Software Development in the Age of Breaches
- 4. Opportunistic Indeed ! TalkTalk 150K + PII records compromised SQL Injection Ashley Madison 37 MM records compromised Weak VPN Authentication HomeDepot 56MM PII records compromised Weak Access Control Patreon 2.3MM PII records compromised Debugger in Prod 000WebHost 13.5MM PII records compromised Using old PHP version
- 7. Test Driven Development • Bugs increase security risk • Allows you to release faster • Fixing issues while in development is cheaper • Only way to prove that “My code works”
- 8. Take it to the next level select version(); select current_database(); select current_user; select session_user; '));waitfor delay '0:0:3'-- "));waitfor delay '0:0:3'-- benchmark(10000000,MD5(1))# 1 or benchmark(10000000,MD5(1))# " or benchmark(10000000,MD5(1))# ' or benchmark(10000000,MD5(1))# getUserByName(first_name,last_name) { … }
- 10. New Responsibility Model • At SecureDB, we have no testers. Only “Buddies” • “Buddies” are fellow developers that: – Test your code – Review your code – Give you feedback • Switch “Buddies” every sprint
- 13. Where would I even start? STEP 1: Find a comparable company in your space STEP 2: COPY IDEAS SHAMELESSLY Examples: You’re a social media co that has too many locked accounts. A: How many login attempts does Twitter Allow? You’re an e-commerce site worried about fake accounts. A: How does Amazon do it? Don’t re-invent the wheel
- 15. Two Factor Everything • Evaluate every service you use for TFA support - Hosting - Code Repos - Email - SSH Access - DNS - File sharing systems • If a vendor does not support TFA – Are they really worth your time and money?
- 16. Change Default Accounts • Default Admin Username/Password – Databases – Key Stores – Content Management Systems • Disable Unnecessary Services • Delete unwanted accounts
- 17. Firewall Effectively • Dev environment is only for Developers – Block access from internet – IP Based restrictions • Restrict SSH access – IP Based restrictions – Easy to setup • Ingress and Egress • Install WAF (It’s FREE)
- 19. Continuous Security (DevSecOps) • Provisioning a new VM – Install latest patches – Apply right firewall policies – Stop unwanted services – Start appropriate services • Run as part of the build: – Fuzzing Tests – Run vulnerability scans – Static Analysis – Dynamic Analysis
- 21. Input Validation • Trust nothing that comes from client • Every layer to do it’s own validation • Whitelist vs Blacklist? – Whitelist is better • Use well tested libraries – Or OWASP RegEx • Specifically Test for SQLi and XSS • Example
- 22. Output Escaping • Escape all content to be rendered • Use UI Frameworks that escape by default • Scan the code to check the usage of un- escaped methods • Example
- 23. Authentication Web Form Based Authentication Two Factor Authentication TOTP Text Message Social Logins Facebook Twitter Google Basic Authentication Digest Authentication OAuth Certificate Based Auth. JWT (with JWS/JWE) APIs
- 24. Authorization • Privilege Escalation attacks are common • Authz mechanisms – Role Based Access Control (RBAC) – Attribute Based Access (ABAC) • Do Authz checks at every layer – Cookies – JWT (Mobile Friendly)
- 26. White Hat Program • Allow white hat hackers to find security issues and report them to you • Explicit contract laying out what kind of attacks they could execute • Implicit contract that they won’t go public with it – And give you reasonable time to fix it • Make payments per bug and severity • Example
- 27. you are the best CISO … of your application You are the best CISO of your application
- 28. Questions?