thank you thank you yeah me too the buns
milk until you're all right welcome to
my song I'm coming far yeah we're here
rapid7 um I'm a manager on the
enterprise consulting group and I want
to present to you on the upside down
basically going from network security to
applications security just to frame it
up this is not more time testing I'm not
going to teach you like how to hack or
anything like that this is more
operational security stuff so so really
you know this is going to be you know if
you're really in tune with the
application world that some of this is
going to be reviewed for you a lot of us
thought it was it was new at some point
so I really want people to have an
understanding of you know the
application world a1 schools because
there and then how to be effective in
this new world w on ourselves in okay so
far we look and this is all being done
stranger things so if you haven't seen
it then there's some spoilers so so deal
with it so who are we according to
linkedin where you know these very
professional people we think we've got
here ease of experience we secure our
networks all day long but really what I
want to focus in on is the vulnerability
management lens so we're doing really
good at man
our SI VES patch tuesday is no problem
for us our pest management program
actually works you know it doesn't don't
tell me just will give you done so so
anyway we're doing really well and then
somebody comes up to us and says all
right well what about our web apps where
we send with that suddenly we don't look
so confident anymore and and so when we
start looking at web applications we're
no longer dealing with this this world
of cds reviewing a cwe so this is a much
more generic software issue so like more
info khaled ation or more session
handling so more about how program is
developed less than you know this
specific version of java or adobe has
this specific budget you know it's much
broader so if you got the mitered
website the latest version of this their
reference material is 1,500 pages and i
can't remember the last time i've read a
1500 page piece of reference material
and tried to incorporate that into a
security office program of fairly
nebulous stuff so you know i think you
know a lot of us don't necessarily know
what to do initially with this so what
do we end up doing well i found that
there is a statistic out here diesel did
a survey and they found that you know a
lot of people were going out there and
they were doing penetration testing yeah
which is common they were doing security
code review nineteen percent the next
highest one on this list no formal
testing so i don't get the warm and
fuzzy from that if i work at that
company so you know it's just like in
stranger things you know they have this
big problem that they're trying to deal
with and they're not exactly sure how to
you know tackle this thing so they just
start throwing stuff at it well i think
before we you know can understand
the effectiveness of those things that
were trying to view maybe we should
start trying to think about what we're
doing with an application in the first
place so with an application a single
application we need to think about
coverage so all aspects of that
application if it's a web application as
opposed to like a phone application
we're talking about all the links on all
the different business logic workflows
how often are we looking to test this
how long does it take us to go through
those tests what framework is this built
on those are all important things to
think about in terms of a single
application we don't thinking about you
know scaling this out I've worked with a
variety of different companies and some
only have one or two applications others
have hundreds so you know how does how
are we going to scale our solution for
this once the development cycle culture
reporting structure responsibility those
are all things that we need to think
about as we start building our security
program for vulnerability management so
they don't we kind of know that that
frame of reference of what we're going
to do with these applications let's take
a look at some of the tools / you're
using so if we take a look at test I
don't know that I really need to
describe the value of a pen test of the
skirt I feel like everyone would have
pretty good understanding of the value
you get out of that the cons are is that
it can be costly especially if you
continually test applications after
release release release it's time
consuming it's not built into your
processes at all there's potentially
narrow focus so you know depending on
the Confessor and you know the scope of
the engagement so on you know we start
thinking about if somebody you know
breaks into the front door and then just
starts wreaking havoc inside but they
never actually went and tested the
windows the other doors on the building
so you know are we really getting true
coverage of everything for that
application um next let's think it will
get an overview so good review is you
know
thing to do it's comprehensive but the
cons are is it's impossible to scale and
as soon as you know we start reaching
some competing priorities that's going
to fall to the wayside you know it's not
repeatable maintainable process over
time it takes time to train people on
how to do it properly so okay so we're
not being affected okay well how do we
be effective well I think before we can
even get to that question maybe we need
to understand this new world what are
the laws of physics in the upside down
so need to understand the software
development lifecycle basically how do
we say code from 90 in our head to an
application in somebody's hands or their
you know on that computer you know I
think a lot of us that have been you
know insecurity or even studied for like
cissp or something like that thing they
talk about different development methods
and waterfalls something that we think
about a lot where you make this really
big product and then ship it like I
don't know video games are a good
example of that you're not going to just
have like a small little you know guy
and then a new town you're gonna you're
going to ship an entire game so you can
play the whole thing right well a lot of
companies are not doing this waterfall
method they're using something called
agile development and that's more about
getting out Minimum Viable Product so if
I you know build an app you're going to
see you know value out of that
application sooner rather than later get
in you know people using it and then
once they are using it then you can
expand it and start building out more
feature sets you need a smaller
development group for that a lot more
cost effective and it's all about this
rapid release so many companies are
doing that type of development model
where bill chef bill chip okay so this
is the general concept of em software
development how does this actually
translate into
the tools in the process to this so we
started you know encounter this terrible
pipeline pipeline is where is basically
the chain of processes procedures and
tools that make this code turn into
something usable so in this example
we've got you know so many rice code
they ship it off to get up they use some
sort of automation program I'm most
familiar with Jenkins of bamboo but
these automation programs will do like
unit tests if you've got some sort of
security program you'd incorporate it
there but that's where your build
happens and then once that happens then
you'll ship it off to talk from dr. then
you'll ship it out to AWS to have that
live application so a pretty basic
workflow this might be different her
company but the general idea is this
okay so who are the people behind the
scenes that are doing this who are
developing groups well our developers
are constantly trying to you know
implement new processes or a process but
it will mess new pieces of code so
they're trying to you know be effective
they're trying to be smart about it
because we constantly have war we're
coming at them all the time so you know
they're going to write though they're
going with the code once you know they
run their tests based on that feedback
they're going to you know make
modifications and reach it these people
have a background in application
building they do not have a background
in security some of them might but most
of them don't so if you go and show them
you have some traffic capture that you
have a web traffic that doesn't mean
much to them which is which is fair
because I don't know how to build web
applications but I know how to do
security stuff so you know we need to
form that partnership of them another
group that we should think about is the
product
our owners are the people that are going
to make the decisions on what the next
build is going to look like what
priorities were going to have you know
for that next hill so I you know want to
mention these people because you're
going to start trying to form
partnerships with these people don't you
know try to form some sort of like ego
about it and be effect when working with
these people because you're really not
going to get anywhere so how do we how
do we you know partner with these people
well when you start talking with them
your language is not going to be one for
one but you start those conversations
definitely don't throw things over the
fence of them because we're trying to
improve you know their processes their
procedures and the software and our
company in general so if we're doing
that we can do that without you know
creating red tape for them we want to
show interest in their world in their
processes and prevent you know slowing
down their development and we also want
to find partnerships so if we start
trying to do like security through
authority I've seen a lot of people fail
there because they stop working security
and they start fighting politics and
that's not really going to get you
anywhere so you know we understand this
world a little bit better now so what
are some of the these solutions of their
answers that we can use well these
different views with technology we'll
talk about that a second you can you
know augment your staff by managed
services so hiring out for this or you
can try to hire somebody that does
application security for your company
good luck with that because an
application security people are in high
demand right now and there's not a lot
of them you keep doing pen tests we
talked about that already but we're well
point of ignoring the issue so in terms
of technology we've got a laundry list
here and i made this plate really
worried so that way you could use it as
a reference i'm not going to breathe
through the entire thing but just hit
the highlights here ass ass tool is
looking at static code so write code
scan the code it's looking prayers a
desk is looking for issues during
runtime so this is where we're doing
cross-site scripting test sequel
injection that sort of thing I am stools
are basically trying to take a mixture
of the benefits of both of those and
merge them together a raft is an agent
based tool I think you've like a hitch
tool so an agent that's looking for
malicious web traffic and then we also
have our web which is our last line of
defense they're not the best thing out
there but you know better than nothing I
guess but those are going to look for
you know cross-site scripting sequel
injection you know that low hanging
fruit so now the real question is you
know like okay now I know all these
things wouldn't wait to do with this and
I think that's where a lot of was kind
of struggle okay you know this is where
we can actually utilize our strengths of
security people in our background by
starting to build a defense in depth
with this we want to focus on our
security being built into the process we
want to automate as much as we can
remove ourselves from as much as we can
because you will become about a night at
some point you want multiple tools at
multiple layers and we want to start
thinking about security training and
building a security culture within the
organization that were in so when we
start looking at that pipeline we need
to start analyzing what we're doing so
what are we doing today what is your
company doing
they you know doing agile development um
you know just to start out of it do they
have any processes procedures that you
should know what tools are they using
that's really important because it's
going to kind of dictate what other
tools you buy to help secure your stuff
are they using any reports what are they
doing with that are they taking any
actions on that happening Brittany's any
policies I think a lot of people don't
ever think about policies procedures in
their organization policies help build
that security culture so if they've
written something you should probably
know about that and then build into it
oh if you're going to scan for CW ease
you should do it early in the build
process it's cheaper that way if you go
out into production and start scanning a
you might blow up your web app which
I've seen people drop their databases
from doing that on a production mode or
yeah and just expected to face that late
into the build process but anyway once
we get to the lake of docker area that's
when we can really start focusing in on
you know the things that we already know
that network scanning cee scans policy
if your incense or sub and then you know
once it's in production we can go back
to doing the pen test up as well you
know and have those incorporated in so
multiple tool that multiple layers SAS
tools get that in early in the process
along with fast or the high after you
know there's a lot of similar acronyms
here but right when you're in that
automation program piece that's what a
lot of those tools should be run to give
you as much you know acknowledged about
the vulnerabilities your company's
created before they hit you know
production once you go into the doctor
area continue doing what you're doing in
terms of network scanning but I think a
lot of people forget about themes in
early stages before they go live when
they do now I'm scanning they only stand
production you know let's think about
trying to do this or
in the process and make sure that it's
fixed early on so we're never hitting
this inter production mode just for the
network-based all the abilities on that
and then again you know we'll do you hit
production to your pen test set up your
bullet rules for your labs in your ass
building that security culture I you may
not know how to train developers how to
write more secure code but you know what
the goal is right so you want to partner
with somebody in the development group
to find out what your company is or what
are they doing today maybe they're doing
it you don't even know I find that
happens a lot people just have zero clue
what's happening in you know the
development in their own company so
really again find those partnerships
help build that you know security
training program internally and then
once you get into some of the tool sets
try to reduce friction show a lot of
value because you're making their
software cutter and you're not putting
injecting a ton of extra effort and red
tape into that process and then my
please let's talk about policies and
procedures so early on when people are
coding what are their you know security
efforts under any requirements that we
need me before we you know ship off to
go once things are in that automation
piece if they're in the ulnar abilities
to find what is okay what is not okay
what the service level agreement is on
that work that's going to be
accomplished similarly if you do that
once we hit the network layer as well
that's probably pretty easy because you
should be doing that today so just you
know transition that edge of this and
then lastly when we go to production
layer define what is a lousy hit that
layer and what
and if something in sounds what's your
what's your escalation process there are
you actually ever going to hit a point
where you say I need to take down my own
application all that should be defined
in your policies and procedures so
through all of this hopefully this will
help you you know a lot less like them
and be a lot more effective in managing
application security for your
organization nice