ContinuousSecurity, Beyond Automation.pdf
0 likes•111 views
Neelu Tripathy, a security practice lead at ThoughtWorks India with over 13 years of experience, emphasizes the importance of continuous security beyond mere automation in product development. The document discusses various aspects of securing products, including vulnerability assessments, threat modeling, and integrating security practices into development processes. It highlights real-world examples of security breaches and the need for a comprehensive approach to manage risks effectively across the software development lifecycle.
ContinuousSecurity, Beyond Automation.pdf
- 1. NEELU TRIPATHY NEELU TRIPATHY CONTINUOUS SECURITY: BEYOND AUTOMATION Continuous Security: Beyond Automation
- 2. NEELU TRIPATHY Work Conferences Contact Interests & Certifications § Security Practice Lead, Thoughtworks India § 13+ years of InfoSec experience § Establishing Security practices for client facing product development § Speaker/Trainer: c0c0n, BlackHat, BSidesDelhi, NSRCEL IIMB; Villages at Nullcon, DefCon, rootconf § Organizer: SecConf, Thoughtworks § Review Board: NullCon, bSides SGP, CySEK Karnataka § DevSecOps, Continuous Security, Vulnerability Assessments, Pentesting for Web & Networks, Red Teaming, Social Engineering, Threat Modelling & Design Reviews § OSCP, GraphQLParser for Burp @neelutripathy br3akp0int@Null/Git neelutripathy ABOUT ME
- 3. NEELU TRIPATHY § Affected: 23000 users/customers § Leaked Credentials in Docker image § Bash uploader Script modified § Created a backdoor from customer Cis § Stole Git creds, tokens, keys § Malware: APT29 § Affected: FireEye, US Treasury § § Target: NMS Orion; 300000 Customers(US Fed, DoD, 425/Fortune 500) § Build Server compromised § Wasn’t present in code § March – June – 2020 § Handcrafted: sleep b4 execute, custom to environments, avoid private IPs § 57 million customer and driver records stolen § $100,000 for cover-up § $148 million total cost to Uber § AWS credentials in Github § Github repo was exposed § CSO Joe Sullivan forced to leave LAST FEW YEARS..
- 4. NEELU TRIPATHY MAINTENANCE RELEASE DEPLYMENT TEST DEVELOPMENT DESIGN REQUIREMENTS REQUIREMENTS DESIGN DEVELOPMENT TEST DEPL0Y REVIEW RELEASE WATERFALL AGILE AGILE & WATERFALL DEVELOPMENT
- 5. NEELU TRIPATHY CONTINUOUS SECURITY VULNERABILITIES PREDICTABLE Automation TOOLS PRODUCTS NOT PREDICTABLE PEOPLE PROCESSES CONTINUOUS SECURITY: LIMITATIONS OF AUTOMATION
- 6. NEELU TRIPATHY Detective •SAST •DAST •Dependency Checking •IDE Static Analysis •RASP/IAST Preventive •Secrets Check-in prevention •pre-commit/push hooks •Security Unit tests •Compliance as Code •Security in IaC Environmental •Container Security •Version Controls •Network/Host/cloud •Hardening •Dev Components Configuration •WAF •Logging & Monitoring •DoS Protection AUTOMATING CONTROLS
- 7. NEELU TRIPATHY NEELU TRIPATHY SECURITY OF THE PRODUCT VS PRODUCT DELIVERY
- 8. NEELU TRIPATHY Security Practices Standards Supply Chain Security Product Security Awareness SECURING YOUR PRODUCT DEVELOPMENT
- 9. NEELU TRIPATHY Product Security SECURING YOUR PRODUCT DEVELOPMENT
- 10. NEELU TRIPATHY Product is secure(enough) Fewer vulnerabilities in the product Code is written securely Cannot be abused to cause damage
- 11. NEELU TRIPATHY PRODUCT SECURITY: KASEYA KASEYA • Ransomware attack • Kaseya's VSA software • Affected: 50 direct customers, and between 800 and 1,500 businesses down the chain • Cause: authentication bypass vulnerability in the Kaseya VSA • Authentication Bypass >> SQL injection >> code execution >> management agent update with REvil ransomware.
- 12. NEELU TRIPATHY Infrastructure § Threat Modeling § Architecture Review Design § Vulnerability assessment § Penetration testing § Mobile/Device Testing Dynamic Application/Service Static Code § Static Code Security review § License verification § Dependency checking § Network VA/PT (BB/GB) § Container Scanning § Cloud Security Assessment MAKING A SECURE SOFTWARE
- 13. NEELU TRIPATHY Supply Chain Security SECURING YOUR PRODUCT DEVELOPMENT
- 14. NEELU TRIPATHY Security of the DELIVERY Source:sysdig.com DEV TEST STAGING PROD SECURITY OF THE DELIVERY
- 16. NEELU TRIPATHY Standards Awareness SECURING YOUR PRODUCT DEVELOPMENT
- 17. NEELU TRIPATHY Tech Stack specific Role specific awareness General Security Awareness AWARENESS Developer Business Analyst QA Tech Lead Tech Architect
- 18. NEELU TRIPATHY Frameworks & Standards • NIST Cybersecurity Framework • ISO 27001 • GDPR • PCI • and so on.. Password Policy Mobile/Device security Endpoint Security Network security Risk Assessment & Treatment Physical environment Product security Communicatio ns & operations Maintenance, Patching STANDARDS
- 19. NEELU TRIPATHY Security Practices SECURING YOUR PRODUCT DEVELOPMENT
- 20. NEELU TRIPATHY 20 § Secure Baselines as a starting point § Hardening § Configuration § Security Acceptance Criteria § DevSecOps KPIs, SLAs/TATs § Observability & Threat Management § Backlog > Project Dashboard § Vulnerability Management § Create Feedback Loops § Security Unit Tests § Code Review Checkpoints § Audit/Secure Delivery Checklists § ITMs § Access Management § Change Management § Sustainable § Evolving Awareness SECURITY PRACTICES
- 21. NEELU TRIPATHY 21 Educate Dev Teams Define and design Security backlog Planning Team card wall/board 1 2 3 4 5 Feedback/Security Unit Tests Infra Security Review Container Scanning DAST Develop 10 9 8 7 6 Security Epic User Story-Sec ACs Epic User Story Epic Fix Story TO DO DOING DONE Analyze SCA SAST Test and review Network Vulnerability Assessment Inspect and adapt Priority Threat Modelling Technology & Automation Process People Sec Champ /Dev/QA/TL/BA Sec Champ/Expert: Optional DevOps Product Tech Principle/Lead Project Manager Security Expert Sec Champ /Dev/QA/TL/BA As the story goes
- 22. NEELU TRIPATHY 1 2 3 4 5 Promote security as code Secure by design Automating security gates Security is everyone’s responsibility Security in the definition of done Key Takeaways
- 23. NEELU TRIPATHY References • https://news.sophos.com/en-us/2021/07/02/kaseya-vsa-supply-chain- ransomware-attack/ • https://www.informationisbeautiful.net/visualizations/worlds-biggest- data-breaches-hacks/ • https://owasp.org/www-project-devsecops-maturity-model/ • https://owasp.org/www-project-application-security-verification- standard/ • https://martinfowler.com/articles/agile-threat-modelling.html
- 25. NEELU TRIPATHY THANK YOU! Contact @neelutripathy br3akp0int@Null/Git neelutripathy Neelu Tripathy Security Practice Lead, Thoughtworks India