Feeding the Virtual Patch Pipeline
0 likes129 views
The document presents a discussion led by Cody Wood about application security challenges and introduces Signal Sciences' next-gen web application firewall and runtime application self-protection technology. It emphasizes the inadequate current security measures against web app attacks and the need for more advanced solutions like virtual patching. The presentation highlights a systematic approach to automating virtual patch triage and leveraging open vulnerabilities for enhanced application security.
Feeding the Virtual Patch Pipeline
- 1. Feeding the Virtual Patch Pipeline July 9, 2019 Cody Wood – Security Engineer, Signal Sciences
- 2. Introduction Cody Wood Security Software Engineer Signal Sciences @sprkyco • Previously earth mining operations (because apparently “miner” means data or cryptocoin) • Whitehat security, PCI Stuff, NBCUniversal, Rapid7 • AppSec, Python, GoLang • https://sprky.co
- 3. Application Security Challenges (We Know What You’re Up Against)
- 4. Web App Attacks Are the #1 Source of Data Breaches Incumbent Products Aren’t Solving the Problem Less Than 5% of data center security budgets are spent on AppSec Web App Attacks POS Intrusions Miscellaneous Errors Privilege Misuse Cyber-Espionage Everything Else Payment Card Skimmers Physical Theft / Loss Crimeware Denial Of Service 908 525 197 172 155 125 86 1 49 56 20 % 10 % 40 % 30 % Percent of Breaches Sources: Gartner, Verizon
- 5. The Security Problem You Can’t Secure New App Tech with Legacy App Sec Account Takeover Direct Object Reference Forceful Browsing Feature Abuse Evasion Techniques Subdomain Takeover Misconfiguration • Legacy WAFs focus on the same threats as 15 years ago • False positives result from generic signatures without context • Rarely used in blocking mode OWASP Injection Attacks Real-World Problems
- 6. Signal Sciences: Next-gen WAF and RASP Defensive Technology Designed to increase security and maintain site reliability without sacrificing speed or scale while unifying the efforts of engineering, security and operations.
- 7. Active Protection Everywhere Any App Cloud Containers, PaaS & Serverless Web Servers & Languages Gateways & Proxies Any Attack OWASP Injection Attacks PLUS: Application DDoS Brute Force Attacks Application Abuse & Misuse Account Takeover Bad Bots Virtual Patching Any DevOps Toolchain INCLUDING: Generic Webhooks & Any Custom Tools via Full RESTFul/JSON API
- 9. Virtual Patch Pipeline “JARVIS” Behind The Scenes DIY The SigSci Approach to Automating Virtual Patch Triage, Develop, and Deploy Generalized Methodology for Developing a Virtual Patch Building Your Own Detections
- 10. • TEMPORARY • Mistakes happen • Helpful in “Constrained” Business Conditions • Reliant on public information • Bypasses are difficult to detect Duct Tape...
- 12. “Jarvis”
- 13. Sciencing • Find => “CVE” • Copy • Paste • Replace ▪ CVEXXXXXXXX ▪ CVE-XXXX-XXXX • With ▪ CVE-0day-mageddon • Write rule • Push to master and deploy! ▪ No, but seriously we do at SigSci
- 14. Section 31 Jupyter Notebooks ❤🐍 run during post virtual patch deploy • Number of Corps/Sites Enabled • Boilerplate for further analysis • Exclude burpsuite, nessus, and other scanners • Scrape results for unique payloads, bitcoin miners for example • Proactive false positive identification • Cross customer cve exploit activity patterns, threat intel 🤷
- 15. And now...
- 16. CVE-2017-12615 Apache Tomcat - JSP Upload Bypass / Remote Code Execution 16
- 17. Q&A
- 18. Thank you!