Graph Visualization - OWASP NYC Chapter
1 like1,183 views
The document discusses challenges in source code analysis, particularly with large codebases that produce thousands of results, which can be overwhelming. It emphasizes the importance of simplifying findings and offering actionable insights for developers, focusing on improving the 'what-if' analysis to determine optimal fix locations. The proposed solutions involve graph simplification techniques to correlate and manage findings more effectively.
Graph Visualization - OWASP NYC Chapter
- 1. OWASP NYC Maty Title in white and bold Siman
- 2. About Maty Siman, CISSP CTO, Founder – Checkmarx: Leading SAST (“Source Code Analysis”) Vendor Hundreds of customers WW Secures SalesForce AppExchange market Title in white and bold “Visionary” by Gartner
- 3. Graph Visualization Title in white and bold
- 4. Issues at hand – size, complexity, volume The biggest challenge of current source code analysis solutions is size- How to deliver: 1. Usable results 2. Automatically Title in white and bold 3. Out-of-the-box 4. Actionable for extra large code bases with thousands+ of results
- 5. Issue • Findings thousands accurate results, does not make us happy … • Webgoat, for example, has hundreds of XSS • We’ll narrow this down to 10 fixing places Title in white and bold
- 6. Current situation • Each result has a data flow, presented independently from other findings. Title in white and bold
- 7. Single Data Flow Path - XSS Request.QueryString*“param1”+; String s = Request.QueryString*“param1”+; … s Response.Write(s); Response.Write(s); Title in white and bold
- 8. Current situation • One is easy. • And 14? Title in white and bold
- 9. Many Single-Path – XSS – a lot of work Title in white and bold
- 10. But … • What do they have in common? Title in white and bold
- 11. Combined paths Title in white and bold
- 12. Can we … • Point, click and check without even READING the source code? • “What if I fix here? Or here?” Title in white and bold
- 13. Here it is more effective Title in white and bold
- 14. What-If I fix here? Title in white and bold
- 15. And here? Title in white and bold
- 16. Automatic “What-if” => Best Fix Location Max-Flow-Min-Cut (http://en.wikipedia.org/wiki/Max-flow_min-cut_theorem_ Title in white and bold
- 17. Simplifying the graph – step 1 - grouping Title in white and bold
- 18. Simplifying the graph – step 2 – homeograph’ing (http://enc.tfode.com/Homeomorphism_(graph_theory)) Title in white and bold
- 19. Simplifying the graph - output Title in white and bold
- 20. Simplifying the graph - output Title in white and bold
- 21. Compare the three Title in white and bold Space Invader
- 22. Benefits • Gives you the correlation between findings of the same type (SQLi) and different types. • You are not dealing with individual findings – but with a complete system •Title inyour time bold Use white and better
- 23. Thank you Title in white and bold [email protected]
Editor's Notes
- #8: That’s a data flow and how each step is reflected at the source code.
- #10: And then we might have dozens of paths. How can we gain some more information?
- #12: Let’s combine them together
- #14: So this place is probably better. More paths get fixed
- #15: If I fixed that point, what parts will be OK?
- #16: And what about this one in here?
- #17: So by fixing only three places in the code, we were able to fix…
- #18: So by fixing only three places in the code, we were able to fix…
- #19: So by fixing only three places in the code, we were able to fix…
- #20: So by fixing only three places in the code, we were able to fix…
- #21: So by fixing only three places in the code, we were able to fix…
- #22: … this.