Scaling AppSec through Education

Copyright © 2020-2021 Secure Delivery. DEF CON 29 AppSec Village.
@rewtd
Scaling AppSec
through Education
DEF CON 29 - AppSec Village

@rewtd
About Secure Delivery
We provide a world-class, predictable and
proven programme of AppSec capability
improvement that measurably reduces
risk and scales as part of software delivery
Our structured approach to delivering
actionable AppSec knowledge is robust
and forms the foundation of OWASP’s
Open Application Security Curriculum.

@rewtd
Grant Ongers (rewtd)
Who I am.
CTO and co-founder of Secure Delivery
Current OWASP Global Foundation board member, I
am a ﬁrm believer in security enabling delivery not
blocking it.
Well-known in the international InfoSec community
(it's hard to forget the beard!), 10+ years of experience in
Dev, 20 years in Ops and 30 years in Sec (mostly white
hat) means I believe there's no such thing as
DevSecOps - just DevOps done right.
OWASP Open AppSec Curriculum project lead
OWASP Cornucopia project lead

@rewtd
Scaling Application Security in Large
Organisations

@rewtd
What is Application Security?

@rewtd
Application Security is an intrinsic quality
of the software systems you’re building and
of the processes used to deliver them.
Product

@rewtd
PERFORMANCE
EFFICIENCY
COMPATIBILITY USABILITY RELIABILITY SECURITY MAINTAINABILITY PORTABILITY
TIME BEHAVIOUR
RESOURCE
UTILISATION
CAPACITY
CO-EXISTENCE
INTEROPERABILITY
LEARNABILITY
OPERABILITY
USER ERROR
PROTECTION
AVAILABILITY
FAULT
TOLERANCE
RECOVERABILITY
MATURITY
INTEGRITY
NON-REPUDIATION
ACCOUNTABILITY /
AUTHENTICITY
CONFIDENTIALITY
ANALYSABILITY
MODIFIABILITY
MODULARITY /
REUSABILITY
TESTABILITY
INSTALLABILITY
ADAPTABILITY
REPLACEABILITY
ISO 25010
FUNCTIONAL
SUITABILITY
FUNCTIONAL
CORRECTNESS
FUNCTIONAL
APPROPRIATENESS
FUNCTIONAL
COMPLETENESS
ACCESSIBILITY
Mainly things that people can see Mainly things that people can’t see

@rewtd
Security through change
BEING
SECURE
DELIVERING
AT PACE
OUR RISK
APPETITE

@rewtd
A security incident is a trailing
indicator of low product quality.

@rewtd
The four metrics that matter
Higher performing organisations produce, and derive more value from,
higher quality software delivered by their high-performing technology
functions.
Analysis1
shows there are four metrics that are strong leading indicators of
high performing organisations:
1. Lead time
2. Deployment frequency
3. Mean time to restore
4. Change fail percentage
1
Forsgren, N., Kim, G. and Humble, J., 2018. Accelerate. IT Revolution Press.
Maintainability,
Portability,
Reliability,
Compatibility,
Security?

@rewtd
All the problems are in your code
Kuhn, D., Raunak, M. and Kacker, R. (2016).
An Analysis of Vulnerability Trends. NIST.
TRADITIONAL FOCUS
Almost!

@rewtd
✓ Think about the performance impact of any changes during (sprint) planning and design
✓ Plan your overall system architecture with performance in mind
✓ Ensure everyone knows how to write performant code in the languages and frameworks you’re using
✓ Hire people with domain expertise in performance to train and work with teams and the wider business
✓ Peer-review code changes for the inevitable human mistakes that could affect performance
✓ Share known-performant code and internal libraries across teams
✓ Make performance a key consideration in the selection of any third-party services you depend on
✓ Automatically test all changes for performance regressions on every commit so developers can catch and
fix them early
✓ Prioritise performance fixes in your backlog / development cycles
✓ Inject comprehensive telemetry into your systems to closely monitor performance in production
✓ Investigate & fix performance incidents in production and widely publish findings across the organisation
to improve learning
✓ Have responsibility and accountability for performance with the people building the systems
Ensuring Performance In Your Systems

@rewtd
✓ Think about the security impact of any changes during (sprint) planning and design
✓ Plan your overall system architecture with security in mind
✓ Ensure everyone knows how to write secure code in the languages and frameworks you’re using
✓ Hire people with domain expertise in security to train and work with teams and the wider business
✓ Peer-review code changes for the inevitable human mistakes that could affect security
✓ Share known-secure code and internal libraries across teams
✓ Make security a key consideration in the selection of any third-party services you depend on
✓ Automatically test all changes for security regressions on every commit so developers can catch and fix
them early
✓ Prioritise security fixes in your backlog / development cycles
✓ Inject comprehensive telemetry into your systems to closely monitor security in production
✓ Investigate & fix security incidents in production and widely publish findings across the organisation to
improve learning
✓ Have responsibility and accountability for security with the people building the systems
Ensuring Performance In Your Systems
Security

@rewtd
Site Reliability Engineering
A proven way to ensure the reliability aspect of quality whilst moving quickly:
➔ Reliability experts building self-service platforms for product teams to
stay out of the delivery critical path and automating their own work
heavily to reduce “toil”
➔ Launch Engineers working closely with product teams to educate and set
them up for success with reliability from product launch
➔ Service Level Objectives quantify reliability requirements per-product
using a Service Level Indicator (uptime)
➔ “Hand the pager back” operating model provides backpressure on
development activities when a Service Level Objective is no longer met
Can we apply this
method to security?

@rewtd
Product Security Engineering...

@rewtd
Mapping SRE to Security
Site Reliability Engineering Product Security Engineering
Providing self-service platforms, automating
own work heavily ✓
Working closely with product teams and
educating ✓
Service Level Objective Service Level Objective
Service Level Indicator Service Level Indicator
“Hand the pager back”, backpressure on
development activities
“Express route” to production
“Information radiators”
^
Security
^

@rewtd
What to measure and track
● Teams, products & the parts that make up products
● A clear, direct measure of security quality
● Measures across ways of working
● The four metrics that matter
Who is contributing to
what?
Get this from the code See the list of practices:
peer reviews, training,
check JIRA for age of
security tickets, etc.

@rewtd
SLOs at scale
Up-to-date on
security
training
Predictable,
security-related
project events
Delivery process
maturity &
capabilities
Direct measure of
security quality
Overall security
level objective
agreed

@rewtd
Providing backpressure is essential
● Make security capabilities of teams visible across the org:
dashboards, “information radiators”
● “Express Route” to production for teams meeting all
organisational requirements, additional checks on changes
from teams not assuring security themselves
● Make quality part of the delivery operating model. Clear
RACI on all aspects of product quality—product owners are
accountable for product quality and delivery teams are
responsible for delivering the level of quality the product
requires

@rewtd
Security Defects and How to Find Them
DESIGN CODE BUILD AUTOMATED
TESTS
MANUAL
TESTS
PRODUCTION
OPS
Secure software development training
Agile threat modelling
Static application security testing
Code inspections
Dynamic application security testing
Interactive application security testing
Mobile application security testing
FOSS/COTS dependency checks (SCA)
Infrastructure scanning
Penetration tests
Active monitoring
Runtime Application Self-Protection
https://youtu.be/clEu-sFKUDs

@rewtd
Secure Software Development Training

@rewtd
OWASP Application Security
Curriculum
● Open source initiative
○ OWASP, of course
● Based on OWASP standards
○ OWASP Top 10
○ OWASP Cornucopia
○ OWASP Application Security Veriﬁcation Standard (ASVS)
○ OWASP Software Assurance Maturity Model (SAMM)
Developed in the open, made
available to all and for
anyone to contribute to
Standing on the shoulders
of giants {

@rewtd
Application Security Fundamentals
- OWASP Top 10

@rewtd
Why use the OWASP Top 10, it’s obviously
not meant to be a standard? But it has
become the defacto standard - since
adoption by the PCI Data Security Standard
and it’s a good start
The Top 10 Team
have said so *
*
Top 10 Projects Team https://owasp.org/www-project-top-ten/2017/Foreword.html

@rewtd
About the Top 10

@rewtd
The Top 10 Details: Issue Types
BUILD
INPUT
VALIDATION
ACCESS
Input Validation Errors
Injection Attacks
XML External Entities (XXE)
Cross Site Scripting (XXS)
Insecure Deserialization
Access Errors
Broken Authentication
Sensitive Data Exposure
Broken Access Control
Building Errors
Security Misconﬁguration
Insufﬁcient Logging and Monitoring
Using Components with Known
Vulnerabilities

OWASP FOUNDATION owasp.org
ASC Foundation: Introduction to AppSec
Who is this aimed at?
What are we covering?
When are you able to take this
course?
Why are we doing this?
All of product delivery from Product
Owner to Engineer.
The basics of AppSec and the Top 10.
Whenever: This is foundational, there
are no prerequisites to taking it.
To provide everyone with the context
and basic understanding.

A2: Broken Authentication
// Very silly session IDs
https://example.com/userApp?sessionId=14632
// Default credentials
if (userName == 'admin' && password == 'letmein') { }
Application functions related to
authentication and session management
are often implemented incorrectly.
This allows attackers to compromise
passwords, keys, or session tokens, or to
exploit other implementation ﬂaws to
assume other users’ identities temporarily
or permanently.
Prevention:
• Strong passwords & MFA. Use the
updated NIST guidance, it’s good now!
• Block or heavily rate limit repeated
authentication attempts
• Expire inactive sessions
• Never implicitly trust
Strong identity is the foundation of all security
It’s not all about user identity. Machine identity also very important.
Those of you building cloud-based services need to enforce strong
authentication EVERYWHERE. Know about Zero Trust. Work towards
it. NEVER implicitly trust a request because of its origin.
Cryptographically strong identity EVERYWHERE. Direct
Connect/ExpressRoute/Cloud Interconnect are EVIL.
How about for internal / admin services (do you auth properly even
there?!)

OWASP FOUNDATION
TM
OWASP
Application Security Curriculum
https://owasp.org/www-project-application-security-curriculum/
https://github.com/OWASP/Application-Security-Curriculum
Find it here:

@rewtd
Application Security Intermediate
- OWASP Cornucopia

@rewtd
Why use Cornucopia? Well, it encourages
secure-by-design thinking, for developers,
and because it simpliﬁes issues described in
the Top 10, while making them more
generically applicable.
Kind of the
OWASP Top 5 *
*
Cornucopia Project Lead Grant Ongers - https://youtu.be/MnHCZozPHp4?t=995

@rewtd
About Cornucopia
https://youtu.be/BZVoQurTEMc
Twitter

@rewtd
Cornucopia Details: Learning Areas

@rewtd
Cornucopia Details: Authentication
Verifying you are who who say you
are, this is the basis of any auth
system and the part that’s most
often attacked.

@rewtd
Cornucopia Details: Authorization
Verifying that you are permitted to
do what you are attempting to do,
this covers the realm of privilege
escalation.

@rewtd
Cornucopia Details: Session Management
Checking that Auth happens
regularly. Not every moment, not
every action but often enough. The
balance being all important.

@rewtd
Cornucopia Details: Cryptography
Whether this is encryption, or
hashing. Whether it’s on the wire, or
on disk, this is about protecting
secrets.
Really?

@rewtd
Cornucopia Details: Data Validation
Validating inputs and encoding
outputs. This basic hygiene when it
comes to allowing users to interface
with your application.

@rewtd
Cornucopia Details: Miscellaneous
The trump suite that contains all of
the general nasties you can imagine.

@rewtd
Cornucopia to Application
Security Curriculum
● Set up and play the game with developers
○ Guide them through the cards
● Encourage the cards use each sprint
○ Tagging stories in Jira
○ Retaining the score sheet
Awkward! Developers don’t
want AppSec folks there
1. Covers the “are they?”
2. Covers the “auditor asked”
Twitter

@rewtd
Application Security Tertiary Education
- OWASP ASVS

@rewtd
Why use the OWASP ASVS? It is a standard,
it can be (and is) tested against, and it spells
out the requirements for a good product,
The Top 10 Team &
the ASVS Team have
said so *
*
ASVS Project Team https://owasp.org/www-project-application-security-veriﬁcation-standard/

@rewtd
ASVS Details: Suitability

@rewtd
ASVS Details: Applicability

@rewtd
ASVS Details: Learning Areas
Architecture
43 items
Authentication
57 items
Session Management
20 items
Access Control
10 items
Validation
30 items
Stored Cryptography
16 items
Error Handling and
Logging
13 items
Data Protection
16 items
Communications
8 items
Malicious Code
10 items
Business Logic
8 items
File and Resources
15 items
API and Web Service
15 items
Conﬁguration
24 items
286 total!

@rewtd
● Each ASVS Requirement is broken down:
○ Terms
○ Actions
● Each Term is mapped to a Unit
○ The weighting for each term is determined
● Each Action is Weighed
○ Bloom’s Taxonomy level (1 - 6)
ASVS to AppSec Curriculum
Yes, All 286 of them!
It’s slow process

@rewtd
AppSec Curriculum: Bloom’s
Taxonomy
Theoretically could be a 6,
but we’ve seen none so far
Generally for AppSec
(in all cases we’ve seen)
2 has been the lowest

@rewtd
1.4.5 - Verify that attribute or
feature-based access control is used
whereby the code checks the user's
authorization for a feature/data item rather
than just their role. Permissions should still
be allocated using roles.
unit: 'Authorization'
terms:
- 'feature-based access control'
- 'role'
- 'user'
- 'Permissions'
level: 2
unit: 'Application Development'
terms:
- 'feature'
- 'data item'
- 'the code'
level: 2
notes: 'The essence of this requirement seems to
be that authorization checks consider the
combination of all role/group/user level
permissions assigned, NOT just a single role
assignment. Suggest a rewording to make the
requirement clearer.'
TODO: create
https://www.owasp.org/www-community/controls/feature-based-access-control/
with info from:
Kim, Dae-Kyoo & Kim, Sangsig & Lu, Lunjin & Kim, Suntae & Park, Sooyong.
(2011). A feature-based approach for modeling role-based access control
systems. Journal of Systems and Software. 84. 2035-2052.
10.1016/j.jss.2011.03.084.
Actions

@rewtd
Application Security Industry Training
- OWASP SAMM

@rewtd
Why use OWASP SAMM? Well, to start
with it’s prescriptive, rather than
descriptive. It also complements the ASVS.
SAMM is often compared
with BSIMM for this
distinction *
*
SAMM Projects Team https://owaspsamm.org/blog/2020/10/29/comparing-bsimm-and-samm/

@rewtd
SAMM Details: Applicability
5
3@
3@ (90 total)
2@

@rewtd
SAMM Details: Learning Areas
Governance
Strategy & Metrics
Policy & Compliance
Education & Guidance
Design
Threat Assessment
Security Requirements
Secure Architecture
Implementation
Secure Build
Secure Deployment
Defect Management
Veriﬁcation
Architecture Analysis
Requirements-driven Testing
Security Testing
Operations
Incident Management
Environment Management
Operational Management
What an idea!

@rewtd
SAMM to AppSec Curriculum
● Each SAMM Activity is broken down:
○ Actions
○ Terms
● Each Action is Weighed
○ Blooms Taxonomy level (2 - 6)
● Each Term is mapped to a Unit
○ The weighting for each term is determined
Only 90 this time!
Still takes a long
time!

@rewtd
Implementation | Secure Build | Build Process
Maturity Level 1
Q: Do you have solid knowledge about
dependencies you're relying on?
Define the build process, breaking it down into a set of clear instructions to either be followed by a person or
an automated tool. The build process definition describes the whole process end-to-end so that the person or
tool can follow it consistently each time and produce the same result. The definition is stored centrally and
accessible to any tools or people. Avoid storing multiple copies as they may become unaligned and outdated.
The process definition does not include any secrets (specifically considering those needed during the build
process).
Review any build tools, ensuring that they are actively maintained by vendors and up-to-date with security
patches. Harden each tool’s configuration so that it is aligned with vendor guidelines and industry best
practices.
Determine a value for each generated artifact that can be later used to verify its integrity, such as a signature
or a hash. Protect this value and, if the artifact is signed, the private signing certificate.
Ensure that build tools are routinely patched and properly hardened.
module: ‘Release and Deployment'
terms:
- 'build process'
- 'process definition
- ‘build tools’
- ‘artifact’
level: 2
module: ‘Secrets Management'
terms:
- secrets
level: 2
Actions

@rewtd
Applying Training in Practice

@rewtd
Getting the AppSec Curriculum
● Foundations are out there and ready to be used.
● The Intermediate ASC requires learning a game.
● The Tertiary and Industry ASC needs your help.
ASC101 is available
Play the game!

@rewtd
The Future

@rewtd
Get Involved
Join the Project
https://owasp.org/www-project-application-security-curriculum/
https://github.com/OWASP/Application-Security-Curriculum
Sponsor the Project
https://owasp.org/www-policy/operational/grants
Give us your Feedback
grant.ongers@owasp.org
twitter.com/rewtd
@rewtd on Discord

@rewtd
Answer the Survey!
https://t.co/SiqeCBfg4D

@rewtd
Thank you!
We hope you’ve gotten a lot out of today’s
session.
Any questions or feedback just send an email
to feedback@securedelivery.io; we’re always
looking to improve on what we do.

Scaling AppSec through Education

Recommended

More Related Content

What's hot (20)

Similar to Scaling AppSec through Education (20)

Recently uploaded (20)

Scaling AppSec through Education