Embracing DevSecOps: A Changing Security Landscape for the US Government
- 1. DJ Schleen Embracing DevSecOps A Changing Security Landscape for the US Government @djschleen
- 2. 2 devsecops
- 3. 3 not just for hipsters
- 5. culture
- 6. Photos courtesy of Pixabay and Pexels. the three ways
- 7. 7 AUTOMATE Automate security toolsets by integrating them into your SDLC in an unobtrusive and transparent way. DISSEMINATE Collect information from your toolsets, aggregate them into actionable KPI’s, and deliver them to the appropriate stakeholders. INVESTIGATE Establish baselines that define normal operating behavior and investigate abnormalities that appear EFFICIENCY @djschleen
- 10. The faster a team can deploy to production, the quicker an organization can remediate critical vulnerabilities and zero days 10 Cycle Time: Weeks - Months Cycle Time: Minutes - Hours 10 – 20 Releases Your imagination is the limit... Plan Deploy Operate Agile DevSecOps … Design Build Test Deploy Operate Design Build TestDesign Build Test Plan Design Build Test Deploy Operate Design Build Test Deploy Operate Observation @dschleen Increased Flow can reduce the risk of outdated software stagnating in production When change is normal and expected, fire-drills become a thing of the past Learn Learn LearnLearn AGILE ISN’T AGILE ENOUGH
- 11. Large Scale Exploit March 10 Equifax applications breached through Struts2 vulnerability AprMar May Jun Jul Aug Sept March 7 Apache Struts releases updated version to thwart vulnerability CVE-2017-5638 July 29 Breach is discovered by Equifax. Probe Crisis Management 11 @dschleen TIMELINE OF AN ATTACK
- 12. @djschleen
- 13. March 7 Apache Struts releases updated version to thwart vulnerability CVE-2017-5638 Today 8,780 continue to download vulnerable versions of Struts 57% of the Fortune 100 3 Days in March March 8 NSA reveals Pentagon servers scanned by nation-states for vulnerable Struts instances Struts exploit published to Exploit-DB. March 10 Equifax Canada Revenue Agency Canada Statistics GMO Payment Gateway The Rest of the Story March 13 Okinawa Power Japan Post March 9 Cisco observes "a high number of exploitation events." March ’18 India’s AADHAAR EQUIFAX WAS NOT ALONE April 13 India Post December ’17 Monero Cryptomining 13
- 14. AVERAGE DAYS BEFORE VULNERABILITY IS EXPLOITED
- 16. 85%-97% 16 CODE YOUR DEVELOPERS DON’T BUILD
- 17. @dschleen NIST SPECIAL PUBLICATION 800-161
- 18. @dschleen NIST SPECIAL PUBLICATION 800-161
- 19. @dschleen SAY HELLO TO YOUR SOFTWARE SUPPLY CHAIN
- 20. NOT ALL PARTS ARE CREATED EQUAL @devstefop s
- 21. AUTOMATION ACCELERATES OSS DOWNLOADS
- 22. 1,096 new projects per day 10,000 new versions per day 14x releases per year • 3M npm components • 2M Java components • 900K NuGet components • 870K PyPI components
- 23. @djschleen
- 24. 24 DEFECT PERCENTAGES FOR JAVASCRIPT @djschleen
- 25. 85% to 97% of modern apps consist of assembled components. 25
- 26. 80% to 90% of modern operations consist of assembled containers. 26 Containers Hand-built applications and infrastructure
- 27. PULLS FROM DOCKER HUB @djschleen
- 28. time
- 29. 233 days MeanTTR 119 days MedianTTR 122,802 components with known vulnerabilities 19,445 15.8% fixed the vulnerability TIME TO REPAIR OSS COMPONENTS @djschleen
- 30. 0 days MeanTTR CVE ID: CVE-2017-5638 March 7 Apache fixed the vulnerability March 7 APACHE STRUTS2 MEAN TIME TO REPAIR @djschleen
- 31. 170,000 Java component downloads annually 3,500 unique 18,870 11.1% with known vulnerabilities 7,500 ORGANIZATIONS ANALYZED @djschleen
- 32. threats are real
- 33. @djschleen
- 34. A Shifting Battlefront of Attacks: Hackers Inject Malicious Code into Supply Chains March 2016 - August 2018 left-pad: Popular npm packages were removed from the repository, breaking thousands of websites and revealing how changes can immediately propagate to the real world. 1 npm credentials used by publishers of 79,000 packages were published online or easily compromised by dictionary attacks. 2 PyPI typosquat: The Slovak National Security Office (NBU) found 10 malicious PyPI packages. Evidence of the fake packages being downloaded and incorporated into software multiple times was noted between Jun '17 and Sept '17. 5 npm credentials: A core contributor to the conventional-changelog ecosystem had their npm credentials compromised and a malicious version of the package was published. Package was installed 28,000 times in 35 hours and executed a Monero crypto miner. 7 Backdoored npm: The npm security team responded to reports of a package that masqueraded as a cookie parsing library but contained a malicious backdoor. Published in March ’18 to introduce unauthorized publishing of mailparser; despite being deprecated, mailparser still received about 64,000 weekly downloads. 9 homebrew breach: Eric Holmes, an operations engineer at Remind, gained commit access to homebrew in under 30 minutes through an exposed GitHub API token. While he had no malicious intent, he gained access to components that are downloaded 500,000 times per month. 11 Mar 2016 July 2017 Sep 2017 Jan 2018 Feb 2018 May 2018 Aug 2018 Malicious npm: Gilbertson writes a fictional tale of creating a malicious npm packages to harvest credit card numbers from hundreds of websites. 6 3 npm typosquat: 40 intentionally malicious packages harvested credentials used to publish to the npm repository itself. 4 docker123321 images were created on Docker Hub. In Jan'18, it was accused of poisoning a Kubernetes honeypot, then in May’18 it was equated to a crypto mining botnet. 8go-bindata: after a developer deleted their GitHub account, someone immediately grabbed the ID — inheriting the karma instilled in that id, calling into question what packages and sources are canonical and immutable. 10 Backdoored PyPI: SSH Decorator (ssh-decorate), a library for handling SSH connections from Python code, was backdoored to enable stealing of private SSH credentials. 34 @djschleen
- 35. Laurie Voss, npm and the furture of JavaScript, 2018-10-10 NPM AUDIT STATS
- 36. 9 years later, vulnerable versions of Bouncy Castle were downloaded… 11M CVE-2007-6721 CVSS Base Score: 10.0 HIGH Exploitability Subscore: 10.0 23M 2007 2016 BOUNCY CASTLE
- 37. Photo courtesy of Pixabay @djschleen do not boil
- 39. @dschleen PROTECT YOUR SOFTWARE SUPPLY CHAIN
- 40. THE REWARDS ARE IMPRESSIVE 90% improvement in time to deploy 34,000 hours saved in 90 days 48% increase in application quality @djschleen
- 41. Image by DJ Schleen inevitable @djschleen