[Music]
so hopefully everybody that's in here is
in here for this talk if not that's cool
you can go
um how many conferences go this late in
the
evening this is it right this is this is
unique this is weird not weird normally
if I'm on stage at this time of night
I'm doing improv
comedy not kidding uh so if you want uh
my slides they're at tiny URL o-
cyphercon hopefully I spelled that
right uh I live in Chicago my name is
Dwayne that's where I do improv I also
love rock and roll and car
Koke hit me up on the
Instagram even though I don't have that
listed that's my preferred Communication
channel but you're all security people
you'll figure it out in fact if you can
find me on
Instagram I'll happily be your friend
there
um I work for a company called G
Guardian who here has ever heard of G
Guardian yay we got one person we help
people figure out where the hard-coded
credentials are and that's how I got
security space I backed into this
company I gave another talk that
mentioned this company and they were
smart enough to recruit
me so this is a talk about oasp and who
here's a member of
oasp awesome I got one person I saw a
couple other hands what are you have
affiliations with oasp over
there yeah it's a it's it's a good price
but we'll get to that but I think good
security is what oasp is all about at
the end of the day
oasp helps people do this sleep through
the
night it helps them go camping with
their family way outside Wi-Fi range no
matter where they put a cell
tower helps people relax and go to
concerts I mean we're practically at one
right now and you can do your
work but it helps to go to places like
Taylor Swift where there's not that good
as Wi-Fi coverage and ultimately it
helps us hang out with people we love
doing stuff that we want to do not up at
3:00 a.m. listen to an alarm
bell all technology all of it has a
human cost to
it I'm realizing all of my sides are
slin slides are fairly centered with the
text so this is going to be fun for you
all just squint and you'll you'll you'll
kind of get
it um so if if that's what good security
looks like what does bad security look
like
I think it looks like this it's very
isolating where we end up just staring
out of window hoping that pigeon comes
back cuz man I ain't been outside in
three days because this incident is
deep uh this is one of my favorite
pictures of all time uh the absence of
reason or the sleep of Reason produces
Monsters uh is what it says in French
down there it's really hard to see even
if you could read French
um this is terrifying world who who
learns about a new vulnerability or
threat
today who learned about one this past
week who learned about one this past
month that was hopefully everyone I saw
some hands go down in the last month
category so I don't know how that works
um but it's a terrifying world and we
hear a little bit we hear about a
15-second sound bite of this new
vulnerability it's it's like do am I
affected by that like when log for Shell
was first announced who thought that
this oh oh I don't use I don't use Java
that's not going to impact me anybody
yeah yeah we all said that unless they
knew exactly where it was down in the
stack and ultimately I hate reading 40
to 90 page PDFs who here likes reading
white papers yeah we do it because we
kind of have to some of them are
entertaining but man combine that with
it's terrifying and isolating and we end
up in some pretty happy
families and I think it's a Cascade
effect that it's not anyone wants bad
things to happen to other people they
want those things that they want they
want to sleep well through the night
they we want to take shortcuts but at
the end of the day we're we're lazy and
we we do things because we're like we're
just guessing because well we we don't
know and that's how things like log for
Shell happen where no one saw it coming
until all of a sudden they did and then
it was too late
uh unless you're uber or you're at Uber
and like you got literally the
40,000 fishing attempt and you hit the
wrong button once that's the story I
have heard I don't know if it's true but
that's how they super fished in admin
they just kept pounding on him and
pounding on him and pounding on him with
two-factor authentication requests until
finally finally his thumb slipped then
the kid from lapsis got in a 19-year-old
got into the Uber pwned everything
because well they left all of their
credentials hard-coded in Powershell
scripts don't do that that's another
talk my favorite part of the story is he
got into their slack told them he did it
and they didn't believe him so the next
person he called was the New York Times
and that's how we know about
it uh Circle C who who got hit by this
anybody's stuff got taken out of
production I should probably asked is
anybody here a Dev like just lives their
life day to day as a Dev I will slightly
adjust this talk things this is slightly
who was written for um who here is a uh
analyst any analysts in the room we got
one up here we got one over there
awesome uh anybody here do incident
response right on Frontline workers
probably you wear every security hat in
the building don't you sir yes yes you
can always tell um any execs here any
VPS sea levels I didn't think so I saw
another talk earlier now I'm can't stop
thinking about VPS and execs not coming
to these things they really should
invite your VPS next time um security
teams are outnumbered you're all
outnumbered out there and outnumbered
not just in the adversarial sense where
there's 40,000 script kitties for every
minute you're awake uh no it's just in
pure number of devs in your org um Alex
rice said it's in the best organizations
100 to one devs to support people I've
met people at smaller companies that are
like we got three support people and 40
devs like good for you that's
awesome I don't trust that number but
that's what people tell me
um so we've invented this term called
shift left as a response to this and
embracing the dev SEC Ops tradition
because we like simple monikers that
convey some kind of meaning to someone
though we don't all agree on what that
means again that's a whole separate talk
but who here knows the term shift
left all right that means we're going to
take the uh the security and we're going
to push it to the left in the in the if
you lay out the software development
life
cycle the process from planning to all
the way to production and we're going to
put the security not at the end we're
going to shift it left who here likes
the term shift left I've never had a
single hand go up for that in four
different talks I've asked that what oh
developers love it because they get to
wear the security hat that's that's how
a lot of people interpret what shift
left is like oh we'll just we'll just
throw our security burden on this
developer and they got to figure it out
out from here but how do security people
keep up with what's going on with
vulnerabilities anybody would disagree
with this list I don't know and then
another PDF that comes out and then
another PDF that comes out then another
PDF that comes out and that's how we
stay up to date because that's how the
reports
work and Debs ain't got time for that
most terrifying thing I was ever told
since I started working in the security
field was security is not the last thing
developers think about because they
don't think about
it because they got everything else
they're fighting kubernetes for God's
sake like I don't know if anybody ever
hear is run
Helm yeah it's not fun um some people
like it but it's it's just really
complicated and it takes so much mental
exertion to remember what that variable
even does when you're debugging
something wow my slides messed up
somehow miraculously um I swear this
looked right on my screen before I
started um but from the business
perspective this is what the security
cycle looks like we got to act right now
because we have a security incident and
Security's got to be our top priority or
posture has got to be perfect we're
going to get audited and they focus on
security for a minute and then hey wait
a minute we can't get enough features
out fast enough we're missing some
deadlines sales needs this out the door
yesterday and we just keep in this
vicious cycle I think execs are getting
better at this overall over time I heard
a promising number that it's up to 2% of
board members have some kind of security
background up I mean that's up from
nothing literally so I mean we're moving
in the right direction we just got to
get there faster and yeah there's a tool
for that if you can figure out exactly
which one you need and if you can cut
through the vendor BS uh I work for a
security
vendor I work in marketing for that
vendor I can tell you what exactly
exactly we can help you
with but you got to talk to me to do
that or figure it out on your own do you
even need to talk to me every one of
these companies there's people like me
there's sales folks there's marketing
folks that want you to use their product
so much we're willing to have that
conversation with you but there's only
so many hours in the day and
again dev's worry about this stuff
security folks wow we got a lot to uh to
worry about to get this
stuff so one of my favorite quotes from
all of literature um if who here has
read Dallas in Wonderland and Through
the Looking Glass if you haven't pick it
up it's an amazing couple books uh full
of math
jokes um but yeah we want to stay in the
same place we got to run as fast as we
can if we want to get anywhere else we
got to go twice as fast and that's the
pressure we're all feeling out
there so isolating
scary and just kind of raw and boring at
times yeah isn't there a group of
superheroes who's dealt with this before
can't we send in The Avengers or
something yeah we already have it it's
called oasp open web application
security project been around for 20
years now it has evolved much since then
so who all the people that have who's
actually heard of OAS
before who Associates it with like old
school
security who Associates it with like
that other conference over there besides
bsides
that's interesting those are the first
two times no hands went up for either of
those um because it did start 20 years
ago and they have a website and the
original founder of OAS one of the
original Founders recently said in an
interview uh the website is the biggest
detriment to oasp because it's a
Byzantine mess that no one can figure
out how to
navigate and that's literally why I
wrote this talk to help people figure
out how to get started with
oasp mission's very very clear no more
insecure
software this is not a reachable
destination we all know this
everything's insecure everything will be
exploited if it can be it's Atwood's law
but for security if it can be exploited
it will be exploited Jeff Atwood's law
um is if it can be written in JavaScript
it will be written in
JavaScript uh if if if you can break in
it will be broken into um there giant
nonprofit all over the world thousands
of people involved so I'm a little
shocked there's only a couple people in
here I talk like this but also you're
already NOP member so why are you here
um but how do you how do you navigate
all of that that's a giant mission
statement I think the mission statement
and really what they do boils down to
these these things projects communities
events and then highly related to those
things education training and
Publications and
resources we'll start with projects
because that is the base unit of work
like a commit is the base unit of work
and get the project is the base unit of
work in oasp so these are open source
repos you can go you can contribute to
them they're built by people like you
and me literally uh I was privileged
enough to be at a talk few a couple
months ago at this point uh with one of
the top 10 maintainers and who built the
list the kubernetes top 10 which I'll
talk about
later and he's like there's three of us
there are three of us working on this
right now if you can help please help if
you know kubernetes at all do a poll
request
file an issue anything we need your help
so built by people like you and me new
ones pop up Weekly right last time I
looked there were about 250 of these
things in any kind of usable State uh
175 I'm sorry 157 in usable state but
there were probably closer to
255 at this very moment if anyone wants
to look it up and let me know that'd be
awesome um they fall into multiple
categories flagships which are the
flagships project our production
projects which are meant to help
Enterprise teams adopt them VPS and
execs be like hey that's actually
Enterprise grade because it says
production project uh nothing's
qualified into this yet because they put
the bar pretty high even their flagships
don't qualify under their own rules uh
but this been around since October so
it's pretty new uh lab projects which
are on their way to Flagship but they're
more specific to Pro problem sets
incubator projects which are on their
way to lab projects but are pretty
immature there's a whole bunch of
uncategorized ones below that so
flagships they 18 last time I looked uh
these are Big these are ones I'll talk
about later these are where if you walk
away right now for my talk which would
be okay I wouldn't mind it's 8 20 at
night on a Thursday
um this is where you would start just go
to their Flagship and just run down the
list um but don't leave yet cuz the
better Parts later uh lab projects 34 of
them again we get more specific you have
things on here like Java
python uh like it gets starts getting
much more
narrow uh and then incubators are on
their way there if you want to make a
big splash in a little Pond incubators
have tons of issues then they need
security people with eyes and typing
ability which is all really any of this
is
um they also categorize things by type
you can go into a type menu and you
might notice these numbers don't quite
add up to the numbers I showed earlier I
don't know how to explain that either
I've never done a one toone mapping so
if you want to do that there's probably
a project for that honestly but in all
reality in all seriousness uh they have
built this idea of CR a common
requirement enumeration and mapped it
one to one to the software development
life cycle starting with
uh can't read fonts uh requirements all
the way through operation
and they tie these to specific projects
so if you are in the design
phase and you know you probably need
threat Dragon at that point to start
looking at your designs and are they
secure and that's a good way to start so
whatever project you're working on just
go take a quick quick peek like hey can
something help me in this particular
phase so cres common resource
requirement uh common requirement
enumeration there's a whole web for this
again basic uniters work as a project
anybody any Drupal people here people
work Drupal an old school Drupal um
everything was a node even nodes were
nodes like in in oasp everything becomes
a project um opc.org jump to it in fact
we got enough time got enough time uh
this is what open Cru looks
like
bigger and what what's a what's a
vulnerability somebody shout out of
vulnerability
SQL injection thank
you and here are related documents to
SQL injection and it's
all properly cross indexed so you can
come here and start
finding how things are interrelated very
quickly uh Community the community are
the folks that build these projects this
really bother me I need to like stop and
readjust my entire deck I think um
Community uh I was had a talk for the
Juma Association one time uh or is that
Paris Berlin Paris anyway uh he said the
problem with the Four Freedoms of Open
Source is that they're missing one it's
like uh we have the right to examine the
code we have the right to change the
code we have the right to run the code
in any way we see fit and we have the
right to redistribute that code none of
those freedoms exist if you don't have
the freedom to gather assemble and
communicate and that's the freedom of
community
and that's what oasp really is embraced
all of this all of these crazy
mismatched numbers of types versus
categories all built by us all built by
human beings all over the world hundreds
of
chapters there's meetups in almost every
area last time I gave this talk I gave
it a snowf frock the um Front Range
open conference uh which is a oasp
conference there and in Denver um so I
was mentioning their event there but OAS
meetups you all know what a Meetup looks
like this is the one that takes place in
the GG Guardian office in Paris the most
recent pictures I have it rotates around
where they do it in Paris a lot of
cities are like that um but the point is
there are meetups literally everywhere
so just go to
meetup.com
inspired a lot of them to go online so
you can go to ones online I go to
ottawa's
uh I went to Cincinnati that's the one
where I saw the uh maintainer of the top
10 for kubernetes so just find them go
online there are bigger events like snow
frck that this slid slightly out of
order um there's a big event that's
happening in
DC October 30th so if you like this
event but just wish it was a lot
bigger and maybe the music in the
hallway is a little bit quieter this
one's probably for
you um Education and Training again all
of these things go back and become
projects for the most part except for
the next one I'm about to show but if
you just Google oasp education or oasp
training you'll find top 10 lists
literally out there all over the place
all sarch of links but one of my
favorite tools I have ever come across
for security training is secure flag
they are a
platform
uh they are their own Standalone thing
they are highly associated with OAS
because all OAS members get full
unfettered free access and you can earn
searchs through secure flag you can play
an ongoing game of capture the flag with
hundreds of other people and learn as
you go and this is constantly evolving
content again completely for free if
you're an OAS member which is a paid
membership uh it's 500 bucks for a
lifetime or 50 bucks a year that's the
last time I checked the
prices uh and again this is a platform
you pay for it on its own it's it's a
little less than that but uh not by much
Publications and resources if you want
to buy a paper book there are paper
books people print it out and you can
buy dead trees and read words off of
those but most of those words came from
PDFs that were also came out of projects
all goes back to GitHub at the end of
the
day all
right Byzantine
mess a lot of stuff there how do you use
this well I'm not telling anyone to go
off and join oasp I'm actually telling
you go explore the tool set go explore
the community you don't have to be a
member to go to a Meetup absolutely not
just show up
they they'll they'll they'll be happy
you're there um but here are the top
four ways I'm going to go through these
and these are if you now if you walk out
of the room and just had this slide you
know where to get started so the top 10
and yes 10 with an
S so there's the OAS top 10 who here
knows the top like is familiar with the
OAS pop
10 oh I was hoping this to be everybody
um this is the standard at least in my
opinion and standard of a lot of people
um this is the standard these are the
top 10 most common vulnerabilities that
are being exploited out there in the
wild plus two that the community vote
on and no suspense suspense here uh you
might notice the date there 2021 these
don't come out every year these come out
periodically
that's as much as I can tell you it's
supposed to be on a cycle is that cycle
true you tell me um however space
doesn't change that much like
cryptographic failures went up from
number four I think in the previous list
things move around and new ideas do get
added but unless cryp um Quantum
Computing really takes off like the
world evolves at a pretty linear rate up
to a point and then you have things like
AI which are we're on a weird trajectory
on but anyway it's a pretty good list so
if you don't know where to start with
security start here don't feel I have to
check down the list and do everything
all of these tell me but if you're
working on application is like did I do
we get cryptography
correct well here's a doc for you
there's an exact section of how to
prevent those attacks and even example
attack scenarios so there you go there's
your starting point even you know
nothing if you show up at an OAS Meetup
and say hey I was looking into this top
10 issue I guarantee you people want to
have a conversation about
that um I said top 10 there are 13 in
any usable State there are several
others but they are not in usable States
in my opinion some of them aren't even
list yet they're just an idea floating
out there again if you want to make a
big impact in a pretty small community a
small pond go into one of these projects
and start having a conversation like if
you disagree with the docker list uh
which looks like
this oh that's one where it's not
directly linked again Byzantine mess
everybody go to kubernetes I know that
one works all
right
uh so insecure workload configuration
supply chain
vulnerabilities and you all said you
weren't uh developers in here so yeah
how do you talk to your developer about
kubernetes and the risks there start
here at least we'll have the common
language of what what's going on with
this so it gives you an overview
description I can't say enough about the
top 10 lists they're
awesome but it's not just
that
uh cheat sheets another one of my
favorite parts of the entire oosp
offering if you're like me you're pretty
lazy and you want to know as much as you
can can in the shortest amount of time
and sound like you know what you're
talking about at least enough to start
the conversation while you're furiously
doing more research to try to stay up
with
speed then again I work in marketing so
it's not anything dangerous the OAS
cheat sheet series uh cheat sheet
series. .org we'll visit it here in a
second um but there's cheat sheets for
pretty much anything you want to know
related to cyber security from a high
level will this get you to pass an audit
absolutely not will it help you get the
conversation going if someone comes into
your office and says what do we know
about again pick on kubernetes security
but what do we know about CBE here's a
starting point here's what our common
knowledge base here's what the industry
has agreed this organization has agreed
the community has agreed these things
are true these things are probably the
right move so if we jump back up
here not going to be super easy to see
on the screen think a little bit
bigger uh but clickjacking one of
the most talked up
vulnerabilities that no one I know has
ever suffered from in the last I don't
know how many years this is like
something I heard about in college that
like people were vulnerable to attacks
and I didn't just graduate so is anyone
actually yeah I'm just curious since we
got we got the time does anyone here
know anybody that's actually suffered
through a clickjacking
attack there there you go this is how
well it worked is we told everybody how
to fix it and they did that's that's my
theory not that people just stop doing
it um because Bots are still doing
aren't they anyway so here's what you
need to know about clickjacking anyway
that's that's my point
there goats greatest of all time this
one's actually got a live demo part
um I like how it splits right between
the S and the P it gets me every time I
look over um so goats are deliberately
insecure applications they are built to
be bug-free but completely vulnerable
which sounds like an oxymoron but I
promise you it's not web goat is one of
the better known ones in the space not
the the best known one I got a whole
next slides about that um if you're
using node if you're a you like to
torture yourself with with JavaScript um
there's got J nodejs is pretty good our
nodejs go is pretty pretty good and
wrong Secrets this is one uh my company
actually done a couple webinars about
this because we obsess about secrets and
finding credentials wrong Secrets tells
you how to do it wrong so if you want to
see an example of how not to do secrets
you can go tear apart their source code
and all of these have training around
them all of these have plenty of
documentation all of these have
communities around them that want to
help and then there's Juice Shop which
is just plain fun Juice Shop is a fully
functional very insecure application but
we're on version
14 what 14.0 right now and it's pretty
pretty much sure again tons of
documentation go to the Juice Shop uh
well o-j shop
oj. shop and you can uh download it for
yourself uh this is this is how fast it
gets up and running now I don't trust
the Wi-Fi so I already did already
download load the uh package but I got
Docker
running we'll fire up
Docker and now jump to Local
Host P am I on 3,000
there we go sorry about
that should have that prepped all right
um so Juice Shop looks like a juice shop
because it is you can make an account do
not put your credit card in this
whatever you do please don't run this on
public infrastructure they have that in
the
docs but if you find the I'll give you
the hint the uh the secret
scoreboard which they've hidden very
well behind a
URL um oh wow this is a reset Local Host
recently because of the GitHub thing uh
so it knocked out all my progress hooray
get to start from scratch
um so this is this is a what it looks
like is a full on training tool of how
to go accomplish these things even very
simple things like Bully the chatbot who
knew you could bully a chatbot
yeah with human being don't bully a
human but if you're on a site and you
know clearly you're dealing with
AI yeah you can ask for a discount over
and over and over again and eventually
it's programmed to give in because it
wants you your money more than it wants
to win um the whole bunch of writing
about that out there um but yeah missing
encoding so go find the picture of the
cat these are level one goes all the way
up to level
six things like uh yeah Forge coupon
uh Forge coupon that gives you a
discount of at least
80% and successfully pull it
off these are some Advanced things in
here and again all of these
have someone has demoed this out there
in the world has already gotten this
working you can run this as a capture
the flag you can run this on your own
private networks and all of that is
fully do uh demonstrated slh show it's
what I want um
if you watch any other talk because you
saw me talk and said hey I want to watch
more about this this is the one I would
recommend it's the chief
maintainer um Bjorn gives it and it's
really entertaining uh he gave this one
of the recent absc days I forget which
one uh I think one back in
October all
right so let's review real quick before
we jump to
zap so
this
list if you were just starting your
journey and had nowhere idea like how do
I get started I would start with the top
10
lists if you're on your path and like I
need to learn more about something
quickly no matter what you're doing for
a living cheat sheets should be in your
back
pocket now we're moving in the purple
and blue teams that's where I think
goats have the best Advantage because
they teach you what is actually
there and what people are attacking and
how those attacks work and then there's
zap zap is definitely purple team but I
think zap is really a tool for
attackers personally even though if you
read all the docs it really is teaching
you how to make your app secure that's
the whole point of having an tax proxy
that goes and hacks your your site but
if I was starting from just like hey I'm
planning to capture the flag and I need
something just tell me what
vulnerabilities exist in this thing I
can hit zap's not a bad tool not that
I've ever done that um but it looks like
this it old school looking you just tell
it what you're attacking tell it how to
attack it and hit go you can get this up
and run it in under five minutes run in
a Docker container what I would highly
recommend you start with is Juice Shop
because it Maps one to one with both
docks and it's beautiful up close it
looks a little closer to this so I was
like Hey Juice Shop only has nine alerts
yeah but one of those has 48
deep it's like open up that support
ticket and like yeah this should be an
easy one and then you actually look at
the screenshot they sent and that's all
they sent I've been there
um notice it gives you cwe ID wasac a
ID can start sending you down the path
of like how do you actually fix this
start sending on that you can tie these
numbers back to open CR and start
chasing down how do I what do I do about
this zap's got
issues there's an issue queue for all of
these
things but this is a tool that if you
really are interested in like red
teaming in my opinion that would be an
issue you to go get involved with like
did we think about this hey let's add
this
in that's maybe the right price for you
but again that's my personal
opinion it's dangerous out there you
don't have to go It
Alone we all want the same thing at the
end of the day we want to sleep through
the night not have nightmares spend time
with our
families start here no matter where
you're at in your journey these are the
four I think we good jumping off
points I'm the Dwayne I live in Chicago
and I should have about 10 minutes for
questions still even with a slight late
start
oh
nice ah
yes tying the business value down um I
think someone said it earlier I can't
remember what talk that was in um you
can learn more for the price of a
beer than you can for like the entire
entry feed RSA if you get him in the
right room um exacts so very much there
is the human aspect to it of like
hey what are you doing on Thursday night
next
week go to the thing with me like see
how passionate people get about these
things that's why I think the community
is first because if you go in with zap
wow nobody knows what you're talking
about uh I forgot to ask how many people
actually have heard of Zap uh I ask in a
room once at um where was I uh Charleson
West Virginia so he WV like who here's
ever use zap and three hands out of 30
went up and everyone in that room is was
either affiliate with oasp some way or
another I think um if I remember right
um but that's that's where I would start
is just the pure human aspect to it of
hey that that that
is yeah um if you're trying to get a
budget number I think that's the better
approach if you're trying to make
culture change and trying to get like
Hey how do we improve our overall
security POS year how do we get people
on board with training have you ever
again it's not the developer issue but
hey we need to approve like an afternoon
for the dubs to do this activity
together let's play do a capture quick
Capture the Flag let's do a quick fun
kind of interactive
training tying that back to business
value
seems pretty straightforward to me but
again I'm not wearing a CIO
hat
oh and quick quick quick clarification
um so I am an OAS member proudly and
strongly I don't lead an OAS chapter I'm
just somebody who thought it was neat
enough to write a talk about so I will
take the credit and pass it on to the
rest of the entire OS Community but I am
one of one of many not any kind of title
yes this is how I'm
contributing other
question oh was a
hallway anybody else want to see Juice
Shop anything else about Juice Shop
since I got it pulled
up can't believe a reset maybe it's a
Docker
thing all right well I'm not GNA hold a
hostage uh thanks everybody for coming
out thanks for staying
late
[Music]