[Rakuten TechConf2014] [Fukuoka] Security checking which is as a part of Continuous Integration
Download as PPTX, PDF0 likes1,444 views
This document summarizes a presentation about integrating security checks into continuous integration workflows. It discusses recent security incidents like Heartbleed and Shellshock to demonstrate that regular security updates are needed. It promotes testing applications continuously using CI tools rather than just before release. Open-source security scanning tools like OWASP ZAP and Nmap are presented for checking web applications and infrastructure as part of CI pipelines. The document also introduces Walti.io as a service for easily running security scans from a dashboard at a low cost in a continuous manner.
[Rakuten TechConf2014] [Fukuoka] Security checking which is as a part of Continuous Integration
- 1. Security Checking, as a part of Continuous Integration Rakuten Technology Conference 2014 @ FUKUOKA
- 2. Who am I ? Masanori Fujisaki Twitter: @fujisaki_hb Facebook: fujisaki.masanori Founder & CEO HEARBTEATS Corp. ( since April, 2005) Walti, Inc. ( since July, 2014 ) Entrepreneur & Infrastructure Engineer I was born in Iiduka, Fukuoka, and grew up in Kitakyusyu, Fukuoka, and now live in Shibuya, Tokyo.
- 3. Who am I ? Masanori Fujisaki Twitter: @fujisaki_hb Facebook: fujisaki.masanori Founder & CEO HEARBTEATS Corp. ( since April, 2005) Walti, Inc. ( since July, 2014 ) Entrepreneur & Infrastructure Engineer I was born in Iiduka, Fukuoka, and grew up in Kitakyusyu, Fukuoka, and now live in Shibuya, Tokyo.
- 4. Today’s Topics 1. Recent Security Incidents. 2. Why you need to do security checking as a part of Continuous Integration. 3. Some Open Source Security Check Tools 4. Some Security Communities and Organizations 5. About Walti.io
- 5. Recent Security Incidents(1) Environmental Pattern..
- 6. Recent Security Incidents(1) Environmental Pattern.. Heartbleed OpenSSL http://heartbleed.com/
- 7. Recent Security Incidents(1) Environmental Pattern.. Heartbleed OpenSSL http://heartbleed.com/ ShellShock Bash http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29
- 8. Recent Security Incidents(1) Environmental Pattern.. Heartbleed OpenSSL http://heartbleed.com/ ShellShock Bash http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29 POODLE SSL3.0 protocol https://www.openssl.org/~bodo/ssl-poodle.pdf
- 9. Recent Security Incidents(2) DDoS Pattern..
- 10. Recent Security Incidents(2) DDoS Pattern.. NTP Amplification Attack CloudFlare 400Gbps http://blog.cloudflare.com/technical-details-behind-a- 400gbps-ntp-amplification-ddos-attack/
- 11. Recent Security Incidents(2) DDoS Pattern.. NTP Amplification Attack CloudFlare 400Gbps http://blog.cloudflare.com/technical-details-behind-a- 400gbps-ntp-amplification-ddos-attack/ DNS Amplification Attack DNS Open Resolver https://www.us-cert.gov/ncas/alerts/TA13-088A
- 12. Recent Security Incidents(2) DDoS Pattern.. NTP Amplification Attack CloudFlare 400Gbps http://blog.cloudflare.com/technical-details-behind-a- 400gbps-ntp-amplification-ddos-attack/ DNS Amplification Attack DNS Open Resolver https://www.us-cert.gov/ncas/alerts/TA13-088A UPnP Device-Based Reflection Attack http://www.akamai.co.jp/enja/html/about/press/releases/2014/ press-101514-2.html
- 13. One of the Solutions Inbound Port 53 Blocking Inbound Port 123 Blocking http://www.kddi.com/important-news/20140825/
- 14. Recent Security Incidents(3) Frameworks Struts https://www.ipa.go.jp/security/ciadr/vul/20140417-struts.html Rails http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3514 One of the Solutions Request Pattern blocking by URL Filter or IDS/IDP
- 15. This means… Security Issues occur to each layer. We always need to do security updating. We have to develop secure applications. We have to manage infrastructure securely.
- 16. This means… Security Issues occur to each layer. We always need to do security updating. We have to develop secure applications. We have to manage infrastructure securely. You can not do those by yourself.
- 17. TEST
- 18. TEST Old Style TEST You test your application before release.
- 19. TEST Old Style TEST You test your application before release. Modern Style TEST You constantly test by CI Tools.
- 20. Security Check
- 21. Security Check Old Style Security Check You only check your application security before release.
- 22. Security Check Old Style Security Check You only check your application security before release. Modern Style Security Check You constantly check your app security by CI Tools.
- 23. Security Check, as a part of Continuous Integration.
- 24. Continuous Integration Security Checking develop deploy test
- 25. Continuous Integration Security Checking develop deploy test develop Test deploy to staging deploy to production Security check
- 26. Security Checking by OSS, as a part of Continuous Integration
- 28. for Web Application OWASP ZAP https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project zapper https://github.com/adedayo/zapper
- 29. for Web Application OWASP ZAP https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project zapper https://github.com/adedayo/zapper Skipfish https://code.google.com/p/skipfish/ shell http://cloudapplistore.biglobe.ne.jp/ca/help/devops_3_manual_Jenkins.pdf
- 30. for Web Application OWASP ZAP https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project zapper https://github.com/adedayo/zapper Skipfish https://code.google.com/p/skipfish/ shell http://cloudapplistore.biglobe.ne.jp/ca/help/devops_3_manual_Jenkins.pdf Wapiti http://wapiti.sourceforge.net/
- 32. for Infrastructure nmap http://nmap.org/ for Firewall / netfilter
- 33. for Infrastructure nmap http://nmap.org/ for Firewall / netfilter nikto https://www.cirt.net/Nikto2 for Web Server
- 34. for Infrastructure nmap http://nmap.org/ for Firewall / netfilter nikto https://www.cirt.net/Nikto2 for Web Server sslyze https://github.com/nabla-c0d3/sslyze for HTTPS setting
- 35. for Infrastructure nmap http://nmap.org/ for Firewall / netfilter nikto https://www.cirt.net/Nikto2 for Web Server sslyze https://github.com/nabla-c0d3/sslyze for HTTPS setting Metasploit http://www.metasploit.com/ All in one
- 36. CI Tools
- 37. CI Tools Jenkins An extendable open source Continuous Integration server http://jenkins-ci.org/
- 38. CI Tools Jenkins An extendable open source Continuous Integration server http://jenkins-ci.org/ Mozilla Minion An open source Security Automation platform. https://wiki.mozilla.org/Security/Projects/Minion http://heartbeats.jp/hbblog/2013/08/minion.html
- 39. Security Communities & Organizations
- 40. OWASP The Open Web Application Security Project (OWASP) https://www.owasp.org/ the free and open software security community Japan Chapter https://www.owasp.org/index.php/Japan OWASP Top 10 https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
- 41. MITRE MITRE a not-for-profit organization that operates multiple federally funded research and development centers http://www.mitre.org/ CWE Common Weakness Enumeration http://cwe.mitre.org/ used by NIST, OWASP Top 10 project, etc…
- 42. CSIRT CSIRT Computer Security Incident Response Team CERT/CC JPCERT/CC NIRT（National Incident Response Team） Nippon CSIRT Association http://www.nca.gr.jp/
- 43. Japan MSP Association Japan MSP Association ( To be Founded on November 1, 2014 )
- 44. How can you do Security Checking Easily by OSS, as a part of Continuous Integration?
- 45. I have one proposal.
- 46. Walti.io
- 47. Walti.io is… https://walti.io/ Continuous Server-side Security Scanner Run Scans Easily from Dashboard Team-based Web Safety Protection Continuous Security Management API Support Impressive Low Cost
- 48. Scanners in Walti.io Portscan ¥10/scan Nikto ¥10/scan Sslyze ¥5/scan Skipfish ¥100/scan develop Test deploy to staging deploy to production Security check
- 50. Today’s Summary 1. Recent Security Incidences 2. Why you need to do security checking as a part of Continuous Integration. 3. Some Open Source Security Check Tools 4. Some Security Communities and Organizations 5. About Walti.io
- 51. Q & A
- 52. Thank you.
Editor's Notes
- #15: 。