SBA Live Academy: Software Security – Towards a Mature Lifecycle and DevSecOps by Thomas Konrad
0 likes383 views
The document outlines a presentation by Thomas Konrad on software security and the importance of integrating DevSecOps into the software development lifecycle. It discusses various strategies for improving security practices, such as simplifying processes, promoting continuous learning, and automating security tools. Key takeaways emphasize the need for cultural change in organizations to enhance security integration and collaboration among teams.
SBA Live Academy: Software Security – Towards a Mature Lifecycle and DevSecOps by Thomas Konrad
- 1. Klassifikation: Öffentlich Welcome to the SBA Live Academy #bleibdaheim #remotelearning Today: Software Security – Towards a Mature Lifecycle and DevSecOps by Thomas Konrad This talk will be recorded as soon as the presentation starts! Recording will end BEFORE the Q&A Session starts. Please be sure to turn off your video in your control panel.
- 2. Classification: Customer 2SBA Research gGmbH, 2020 $ whoami Thomas Konrad $ id uid=123(tom) gid=0(SBA Research) gid=1(Vienna, Austria) gid=2(Software Security) gid=3(Penetration Testing) gid=4(Software Development) gid=5(Security Training) gid=6(sec4dev Conference & Bootcamp)
- 3. Classification: Public 3Photo by Quino Al on UnsplashSBA Research gGmbH, 2020
- 4. Classification: Public 4Photo by NASA on UnsplashSBA Research gGmbH, 2020
- 5. Classification: Public 5Photo by Braden Collum on UnsplashSBA Research gGmbH, 2020
- 6. Classification: Public 6 Security Costs Money, Right? Perspectives on (software) security. SBA Research gGmbH, 2020
- 7. Classification: Public 7 Time Is Money SBA Research gGmbH, 2020
- 8. Classification: Public 8 Risk vs. Security Controls SBA Research gGmbH, 2020 SQLi XSS CSRF UserAccountSecurity AccessControl XXE Deserial. ComponentswithVulns TLS Logging Crypto
- 9. Classification: Public 9 So You Want More Money? No. I want to use the limited resources more efficiently. SBA Research gGmbH, 2020 Photo by Fabian Blank on Unsplash
- 10. Classification: Public 10 Gartner Application Security Hype Cycle SBA Research gGmbH, 2020
- 11. Classification: Public 11 Solution Approaches Steps towards the future of software security. SBA Research gGmbH, 2020
- 12. Classification: Public 12SBA Research gGmbH, 2020 We need to shift security left in the software development lifecycle. Photo by Suzanne D. Williams on Unsplash
- 13. Classification: Public 13 Backwards Security Integration SBA Research gGmbH, 2020 How can I recover? How do I react? How do I identify problems? How do I protect? What do I have to protect and why? Ad-hocSecurity integration Security test before go-live Incident / CISO intervention
- 14. 14 Shifting Left Image source: https://www.cigital.com/blog/what-is-the-secure-software-development-lifecycle/ SBA Research gGmbH, 2020 Classification: Public
- 15. 15 Threat Model Example: Account Security Threat modeling as part of the design process Threat Severity1 C/I/A Countermeasures Password guessing High C/I/- (Temporary) user lockout, password policy, MFA, transparency (device lists and notifications, with Device Tokens) Account lockout Medium -/-/A Selective lockout (with Device Tokens) Misuse of known passwords (public lists, other apps, ...) Medium C/I/- MFA Someone dumps the DB on the Internet Medium C/I/- Proper hashes (Argon2) Enumerating valid user names Low C/-/- (Generic error messages, constant timing on all requests containing the user name) 1 The severity really depends on the classification of your data. Don’t see them as absolute and unchangeable values. SBA Research gGmbH, 2020 Classification: Public
- 16. Classification: Public 16SBA Research gGmbH, 2020 We need to bridge the gap between security and agility. Photo by Sonja Guina on Unsplash
- 17. Classification: Public 17 What is DevSecOps? SBA Research gGmbH, 2020 DevSecOps is thinking about security from the start. https://www.redhat.com/en/topics/devops/what-is-devsecops, 2018 State of DevOps Report
- 18. Classification: Public 18 What is DevSecOps? SBA Research gGmbH, 2020 DevSecOps is security automation and measurement. https://www.redhat.com/en/topics/devops/what-is-devsecops, 2018 State of DevOps Report
- 19. Classification: Public 19 What is DevSecOps? SBA Research gGmbH, 2020 DevSecOps is sharing between teams. https://www.redhat.com/en/topics/devops/what-is-devsecops, 2018 State of DevOps Report
- 20. Classification: Public 20 What is DevSecOps? SBA Research gGmbH, 2020 DevSecOps is evolving from immediate pain to strategic focus. https://www.redhat.com/en/topics/devops/what-is-devsecops, 2018 State of DevOps Report
- 21. Classification: Public 21 “Are security teams involved in technology design and deployment?” Yes 39%No 61% Team Respondents Yes 64% No 36% C-Suite Respondents 2018 State of DevOps Report, Puppet + Splunk
- 22. Classification: Public 22 How To Make DevSecOps Work #1: Start with simplification. • Tool re-use is easier in a common tech stack. • More flexibility for dev staff to work on different projects. • Fewer moving parts to maintain, upgrade, learn. SBA Research gGmbH, 2020 Partially taken from the 2018 State of DevOps Report by Puppet + Splunk
- 23. Classification: Public 23 How To Make DevSecOps Work #2: Push existing pockets of success. • Give a well-working team resources to build security automation. • Advertise to others how this buys them time to do more fun stuff. • Make source code available to other teams. SBA Research gGmbH, 2020 Partially taken from the 2018 State of DevOps Report by Puppet + Splunk
- 24. Classification: Public 24 How To Make DevSecOps Work #3: Offer self-service security tools. • A dedicated, cross-project, well-integrated team for security automation. • Pick people with good social skills. • Get external help where necessary. SBA Research gGmbH, 2020 Partially taken from the 2018 State of DevOps Report by Puppet + Splunk
- 25. Classification: Public 25 How To Make DevSecOps Work #4: Work with both empowerment and accountability. • Mutually enforcing DevSecOps pillars of automation and measurement. • Build dashboards with performance indicators. • Play it open. SBA Research gGmbH, 2020 Partially taken from the 2018 State of DevOps Report by Puppet + Splunk
- 26. Classification: Public 26 How To Make DevSecOps Work #5: Create and promote a culture of continuous learning. • Understanding security means understanding technology in detail. • Make teams work together in new ways. • Stop the blaming culture. • Offer security training. SBA Research gGmbH, 2020 Partially taken from the 2018 State of DevOps Report by Puppet + Splunk
- 27. Classification: Public 27SBA Research gGmbH, 2020 Let’s face it: You are not going to fix your company’s culture overnight. Take your time but be dedicated. Photo by Les Anderson on Unsplash
- 28. Classification: Public 28 Skill Levels of a Developer 1. Write messy, insecure code 2. Write clean code 3. Write testable code 1. High cohesion 2. loose coupling 4. Write actual tests 5. Hack the own code 6. Write secure code SBA Research gGmbH, 2020
- 29. Classification: Public 29SBA Research gGmbH, 2020
- 30. Classification: Public 30 Which Types Of Test? • Write a simple integration test! • For functional and unit tests, test the right parts SBA Research gGmbH, 2020
- 31. Classification: Public 31 What Shall I Automate First? 1. Upon every push 1. Test for known vulnerabilities in external libraries and frameworks. 2. Scan your containers for known vulnerabilities. 2. On a regular basis 1. Scan your infrastructure. 2. Do SAST / IAST / DAST. SBA Research gGmbH, 2020
- 32. Classification: Public 32 Dynamic Tests: Known-Good Requests GET /profile/profile-picture?thumbnail-width=200 Input Validation Original or scaled? Read from filesystem Ask scaling microservice × ×SBA Research gGmbH, 2020
- 33. Classification: Public 33 Results Are Just Symptoms • Repeatedly fixing the same vulnerabilities? o Consider changing the architecture and technology! o Update common requirements! o Update architecture recommendations! o Add it to the threat model! o Update secure coding guidelines! o Implement a test in the common test suite! o Talk about it! • Selective fixes are just security painkillers! SBA Research gGmbH, 2020
- 34. Classification: Public 34 What Performance Indicators Shall I Collect? • Number of vulnerabilities/LoC over time • Time to fix • Number of security-related tickets/LoC • ... Make sure the numbers are contextually specific! SBA Research gGmbH, 2020
- 35. Classification: Public 35SBA Research gGmbH, 2020 Photo by Austin Distel on Unsplash There will be vulnerabilities and there will be attacks. The question is how we deal with them.
- 36. Classification: Public 36 Key Takeaways Steps you can do to push yourself forward. SBA Research gGmbH, 2020
- 37. Classification: Public 37 Key Takeaways, 1/2 • DevSecOps is a culture thing, and culture things take time. • It’s all about integrating security earlier. • Security is hard. Consider that when assigning roles. • The difference between a good team and a bad team is how they deal with difficult situations. SBA Research gGmbH, 2020
- 38. Classification: Public 38 Key Takeaways, 2/2 • Steps towards DevSecOps o #1: Start with simplification. o #2: Push existing pockets of success. o #3: Offer self-service security tools. o #4: Work with both empowerment and accountability. o #5: Create and promote a culture of continuous learning. SBA Research gGmbH, 2020
- 39. Classification: Public 39 Thomas Konrad SBA Research gGmbH Floragasse 7, 1040 Wien +43 664 889 272 17 tkonrad@sba-research.org Twitter: @_thomaskonrad SBA Research gGmbH, 2020
- 40. Klassifikation: Öffentlich 40 Professional Services Penetration Testing Architecture Reviews Security Audit Security Trainings Incident Response Readiness ISMS & ISO 27001 Consulting Bridging Science and Industry Applied Research Industrial Security | IIoT Security | Mathematics for Security Research | Machine Learning | Blockchain | Network Security | Sustainable Software Systems | Usable Security SBA Research Knowledge Transfer SBA Live Academy | sec4dev | Trainings | Events | Teaching | sbaPRIME Contact us: anfragen@sba-research.org
- 41. Klassifikation: Öffentlich 41 #stayhome #remotelearning Coming up @ SBA Live Academy April 14, 5 pm CET, live: „Passwords: Policy and Storage with NIST SP800-63b“ by Jim Manico! Join our MeetUp Group! https://www.meetup.com/Security-Meetup-by-SBA- Research/