Security for devs
- 2. ABOUT ME • Built multiple CI/CD Pipelines for businesses with different needs. • Lived 4 Years in Germany and now I’m back to الوطن أرض • A Software Engineer at day, a Hacker by night. • Love to automate everything. • In love with Security and an OSCP Holder. • Technical Consultant @S3Geeks • Security and Systems Engineer @FuturaSolutionsGmbH
- 3. SDLC (SOFTWARE DEVELOPMENT LIFECYCLE) • A Software Development Life Cycle (SDLC) is a framework that defines the process used by organizations to build an application from its inception to its decommission. Over the years, multiple standard SDLC models have been proposed (Waterfall, Iterative, Agile, etc.) and used in various ways to fit individual circumstances.
- 4. • Planning and requirements. • Architecture and design. • Test planning. • Coding. • Testing and results. • Release and maintenance. SDLC PHASES
- 5. SECURE YOUR SDLC ACCORDING TO MICROSOFT • Provide Training. • Define Security Requirements. • Perform Thread Modeling. • Define and Use Cryptography Standards. • Follow Best Practices. • Perform Static Analysis. • Perform Dynamic Analysis. • Regularly Pentest. • Establish Incident Response Mechanism. Source: https://www.microsoft.com/en-us/securityengineering/sdl/practices
- 6. •What happens when you write a url in a browser and press enter?
- 8. • GET requests a specific resource in its entirety • HEAD requests a specific resource without the body content • POST adds content, messages, or data to a new page under an existing web resource • PUT directly modifies an existing web resource or creates a new URI if need be • DELETE gets rid of a specified resource • TRACE shows users any changes or additions made to a web resource • OPTIONS shows users which HTTP methods are available for a specific URL • CONNECT converts the request connection to a transparent TCP/IP tunnel • PATCH partially modifies a web resource HTTP REQUESTS
- 9. HTTP HEADERS • Origin • Accept • Accept-Encoding • Cookie • Cache-Control • Dnt but many more exist.
- 10. HTTP RESPONSES • 200 OK • 404 Not Found • 403 Forbidden • 301 Moved Permanently • 500 Internal Server Error • 304 Not Modified • 401 Unauthorized
- 11. OWASP TOP 10
- 12. RESOURCE FOR DEVS? • Troy Hunt‘s OWASP Top 10 for .NET developers • https://files.troyhunt.com/OWASP%20Top%2010%20for%20.NET%20developers.pdf • OWASP TOP 10 2017 • https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf
- 13. LET‘S DO SOME HACKING •DEMO WEBGOAT.NET
- 14. VULNERABILITY RATING •What is CVSS?
- 15. • Define your app Scope. • Regular and Internal Penetration tests. • Bug Bounty? Let the crowd hack you. SECURITY TESTS
- 16. HOW TO YOU APPLY BEST PRACTICES • Always check OWASP‘s Best practices for a certain vulnerability. • Look for OWASP‘s Library/Framework Recommendations.
- 17. HOW DO I KNOW ABOUT NEW 0DAYS? • Check if your local CERT if they offer a newsletter. • Subscribe to MITRE newsletter https://cve.mitre.org/news/newsletter.html • Regrularly Update Libraries/Frameworks you‘re using.
- 18. SECURE YOUR CI/CD • Code Analysis. Analyze code for application specific vulnerabilities. • Container Hardening. Remove unneeded libraries and packages; restrict functions. • Image Scanning. Scan images for vulnerabilities at build; regularly in registries. • Image Signing, e.g. Content Trust. Ensure trust with signing and author / publisher verification. • User Access Controls, e.g. Registries. Restrict and monitor access to trusted registries and deployment tools. • Host and Kernel Security. Use SECCOMP, AppArmor, or SELinux or equivalent host security settings. • Access Controls. Enable restricted access to system and Docker daemon. • Auditing, e.g. Docker Bench. Perform security audit using Docker CIS benchmark.
- 19. SECURE YOUR CI/CD • Network Inspection & Visualization. Inspect all container to container connections and build visualization for application stack behavior. • Threat Detection. Monitor applications for DDoS, DNS attacks and other network based application attacks. • Host & Container Privilege Escalation Detection. Detect privilege escalations on hosts and containers to predict break outs and attacks. • Packet Capture & Event Logging. Capture packets and event logs to enable forensics.