Automation of Security scanning easy or cheese
- 1. 1 Skype: florykian.karen EPAM Kharkiv Security Automation Easy or cheese by Karen Florykian Lead Performance Analyst
- 2. 2 Application Security Testing Security assessment for routers, firewall, load balancers, switches, find network misconfiguration Infrastructure Scanning OS vulnerabilities, known vulnerabilities in images, evaluate the image against policies to check for security compliance. Container Scanning Dynamic application security testing Find security vulnerabilities in a running application, typically web apps. DAST Static Application Security Testing Catch security issues on early stages of code development, allows developers to find bugs in code SAST Many types of security vulnerabilities are difficult to find automatically, such as authentication problems, access control issues, insecure use of cryptography, etc. Functional Security Automation
- 4. 4 Real Life 68 % False positive analysis 25 % 29 % 39 % 7 %
- 5. 5 Real Life 85 % of findings are not real issues 25 % 29 % 39 % 7 %
- 6. 6 Vision
- 7. 7 Proof Of Concept • Integrated in existing CI pipeline or configured to be ran on self- service basis • Traffic created using existing tests • False Positives analysis can be partially automated using DefectDojo or ReportPortal capabilities
- 9. 9 Under The SAST Hood
- 10. 10
- 12. 12 Spidergetti Or Rainboweb Jira service ReportPortal Jira Service Junit XML
- 13. 13 Canonical Data Model Jira service ReportPortal Jira Service Junit XML CDM
- 14. 14 Auto-Analysis • Validate capabilities • Identify parameters to reduce duplicates • Create service with equals strategy • Contact to ReportPortal team to create custom analyzer service with equals strategy
- 15. 15 Issue #1
- 16. 16 Issue #2
- 17. 17 We All Are Lazy VS OPEN FOR WEEKS BECAUSE IT IS NOT ACTIONABLE FIXED WITHIN THE WEEK IT APPEARED IN BACKLOG
- 18. 18 Carrier carrier-io/sast: Tools for SAST Demo
- 19. 19
- 20. 20 Useful Links • SAST: https://github.com/carrier-io/sast • Docker Hub: https://hub.docker.com/r/getcarrier/sast • DAST: https://github.com/carrier-io/dast • Docker Hub: https://hub.docker.com/r/getcarrier/dast • DASTY ☺: https://github.com/carrier-io/dusty Library to execute various security tools and convert output to common unifiedformat • Carrier: https://hub.docker.com/u/getcarrier • ReportPortal Auto-Analysis equals service: https://github.com/reportportal/service-analyzer-equals
- 21. 21 Thank You!Florykian Karen Lead Performance Analyst