Download as PDF, PPTX
Uploaded byDevSecCon
DevSecCon Singapore 2018 - Maginot Line – 6 Common AppSec Anti-Patterns Preventing your Success by Pete Chestna
The document summarizes Peter Chestna's presentation on common application security (AppSec) anti-patterns and practical solutions. It discusses how InfoSec differs from AppSec in terms of maturity. It then outlines several common AppSec anti-patterns such as only focusing on critical applications, not properly managing open source components, and having a security mandate without relationships. For each anti-pattern, it provides strategies for practical solutions such as comprehensive security policies, mapping all applications to a maturity model, selecting appropriate security metrics, and establishing an open source incident response plan.
More Related Content
Similar to DevSecCon Singapore 2018 - Maginot Line – 6 Common AppSec Anti-Patterns Preventing your Success by Pete Chestna
![Governance, Deployment & Methodologies for Agentic Automation [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day2-251112135038-a386476d-thumbnail.jpg?width=640&height=640&fit=bounds)
DevSecCon Singapore 2018 - Maginot Line – 6 Common AppSec Anti-Patterns Preventing your Success by Pete Chestna
- 1. Join the conversation#DevSecCon PETER CHESTNA Maginot Line Common AppSec Anti-Patterns
- 2. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES2 @PeteChestna Who am I? • 25+ Years Software Development Experience • 11+ Years Application Security Experience • Certified Agile Product Owner and Scrum Master • At Veracode since 2006 • From Waterfall to Agile to DevOps • From Monolith to MicroService • Consultant on DevSecOps best practices • Fun Fact: I love whiskey! • Tell me where to drink local whiskey
- 3. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES3 @PeteChestna Agenda • InfoSec vs. AppSec maturity • Common anti-patterns • Practical solutions
- 4. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES4 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES InfoSec vs. AppSec
- 5. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES5 @PeteChestna InfoSec
- 6. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES6 @PeteChestna AppSec
- 7. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES7 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES AppSec Anti-Patterns
- 8. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES8 @PeteChestna AP: The Goal?
- 9. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES9 @PeteChestna AP: The Goal?
- 10. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES10 @PeteChestna AP: The Goal?
- 11. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES11 @PeteChestna AP: The Goal? Find TrackDevelop Fix Re-test Develop Bug No Bug Develop Develop Develop
- 12. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES12 @PeteChestna AP: The Goal?
- 13. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES13 @PeteChestna Measurement is Key
- 14. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES14 @PeteChestna Training and Awareness
- 15. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES15 @PeteChestna Train Yourself on the Process
- 16. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES16 @PeteChestna Help them fix what they find
- 17. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES17 @PeteChestna AP: Security Mandate
- 18. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES18 @PeteChestna AP: Security Mandate
- 19. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES19 @PeteChestna Relationships
- 20. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES20 @PeteChestna Mutual Accountability
- 21. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES21 AP: Protect Just the Critical Applications Retailer How: Sophisticated kill chain including exploitation of vulnerable web application Result: Hackers stole names, mailing addresses, phone numbers and email addresses for more than 70 million shoppers Financial Institution How: Vulnerability on website built and maintained by third-party vendor in support of a charity. Result: Usernames and passwords for 76 million households and 7 million business were stolen
- 22. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES22 @PeteChestna AP: Protect Just the Critical Applications Strategy: Comprehensive AppSec • Application Inventory • Map to Maturity Model • Set Security Policies • Select Metrics • Report Regularly
- 23. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES23 @PeteChestna AP: Protect Just the Critical Applications Strategy: Map All Applications to Maturity Model Baseline Ostrich Reactive Proactive Adaptive
- 24. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES24 @PeteChestna AP: Protect Just the Critical Applications Strategy: Select Metrics Per Application • Scanned vs Unscanned • Only include policy flaws • Flaws Found vs. Fixed • Flaws Introduced • Utilization • Automation
- 25. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES25 @PeteChestna AP: Protect Just the Critical Applications Strategy: Report Regularly • Fair and transparent • Per Application • Per Team • Per Management Level • Include Maturity Level • Gamify if possible
- 26. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES26 @PeteChestna AP: What Open Source? Healthcare Provider How: Targeted a flaw in OpenSSL, CVE-2014-0160, better known as Heartbleed Result: The theft of Social Security Numbers and other personal data belonging to 4.5 million patients Financial Institution How: Hackers exploited a known vulnerability in an open source component Result: Social Security Numbers and personal data for more than 143 million Americans stolen. Three executives lose their jobs.
- 27. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES27 @PeteChestna Built Mostly from Components 80% to 95% of modern apps consist of assembled components. Proprietary Code Open Source Open Source Open Source Open Source Open Source Open Source Open Source Open Source Open Source Open Source Open Source Open Source
- 28. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES28 @PeteChestna Open Source – More or Less Secure? • Defect rate in open source is no better or worse than first party code • The difference is that developers never revisit • Integrated and abandoned • It’s not a problem until a vulnerability is discovered
- 29. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES29 @PeteChestna Integrated and Abandoned Explicitly - Struts
- 30. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES30 @PeteChestna Integrated and Abandoned Implicitly – Apache Commons Collections
- 31. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES31 @PeteChestna Component Family Tree – Apache Commons Collection (ACC) 3.2.1 Apache Commons Collections 3.2.1 (1290) Apache Commons BeanUtils (1348) Spring Web (1779) Spring Framework (501) ... Core Hibernate ORM Functionality (1185) Spring TestContext Framework (3007) Spring Web MVC (1314) ... Apache Commons Configuration (803) Hadoop Core (399) SonarQube Plugin API (262) ... Apache Velocity (748) Spring Context Support (916) SnakeYAM (519) ... Within 5 generations, 80,323 components contain ACC 3.2.1 The components are then used in millions of software applications >26% of software applications had ACC 3.2.1 50.3% of software applications had some vulnerable version of ACC
- 32. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES32 @PeteChestna AP: What Open Source? Strategy: Security Champions
- 33. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES33 @PeteChestna AP: What Open Source? Strategy: Assess MTTR • How quickly can you ship a code change? • For each application: – Methodology – Test automation – Time to deploy – CI/CD? – Minutes/Hours/Days/Weeks?
- 34. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES34 @PeteChestna AP: What Open Source? Strategy: OSS Incident Response Plan • Monitor for new CVEs • Triage CVE based on: – Database of applications – CVSS score – Known exploit • Disseminate to champions – Vulnerability assessment – Remediation plan – Notification of remediation or mitigation
- 35. © 2017 VERACODEINC. ACQUIRED BY CA TECHNOLOGIES42 @PeteChestna Conclusions
- 36. Join the conversation#DevSecCon Thank You