SlideShare une entreprise Scribd logo

Secure Software Development Lifecycle - Devoxx MA 2018

•
•
Imola Informatica
Imola Informatica

Slides from our talk @Devoxx MA 2018. We discuss Secure Software Development Lifecycle practices, recommendations, and tools, and we show practical examples of bad progamming habits that can be mitigated.

Technologie
1  sur  49
Télécharger pour lire hors ligne
SSDLC - Secure Software Development Lifecycle L. Molari – S. Monti – A. Proscia @imolinfo https://www.imolainformatica.it
How much does it cost? if (multiWrapper.hasErrors()) { for (LocalizedMessage error : multiWrapper.getErrors()) { if (validation != null) { validation.addActionError( LocalizedTextUtil.findText(error.getClazz(), error.getTextKey(), ActionContext.getContext().getLocale(), error.getDefaultMessage(), error.getArgs())); } } } #SSDLC@imolinfo
How much does it cost? if (multiWrapper.hasErrors()) { for (LocalizedMessage error : multiWrapper.getErrors()) { if (validation != null) { validation.addActionError( LocalizedTextUtil.findText(error.getClazz(), error.getTextKey(), ActionContext.getContext().getLocale(), error.getDefaultMessage(), error.getArgs())); } } } source Reuters: https://reut.rs/2QsGivt #SSDLC@imolinfo
A little patch… #SSDLC@imolinfo
Security costs. Average cost of a data breach in 2017 was… #SSDLC@imolinfo
Security costs. When you don’t care about it. …3.62 milions of dollars. source IBM: https://ibm.co/2tMp7ek #SSDLC@imolinfo
GDPR: Take care of users data With GDPR, data breaches will be more and more expensive: fines up to € 20M #SSDLC@imolinfo
Security misconceptions Security should not be a matter of fences… #SSDLC@imolinfo
Security misconceptions …or products or tools either #SSDLC@imolinfo
Key Principles Security should be a process #SSDLC@imolinfo Security should be testable Security should be measurable
Security as a Process #SSDLC@imolinfo Security should be a process
Software Development LifeCycle SDLC #SSDLC@imolinfo «Security» goes here
A typical perspective #SSDLC@imolinfo Don’t care about Security Let’s deliver the application
(Secure) Software Development LifeCycle SSDLC #SSDLC@imolinfo Dynamic Application Security Testing Static Application Security Testing Software Component Analysis
SSDLC Landscape Analysis Design Development SAST Code Review Software Component Analysis Testing DAST / IAST Maintenance SIEM Vault Management Issue TrackingIndipendent Vulnerability Assessment Risk Management Consolidated Security Standard Security Best Practices Threat Modelling Secure Coding Guidelines Security Response Planning Secure Testing Policies Security Response Execution Education & Awareness RASP Enterprise Information Security Architecture Continuous Vulnerability Assessment #SSDLC@imolinfo
OWASP 2017 Top 10 #SSDLC@imolinfo OWASP Top 10 Application Security Risks – 2017 A1:2017 – Injection A2:2017 - Broken Authentication A3:2017 - Sensitive Data Exposure A4:2017 - XML External Entities (XXE) A5:2017 - Broken Access Control A6:2017 - Security Misconfiguration A7:2017 - Cross-Site Scripting (XSS) A8:2017 - Insecure Deserialization A9:2017 - Using Components with Known Vulnerabilities A10:2017 - Insufficient Logging&Monitoring source OWASP: https://bit.ly/2HlP8H5
OWASP 2017 Top 10 #SSDLC@imolinfo OWASP Top 10 Application Security Risks – 2017 A1:2017 – Injection A2:2017 - Broken Authentication A3:2017 - Sensitive Data Exposure A4:2017 - XML External Entities (XXE) A5:2017 - Broken Access Control A6:2017 - Security Misconfiguration A7:2017 - Cross-Site Scripting (XSS) A8:2017 - Insecure Deserialization A9:2017 - Using Components with Known Vulnerabilities A10:2017 - Insufficient Logging&Monitoring source OWASP: https://bit.ly/2HlP8H5
Security Testing Tools #SSDLC@imolinfo Security should be testable
(Secure) Software Development LifeCycle SSDLC #SSDLC@imolinfo Dynamic Application Security Testing Static Application Security Testing Software Component Analysis
SAST - Static Application Security Testing SAST lets you find flaws in source code using the best known patterns of bad programming habits #SSDLC@imolinfo
SAST - Static Application Security Testing String query = "select count(*) as number "+ " from required_documents rd, "+ " required_documents_quotations rdq, "+ " quotations q, documents d "+ " where rd.id = rdq.id_document "+ " and rd.id = d.id "+ " and rdq.id_quotation = q.id "+ " and q.end_date > sysdate "+ " and rd.status = 'EXP' "+ " and q.quotation_number = " + quotation; #SSDLC@imolinfo
SAST - Static Application Security Testing String query = "select count(*) as number "+ " from required_documents rd, "+ " required_documents_quotations rdq, "+ " quotations q, documents d "+ " where rd.id = rdq.id_document "+ " and rd.id = d.id "+ " and rdq.id_quotation = q.id "+ " and q.end_date > sysdate "+ " and rd.status = 'EXP' "+ " and q.quotation_number = " + quotation; Thank you guys! #SSDLC@imolinfo
SAST - Static Application Security Testing String key = “A Fixed Password"; // 128 bit key // Create key and cipher Key aesKey = new SecretKeySpec(key.getBytes(), "AES"); Cipher cipher = Cipher.getInstance("AES"); // encrypt the text cipher.init(Cipher.ENCRYPT_MODE, aesKey); byte[] encrypted = cipher.doFinal(password.getBytes()); #SSDLC@imolinfo
SAST - Static Application Security Testing String key = “A Fixed Password"; // 128 bit key // Create key and cipher Key aesKey = new SecretKeySpec(key.getBytes(), "AES"); Cipher cipher = Cipher.getInstance("AES"); // encrypt the text cipher.init(Cipher.ENCRYPT_MODE, aesKey); byte[] encrypted = cipher.doFinal(password.getBytes()); #SSDLC@imolinfo
SAST - Static Application Security Testing String key = “A Fixed Password"; // 128 bit key // Create key and cipher Key aesKey = new SecretKeySpec(key.getBytes(), "AES"); Cipher cipher = Cipher.getInstance("AES"); // encrypt the text cipher.init(Cipher.ENCRYPT_MODE, aesKey); byte[] encrypted = cipher.doFinal(password.getBytes()); What’s wrong with you bro’??? #SSDLC@imolinfo
SonarQube #SSDLC@imolinfo A comprehensive platform for Quality Assurance and Static Analysis Source Testing
#SSDLC@imolinfo Let’s play!
(Secure) Software Development LifeCycle SSDLC #SSDLC@imolinfo Dynamic Application Security Testing Static Application Security Testing Software Component Analysis
Equifax Data Breach #SSDLC@imolinfo On march 2017 a serious flaw on Apache Struts 2.x was disclosed (CVE-2017-5638) ▪ Vulnerability allows Remote Code Execution ▪ Equifax Inc., a large USA credit reporting agency, was victim of an attack via this flaw ▪ Data of 145.5 milions of US citizens were stolen
Software Component Analysis Any lesson learnt from the Equifax data breach? #SSDLC@imolinfo
Software Component Analysis Know your software and its vulnerable components! “OWASP TOP 10 2017: A9:2017-Using Components with Known Vulnerabilities” #SSDLC@imolinfo Any lesson learnt from the Equifax data breach?
Software Component Analysis Answer to questions such as… …what components am I using? …what vulnerabilities am I inheriting? …where am I using this component? #SSDLC@imolinfo
Dependency Track A platform for comprehensive Software Component Analysis #SSDLC@imolinfo
#SSDLC@imolinfo Let’s play!
(Secure) Software Development LifeCycle SSDLC #SSDLC@imolinfo Dynamic Application Security Testing Static Application Security Testing Software Component Analysis
DAST - Dynamic Application Security Testing DAST lets us test applications using a black box approach #SSDLC@imolinfo
Zed Attack Proxy #SSDLC@imolinfo An integrated Web Application penetration testing tool with active and passive scanners
#SSDLC@imolinfo Let’s play!
Reverse proxy uses ZAP as HTTP proxy for connection to application Automated Tests HTTP Proxy ZAP Proxy Application CI Suite Zed Attack Proxy #SSDLC@imolinfo 1 2 3 6 4 Users and automated tests reach application through a reverse proxy ZAP passively records and scan requests of users and automated tests 5 A CI job fires ZAP active scan tests ZAP tries to attack application exploiting recorded requests A CI job collects reports from ZAP
Don’t rely only on tools… Perform routine code reviews #SSDLC@imolinfo Security is a matter of people and processes Build awareness through education
Security KPI Security should be measurable #SSDLC@imolinfo
CVSS – Common Vulnerability Score System #SSDLC@imolinfo Temporal Metric Group Exploit Code Maturity Remediation Level Report Confidence Modified Base Metrics Exploit Code Maturity Remediation Level Environmental Metric Group Report Confidence Exploitable Metrics Scope Impact Metrics Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A) Base Metric Group
CVSS - Common Vulnerability Score System #SSDLC@imolinfo Severity CVSSv2 CVSSv3 None N/A 0.0 Low 0.0-3.9 0.1-3.9 Medium 4.0-6.9 4.0-6.9 High 7.0-10.0 7.0-8.9 Critical N/A 9.0-10 Base Score Range
CVSS - An example? CVSS 10 CVE-2017-5638 (Equifax Data Breach Vulnerability) #SSDLC@imolinfo
WRT - Weighted Risk Trend #SSDLC@imolinfo Weighted Sum of vulnerabilities per application risk factor Example Blocker: 4 x 2.5 Critical: 133 x 2 Major: 508 x 1.5 Minor: 314 x 1 Application Risk Factor: 1.5 WRT = 2028
Security in a CI/CD process #SSDLC@imolinfo Software Security Checks Toolchain Software Component Analysis DAST OWASP ZAP SAST Continuos Integration SCM Issue Tracking Artifact Repository Container Security Platform Application Collaboration Suite SIEM
Key Takeaway points TOOLS can help you, but use them WISELY #SSDLC@imolinfo Security CAN fit your software development PROCESS Build security AWARENESS in your organization Security is TESTABLE and MEASURABLE in an AUTOMATED fashion
Do you have any question? 42!(*) (*) If you don’t know why 42 is your answer, I’ve got some bad news for you… Black Hats are the least of your problems: Vogons are on the way! #SSDLC@imolinfo
Luca Molari lmolari@imolainformatica.it @LMolr Stefano Monti smonti@imolainformatica.it @Ste_Monti Alessandro Proscia aproscia@imolainformatica.it @alex184it #SSDLC@imolinfo

Recommandé

Introduction to threat_modeling
Introduction to threat_modelingIntroduction to threat_modeling
Introduction to threat_modelingPrabath Siriwardena
 
Threat Modeling Everything
Threat Modeling EverythingThreat Modeling Everything
Threat Modeling EverythingAnne Oikarinen
 
Threat Modeling In 2021
Threat Modeling In 2021Threat Modeling In 2021
Threat Modeling In 2021Adam Shostack
 
Threat Modelling
Threat ModellingThreat Modelling
Threat Modellingn|u - The Open Security Community
 
7 Steps to Threat Modeling
7 Steps to Threat Modeling7 Steps to Threat Modeling
7 Steps to Threat ModelingDanny Wong
 
Security Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsSecurity Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsYulian Slobodyan
 
Introduction to Software Security and Best Practices
Introduction to Software Security and Best PracticesIntroduction to Software Security and Best Practices
Introduction to Software Security and Best PracticesMaxime ALAY-EDDINE
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)Ahmad Haghighi
 

Recommandé

Introduction to threat_modeling
Introduction to threat_modelingIntroduction to threat_modeling
Introduction to threat_modelingPrabath Siriwardena
 
Threat Modeling Everything
Threat Modeling EverythingThreat Modeling Everything
Threat Modeling EverythingAnne Oikarinen
 
Threat Modeling In 2021
Threat Modeling In 2021Threat Modeling In 2021
Threat Modeling In 2021Adam Shostack
 
Threat Modelling
Threat ModellingThreat Modelling
Threat Modellingn|u - The Open Security Community
 
7 Steps to Threat Modeling
7 Steps to Threat Modeling7 Steps to Threat Modeling
7 Steps to Threat ModelingDanny Wong
 
Security Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsSecurity Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsYulian Slobodyan
 
Introduction to Software Security and Best Practices
Introduction to Software Security and Best PracticesIntroduction to Software Security and Best Practices
Introduction to Software Security and Best PracticesMaxime ALAY-EDDINE
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)Ahmad Haghighi
 
Maturity Model of Security Disciplines
Maturity Model of Security Disciplines Maturity Model of Security Disciplines
Maturity Model of Security Disciplines Florian Roth
 
STRIDE And DREAD
STRIDE And DREADSTRIDE And DREAD
STRIDE And DREADchuckbt
 
SIEM and Threat Hunting
SIEM and Threat HuntingSIEM and Threat Hunting
SIEM and Threat Huntingn|u - The Open Security Community
 
Red7 Software Application Security Threat Modeling
Red7 Software Application Security Threat ModelingRed7 Software Application Security Threat Modeling
Red7 Software Application Security Threat ModelingRobert Grupe, CSSLP CISSP PE PMP
 
Security in the Software Development Life Cycle (SDLC)
Security in the Software Development Life Cycle (SDLC)Security in the Software Development Life Cycle (SDLC)
Security in the Software Development Life Cycle (SDLC)Frances Coronel
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDEGirindro Pringgo Digdo
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
Threat modeling web application: a case study
Threat modeling web application: a case studyThreat modeling web application: a case study
Threat modeling web application: a case studyAntonio Fontes
 
Enterprise Security Architecture Design
Enterprise Security Architecture DesignEnterprise Security Architecture Design
Enterprise Security Architecture DesignPriyanka Aash
 
CSSLP & OWASP & WebGoat
CSSLP & OWASP & WebGoatCSSLP & OWASP & WebGoat
CSSLP & OWASP & WebGoatSurachai Chatchalermpun
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Kangaroot
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 
Threat Modeling And Analysis
Threat Modeling And AnalysisThreat Modeling And Analysis
Threat Modeling And AnalysisLalit Kale
 
Distributed Immutable Ephemeral - New Paradigms for the Next Era of Security
Distributed Immutable Ephemeral - New Paradigms for the Next Era of SecurityDistributed Immutable Ephemeral - New Paradigms for the Next Era of Security
Distributed Immutable Ephemeral - New Paradigms for the Next Era of SecuritySounil Yu
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onSplunk
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Secure Coding and Threat Modeling
Secure Coding and Threat ModelingSecure Coding and Threat Modeling
Secure Coding and Threat ModelingMiriam Celi, CISSP, GISP, MSCS, MBA
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC FrameworkRishi Kant
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxcgt38842
 
OWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxOWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxnmk42194
 

Contenu connexe

Tendances

Maturity Model of Security Disciplines
Maturity Model of Security Disciplines Maturity Model of Security Disciplines
Maturity Model of Security Disciplines Florian Roth
 
STRIDE And DREAD
STRIDE And DREADSTRIDE And DREAD
STRIDE And DREADchuckbt
 
Security in the Software Development Life Cycle (SDLC)
Security in the Software Development Life Cycle (SDLC)Security in the Software Development Life Cycle (SDLC)
Security in the Software Development Life Cycle (SDLC)Frances Coronel
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
Threat modeling web application: a case study
Threat modeling web application: a case studyThreat modeling web application: a case study
Threat modeling web application: a case studyAntonio Fontes
 
Enterprise Security Architecture Design
Enterprise Security Architecture DesignEnterprise Security Architecture Design
Enterprise Security Architecture DesignPriyanka Aash
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Kangaroot
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 
Threat Modeling And Analysis
Threat Modeling And AnalysisThreat Modeling And Analysis
Threat Modeling And AnalysisLalit Kale
 
Distributed Immutable Ephemeral - New Paradigms for the Next Era of Security
Distributed Immutable Ephemeral - New Paradigms for the Next Era of SecurityDistributed Immutable Ephemeral - New Paradigms for the Next Era of Security
Distributed Immutable Ephemeral - New Paradigms for the Next Era of SecuritySounil Yu
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onSplunk
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC FrameworkRishi Kant
 

Tendances (20)

Maturity Model of Security Disciplines
Maturity Model of Security Disciplines Maturity Model of Security Disciplines
Maturity Model of Security Disciplines
 
STRIDE And DREAD
STRIDE And DREADSTRIDE And DREAD
STRIDE And DREAD
 
SIEM and Threat Hunting
SIEM and Threat HuntingSIEM and Threat Hunting
SIEM and Threat Hunting
 
Red7 Software Application Security Threat Modeling
Red7 Software Application Security Threat ModelingRed7 Software Application Security Threat Modeling
Red7 Software Application Security Threat Modeling
 
Security in the Software Development Life Cycle (SDLC)
Security in the Software Development Life Cycle (SDLC)Security in the Software Development Life Cycle (SDLC)
Security in the Software Development Life Cycle (SDLC)
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDE
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
Threat modeling web application: a case study
Threat modeling web application: a case studyThreat modeling web application: a case study
Threat modeling web application: a case study
 
Enterprise Security Architecture Design
Enterprise Security Architecture DesignEnterprise Security Architecture Design
Enterprise Security Architecture Design
 
CSSLP & OWASP & WebGoat
CSSLP & OWASP & WebGoatCSSLP & OWASP & WebGoat
CSSLP & OWASP & WebGoat
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on it
 
Threat Modeling And Analysis
Threat Modeling And AnalysisThreat Modeling And Analysis
Threat Modeling And Analysis
 
Distributed Immutable Ephemeral - New Paradigms for the Next Era of Security
Distributed Immutable Ephemeral - New Paradigms for the Next Era of SecurityDistributed Immutable Ephemeral - New Paradigms for the Next Era of Security
Distributed Immutable Ephemeral - New Paradigms for the Next Era of Security
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
 
Secure Coding and Threat Modeling
Secure Coding and Threat ModelingSecure Coding and Threat Modeling
Secure Coding and Threat Modeling
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...
 
Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC Framework
 

Similaire à Secure Software Development Lifecycle - Devoxx MA 2018

OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxcgt38842
 
OWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxOWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxnmk42194
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxjohnpragasam1
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxazida3
 
Secure Coding For Java - Une introduction
Secure Coding For Java - Une introductionSecure Coding For Java - Une introduction
Secure Coding For Java - Une introductionSebastien Gioria
 
Secure by Design Microservices & Integrations
Secure by Design Microservices & IntegrationsSecure by Design Microservices & Integrations
Secure by Design Microservices & IntegrationsBallerina
 
Prevoty NYC Java SIG 20150730
Prevoty NYC Java SIG 20150730Prevoty NYC Java SIG 20150730
Prevoty NYC Java SIG 20150730chadtindel
 
Application Security at DevOps Speed and Portfolio Scale
Application Security at DevOps Speed and Portfolio ScaleApplication Security at DevOps Speed and Portfolio Scale
Application Security at DevOps Speed and Portfolio ScaleJeff Williams
 
香港六合彩
香港六合彩香港六合彩
香港六合彩baoyin
 
Magento Application Security [EN]
Magento Application Security [EN]Magento Application Security [EN]
Magento Application Security [EN]Anna Völkl
 
Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2Jim Manico
 
OWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesOWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesMarco Morana
 
How to avoid top 10 security risks in Java EE applications and how to avoid them
How to avoid top 10 security risks in Java EE applications and how to avoid themHow to avoid top 10 security risks in Java EE applications and how to avoid them
How to avoid top 10 security risks in Java EE applications and how to avoid themMasoud Kalali
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxFernandoVizer
 
Matthew Coles - Izar Tarandach - Security Toolbox
Matthew Coles - Izar Tarandach - Security ToolboxMatthew Coles - Izar Tarandach - Security Toolbox
Matthew Coles - Izar Tarandach - Security ToolboxSource Conference
 
Application Security around OWASP Top 10
Application Security around OWASP Top 10Application Security around OWASP Top 10
Application Security around OWASP Top 10Sastry Tumuluri
 
Application Security on a Dime: A Practical Guide to Using Functional Open So...
Application Security on a Dime: A Practical Guide to Using Functional Open So...Application Security on a Dime: A Practical Guide to Using Functional Open So...
Application Security on a Dime: A Practical Guide to Using Functional Open So...POSSCON
 
Shift Left Security
Shift Left SecurityShift Left Security
Shift Left SecurityBATbern
 

Similaire à Secure Software Development Lifecycle - Devoxx MA 2018 (20)

OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
OWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxOWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptx
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
Secure Coding For Java - Une introduction
Secure Coding For Java - Une introductionSecure Coding For Java - Une introduction
Secure Coding For Java - Une introduction
 
Secure DevOps: A Puma's Tail
Secure DevOps: A Puma's TailSecure DevOps: A Puma's Tail
Secure DevOps: A Puma's Tail
 
Secure by Design Microservices & Integrations
Secure by Design Microservices & IntegrationsSecure by Design Microservices & Integrations
Secure by Design Microservices & Integrations
 
Prevoty NYC Java SIG 20150730
Prevoty NYC Java SIG 20150730Prevoty NYC Java SIG 20150730
Prevoty NYC Java SIG 20150730
 
Application Security at DevOps Speed and Portfolio Scale
Application Security at DevOps Speed and Portfolio ScaleApplication Security at DevOps Speed and Portfolio Scale
Application Security at DevOps Speed and Portfolio Scale
 
香港六合彩
香港六合彩香港六合彩
香港六合彩
 
Magento Application Security [EN]
Magento Application Security [EN]Magento Application Security [EN]
Magento Application Security [EN]
 
Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2
 
OWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesOWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root Causes
 
OWASP an Introduction
OWASP an Introduction OWASP an Introduction
OWASP an Introduction
 
How to avoid top 10 security risks in Java EE applications and how to avoid them
How to avoid top 10 security risks in Java EE applications and how to avoid themHow to avoid top 10 security risks in Java EE applications and how to avoid them
How to avoid top 10 security risks in Java EE applications and how to avoid them
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
Matthew Coles - Izar Tarandach - Security Toolbox
Matthew Coles - Izar Tarandach - Security ToolboxMatthew Coles - Izar Tarandach - Security Toolbox
Matthew Coles - Izar Tarandach - Security Toolbox
 
Application Security around OWASP Top 10
Application Security around OWASP Top 10Application Security around OWASP Top 10
Application Security around OWASP Top 10
 
Application Security on a Dime: A Practical Guide to Using Functional Open So...
Application Security on a Dime: A Practical Guide to Using Functional Open So...Application Security on a Dime: A Practical Guide to Using Functional Open So...
Application Security on a Dime: A Practical Guide to Using Functional Open So...
 
Shift Left Security
Shift Left SecurityShift Left Security
Shift Left Security
 

Dernier

Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfRankYa
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity PlanDatabarracks
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubKalema Edgar
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clashcharlottematthew16
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piececharlottematthew16
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsMiki Katsuragi
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):comworks
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationSlibray Presentation
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe
 

Dernier (20)

Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdf
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity Plan
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding Club
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clash
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piece
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering Tips
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck Presentation
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 

Secure Software Development Lifecycle - Devoxx MA 2018

  • 1. SSDLC - Secure Software Development Lifecycle L. Molari – S. Monti – A. Proscia @imolinfo https://www.imolainformatica.it
  • 2. How much does it cost? if (multiWrapper.hasErrors()) { for (LocalizedMessage error : multiWrapper.getErrors()) { if (validation != null) { validation.addActionError( LocalizedTextUtil.findText(error.getClazz(), error.getTextKey(), ActionContext.getContext().getLocale(), error.getDefaultMessage(), error.getArgs())); } } } #SSDLC@imolinfo
  • 3. How much does it cost? if (multiWrapper.hasErrors()) { for (LocalizedMessage error : multiWrapper.getErrors()) { if (validation != null) { validation.addActionError( LocalizedTextUtil.findText(error.getClazz(), error.getTextKey(), ActionContext.getContext().getLocale(), error.getDefaultMessage(), error.getArgs())); } } } source Reuters: https://reut.rs/2QsGivt #SSDLC@imolinfo
  • 5. Security costs. Average cost of a data breach in 2017 was… #SSDLC@imolinfo
  • 6. Security costs. When you don’t care about it. …3.62 milions of dollars. source IBM: https://ibm.co/2tMp7ek #SSDLC@imolinfo
  • 7. GDPR: Take care of users data With GDPR, data breaches will be more and more expensive: fines up to € 20M #SSDLC@imolinfo
  • 8. Security misconceptions Security should not be a matter of fences… #SSDLC@imolinfo
  • 9. Security misconceptions …or products or tools either #SSDLC@imolinfo
  • 10. Key Principles Security should be a process #SSDLC@imolinfo Security should be testable Security should be measurable
  • 11. Security as a Process #SSDLC@imolinfo Security should be a process
  • 13. A typical perspective #SSDLC@imolinfo Don’t care about Security Let’s deliver the application
  • 14. (Secure) Software Development LifeCycle SSDLC #SSDLC@imolinfo Dynamic Application Security Testing Static Application Security Testing Software Component Analysis
  • 15. SSDLC Landscape Analysis Design Development SAST Code Review Software Component Analysis Testing DAST / IAST Maintenance SIEM Vault Management Issue TrackingIndipendent Vulnerability Assessment Risk Management Consolidated Security Standard Security Best Practices Threat Modelling Secure Coding Guidelines Security Response Planning Secure Testing Policies Security Response Execution Education & Awareness RASP Enterprise Information Security Architecture Continuous Vulnerability Assessment #SSDLC@imolinfo
  • 16. OWASP 2017 Top 10 #SSDLC@imolinfo OWASP Top 10 Application Security Risks – 2017 A1:2017 – Injection A2:2017 - Broken Authentication A3:2017 - Sensitive Data Exposure A4:2017 - XML External Entities (XXE) A5:2017 - Broken Access Control A6:2017 - Security Misconfiguration A7:2017 - Cross-Site Scripting (XSS) A8:2017 - Insecure Deserialization A9:2017 - Using Components with Known Vulnerabilities A10:2017 - Insufficient Logging&Monitoring source OWASP: https://bit.ly/2HlP8H5
  • 17. OWASP 2017 Top 10 #SSDLC@imolinfo OWASP Top 10 Application Security Risks – 2017 A1:2017 – Injection A2:2017 - Broken Authentication A3:2017 - Sensitive Data Exposure A4:2017 - XML External Entities (XXE) A5:2017 - Broken Access Control A6:2017 - Security Misconfiguration A7:2017 - Cross-Site Scripting (XSS) A8:2017 - Insecure Deserialization A9:2017 - Using Components with Known Vulnerabilities A10:2017 - Insufficient Logging&Monitoring source OWASP: https://bit.ly/2HlP8H5
  • 19. (Secure) Software Development LifeCycle SSDLC #SSDLC@imolinfo Dynamic Application Security Testing Static Application Security Testing Software Component Analysis
  • 20. SAST - Static Application Security Testing SAST lets you find flaws in source code using the best known patterns of bad programming habits #SSDLC@imolinfo
  • 21. SAST - Static Application Security Testing String query = "select count(*) as number "+ " from required_documents rd, "+ " required_documents_quotations rdq, "+ " quotations q, documents d "+ " where rd.id = rdq.id_document "+ " and rd.id = d.id "+ " and rdq.id_quotation = q.id "+ " and q.end_date > sysdate "+ " and rd.status = 'EXP' "+ " and q.quotation_number = " + quotation; #SSDLC@imolinfo
  • 22. SAST - Static Application Security Testing String query = "select count(*) as number "+ " from required_documents rd, "+ " required_documents_quotations rdq, "+ " quotations q, documents d "+ " where rd.id = rdq.id_document "+ " and rd.id = d.id "+ " and rdq.id_quotation = q.id "+ " and q.end_date > sysdate "+ " and rd.status = 'EXP' "+ " and q.quotation_number = " + quotation; Thank you guys! #SSDLC@imolinfo
  • 23. SAST - Static Application Security Testing String key = “A Fixed Password"; // 128 bit key // Create key and cipher Key aesKey = new SecretKeySpec(key.getBytes(), "AES"); Cipher cipher = Cipher.getInstance("AES"); // encrypt the text cipher.init(Cipher.ENCRYPT_MODE, aesKey); byte[] encrypted = cipher.doFinal(password.getBytes()); #SSDLC@imolinfo
  • 24. SAST - Static Application Security Testing String key = “A Fixed Password"; // 128 bit key // Create key and cipher Key aesKey = new SecretKeySpec(key.getBytes(), "AES"); Cipher cipher = Cipher.getInstance("AES"); // encrypt the text cipher.init(Cipher.ENCRYPT_MODE, aesKey); byte[] encrypted = cipher.doFinal(password.getBytes()); #SSDLC@imolinfo
  • 25. SAST - Static Application Security Testing String key = “A Fixed Password"; // 128 bit key // Create key and cipher Key aesKey = new SecretKeySpec(key.getBytes(), "AES"); Cipher cipher = Cipher.getInstance("AES"); // encrypt the text cipher.init(Cipher.ENCRYPT_MODE, aesKey); byte[] encrypted = cipher.doFinal(password.getBytes()); What’s wrong with you bro’??? #SSDLC@imolinfo
  • 28. (Secure) Software Development LifeCycle SSDLC #SSDLC@imolinfo Dynamic Application Security Testing Static Application Security Testing Software Component Analysis
  • 29. Equifax Data Breach #SSDLC@imolinfo On march 2017 a serious flaw on Apache Struts 2.x was disclosed (CVE-2017-5638) ▪ Vulnerability allows Remote Code Execution ▪ Equifax Inc., a large USA credit reporting agency, was victim of an attack via this flaw ▪ Data of 145.5 milions of US citizens were stolen
  • 30. Software Component Analysis Any lesson learnt from the Equifax data breach? #SSDLC@imolinfo
  • 31. Software Component Analysis Know your software and its vulnerable components! “OWASP TOP 10 2017: A9:2017-Using Components with Known Vulnerabilities” #SSDLC@imolinfo Any lesson learnt from the Equifax data breach?
  • 32. Software Component Analysis Answer to questions such as… …what components am I using? …what vulnerabilities am I inheriting? …where am I using this component? #SSDLC@imolinfo
  • 33. Dependency Track A platform for comprehensive Software Component Analysis #SSDLC@imolinfo
  • 35. (Secure) Software Development LifeCycle SSDLC #SSDLC@imolinfo Dynamic Application Security Testing Static Application Security Testing Software Component Analysis
  • 36. DAST - Dynamic Application Security Testing DAST lets us test applications using a black box approach #SSDLC@imolinfo
  • 37. Zed Attack Proxy #SSDLC@imolinfo An integrated Web Application penetration testing tool with active and passive scanners
  • 39. Reverse proxy uses ZAP as HTTP proxy for connection to application Automated Tests HTTP Proxy ZAP Proxy Application CI Suite Zed Attack Proxy #SSDLC@imolinfo 1 2 3 6 4 Users and automated tests reach application through a reverse proxy ZAP passively records and scan requests of users and automated tests 5 A CI job fires ZAP active scan tests ZAP tries to attack application exploiting recorded requests A CI job collects reports from ZAP
  • 40. Don’t rely only on tools… Perform routine code reviews #SSDLC@imolinfo Security is a matter of people and processes Build awareness through education
  • 41. Security KPI Security should be measurable #SSDLC@imolinfo
  • 42. CVSS – Common Vulnerability Score System #SSDLC@imolinfo Temporal Metric Group Exploit Code Maturity Remediation Level Report Confidence Modified Base Metrics Exploit Code Maturity Remediation Level Environmental Metric Group Report Confidence Exploitable Metrics Scope Impact Metrics Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A) Base Metric Group
  • 43. CVSS - Common Vulnerability Score System #SSDLC@imolinfo Severity CVSSv2 CVSSv3 None N/A 0.0 Low 0.0-3.9 0.1-3.9 Medium 4.0-6.9 4.0-6.9 High 7.0-10.0 7.0-8.9 Critical N/A 9.0-10 Base Score Range
  • 44. CVSS - An example? CVSS 10 CVE-2017-5638 (Equifax Data Breach Vulnerability) #SSDLC@imolinfo
  • 45. WRT - Weighted Risk Trend #SSDLC@imolinfo Weighted Sum of vulnerabilities per application risk factor Example Blocker: 4 x 2.5 Critical: 133 x 2 Major: 508 x 1.5 Minor: 314 x 1 Application Risk Factor: 1.5 WRT = 2028
  • 46. Security in a CI/CD process #SSDLC@imolinfo Software Security Checks Toolchain Software Component Analysis DAST OWASP ZAP SAST Continuos Integration SCM Issue Tracking Artifact Repository Container Security Platform Application Collaboration Suite SIEM
  • 47. Key Takeaway points TOOLS can help you, but use them WISELY #SSDLC@imolinfo Security CAN fit your software development PROCESS Build security AWARENESS in your organization Security is TESTABLE and MEASURABLE in an AUTOMATED fashion
  • 48. Do you have any question? 42!(*) (*) If you don’t know why 42 is your answer, I’ve got some bad news for you… Black Hats are the least of your problems: Vogons are on the way! #SSDLC@imolinfo