler LASCON 2022 @gabe_sky Where to start danger is my middle name • Web application • Basic attacks • Get fancy • Integrate into CICD • Integrate into monitoring
- 17. Q & A and Discussion Gabe Schuyler @gabe_sky LASCON 2022