Proactive Security AppSec Case Study
2 likes782 views
Automating your way to Proactive Application Security Andy Hoernecke AppSec Engineer Netflix OWASP Atlanta 4/21/2016
Ad
More Related Content
What's hot (20)
Viewers also liked (19)
Ad
Similar to Proactive Security AppSec Case Study (20)
Ad
Recently uploaded (19)
Proactive Security AppSec Case Study
- 1. PROACTIVE SECURITY APPSEC CASE STUDY ANDY HOERNECKE
- 2. HELO Andy Hoernecke Application Security Engineer AppSec, Automation, Data Visualization
- 3. What We Will Cover • Background on Netflix • Our Security Philosophy • Walkthrough of Our Approach to AppSec
- 4. Terminology • Define technology terms: • Application • Instance • ELB (Load Balance) • AMI • Security Groups
- 5. Netflix Primer • 100's of Developers • Over 1,000 applications • Hundreds of production pushes a day • Over 50k instances • Very Pro Open Source • No Security Gates!
- 6. Continuous Delivery • Fast, Automated Deployment • Immutable Platform • Low Friction
- 7. The Challenge • Provide security in the environment described: • No security gates • Production Changes Rapidly • Multiple Codes Bases (A/B Testing) • Many Developers vs. 5 Member AppSec Team
- 8. How?
- 9. Act as enablers not gatekeepers
- 10. Application developers are responsible for the security of their application.
- 11. Security is as important as: • functionality • performance • availability • scalability
- 12. Create paved paths, that are secure by default
- 13. Proactive Security • Know your environment & weaknesses and work to improve • Find problems early and address them • Monitor for anomalies and be prepared to respond • Collect meaningful data and use it to improve • Simplify make security the easy path • Reevaluate your approach • Share what you learn with others
- 14. Implementing Proactive Security AppSec Case Study* * Note: Talk discusses new version of software yet to be open sourced
- 15. Goals 1. Understand your environment 2. Inject automated security controls 3. Tie environment and security together
- 16. Goal 1 Understand Your Environment 1. Know the components of your environment 2. Understand connections 3. Monitor for changes
- 17. Defining The Environment • Applications that make up and support the Netflix experience 1. Accessibility (How, Where, Who) 2. Functionality 3. Ownership 4. Risk Level 5. Security
- 18. Where do Applications Come From? • Binaries • Appliances • SaaS • Internally Developed (Source Code)
- 19. Where do Applications Come From? SCMDevelopers Build Bake Deploy 1. Developers push code to SCM 2. Built into a package 3. Combined with BaseAMI to form a machine image 4. Deployed as an EC2 Instance
- 20. SCMDevelopers Build Bake Deploy Dependencies BaseAMI Source Code Package Baked AMI EC2 Instance
- 21. SCMDevelopers Build Bake Deploy EC2 Instance Cluster Application Cluster Cluster EC2 InstanceEC2 Instance ELB DNS Name
- 22. SCMDevelopers Build Bake Deploy EC2 Instance Cluster Application Dependencies BaseAMI Source Code Package Baked AMI DNS Name ELB Penguin Shortbread
- 23. Penguin Shortbread • Specialized Branch of Scumblr • Tracks Applications and all their associated metadata • Repositories • Committers • DNS Names • BaseAMI Information • Dependencies • More!
- 24. Penguin Shortbread • Individual tasks for gathering different pieces of metadata • Tasks for Spinnaker, Github, Stash, Jenkins, etc. • Easy to customize, maintain, etc. • Searching and filtering based on any information stored on the application. • Examples: What application uses sketchy.netflix.com? What repos does Andy Hoernecke contribute to?
- 25. While we're at it... • Collect information about how risky an application is • Calculate a risk score • Determine which applications posed the great risk and make decisions based on this
- 26. Security Monkey • Monitor for changes in AWS environment • Get alerts for important changes • Integrations with Scumblr/Penguin Shortbread
- 27. Goal 1 Understand Your Environment 1. Know the components of your environment 2. Understand connections 3. Monitor for changes
- 28. Goal 2 Automated Security Controls 1. Select and run tools 2. Aggregate data 3. Take action
- 29. SCMDevelopers Build Bake Deploy Systems Github Stash OpenGrok Information Source Code Commit History Committer Owner Info Security Tools/Services Static Analysis
- 30. SCMDevelopers Build Bake Deploy Systems Jenkins Information Packaged Application Dependency Info Security Tools/Services Static Analysis, Dependency Checking
- 31. SCMDevelopers Build Bake Deploy Systems Spinnaker Bakery Animator Information OS/Version Animation Date BaseAMI Info Security Tools/Services Host Analysis/Hardening
- 32. SCMDevelopers Build Bake Deploy Systems Spinnaker DNS Security Monkey Information Application Name DNS Names Security Groups Security Tools/Services Dynamic Scanning, Runtime Analysis, Penetration Testing
- 33. Dirty Laundry • Evolution of Scumblr
- 35. Scumblr 2.0 • Extended the model with Metadata • Added: • Generic Tasks • Task Ordering/Grouping • Customizable Views • Events
- 36. New vs. Old • Scumblr 1.0 Tasks: Search Google Search Twitter Search Facebook • Example Scumblr 2.0 Tasks: 1. Get list of Stash Repos 2. Run Brakeman on Rails Repos 3. Save the Results and Send out Notifications
- 37. Pulling it Together • Dirty Laundry integrates with all our security tools • Can track results based on a repo, a DNS name, an API endpoint, etc. • With Penguin Shortbread, can fit things together
- 38. Action • Enhanced the ability to track status • Added standard way to store/action vulnerability data • Workflowable provides easy mechanism to create JIRA tickets, send out notifications, etc.
- 39. Goal 2 Automated Security Controls 1. Select and run tools 2. Aggregate data 3. Take action
- 40. Goal 3 Tie Environment and Security Together 1. Understand vulnerabilities in context 2. Prioritize security services and remediation efforts 3. Enable linking security risks with their source 4. Identify weak links and look for improvements Coming Soon
- 41. Open Source • Netflix Open Source • Scumblr • Security Monkey • Penguin Shortbread (soon) • Spinnaker • Animator • More: https://netflix.github.io/ • Arachni www.arachni-scanner.com • Dependency Check https://www.owasp.org/index.php/ OWASP_Dependency_Check • FindSecBugs http://find-sec-bugs.github.io/ • Brakeman http://brakemanscanner.org/ • Bandit https://github.com/openstack/bandit
- 42. Thanks!