Secure DevOps with ThreadFix 2.3

© 2015 Denim Group – All Rights Reserved
Secure DevOps with ThreadFix 2.3!
!
Dan Cornell!
@danielcornell
This presentation contains information about DHS-funded research:
Topic Number: H-SB013.1-002 - Hybrid Analysis Mapping (HAM)
Proposal Number: HSHQDC-13-R-00009-H-SB013.1-002-0003-I

2
ThreadFixAccelerate Software Remediation
ThreadFix is a software vulnerability aggregation and
management system that helps organizations aggregate
vulnerability data, generate virtual patches, and interact with
software defect tracking systems.

What Can We Do With ThreadFix?
•  Create a consolidated view of your applications and vulnerabilities
•  Prioritize application risk decisions based on data
•  Translate vulnerabilities to developers in the tools they are already
using
3

Create a consolidated
view of your
applications and
vulnerabilities
4

Application Portfolio Tracking
•  Track multiple “Teams”
•  Arbitrary distinction – geography, line of business, common tools and practices
•  Track multiple “Applications” per “Team”
•  Unit of scanning or testing
•  Track Application metadata
•  Criticality, hosted URL, source code location
•  Reporting can be done at the organization, Team or Application level
5

Demo: Application Portfolio Tracking
6

Fill ThreadFix Up With Vulnerability Data
•  Manual file upload
•  REST API
•  https://github.com/denimgroup/threadfix/wiki/Threadfix-REST-Interface
•  Command Line Interface (CLI)
•  https://github.com/denimgroup/threadfix/wiki/Command-Line-Interface
•  JAR can also be used as a Java REST client library
•  Jenkins plugin
•  Contributed from the ThreadFix community (yeah!)
•  https://github.com/automationdomination/threadfix-plugin
7

What Does ThreadFix Do With Scan Results
•  Diff against previous scans with same technology
•  What vulnerabilities are new?
•  What vulnerabilities went away?
•  What vulnerabilities resurfaced?
•  Findings marked as false positive are remembered across scans
•  Hopefully saving analyst time
•  Normalize and merge with other scanners’ findings
•  SAST to SAST
•  DAST to DAST
•  SAST to DAST via Hybrid Analysis Mapping (HAM)
8

Demo: Vulnerability Merge
9

Hybrid Analysis Mapping (HAM)
•  Initial research funded by the US Department of Homeland Security
(DHS) Science and Technology (S&T) Directorate via a Phase 1 and
(now) Phase 2 Small Business Innovation Research (SBIR) contract
•  Acronyms!
•  Initial goal: SAST to DAST merging
•  Results: That, plus other stuff
10

Demo: Merging Static and Dynamic Scanner Results
11

Demo: De-Duplicate Dynamic RESTful Scanner Results
12

Prioritize application
risk decisions based on
data
13

Vulnerability Filtering
•  Filter vulnerability data
•  Scanner, scanner count
•  Vulnerability type
•  Path, parameter
•  Severity
•  Status
•  Aging
•  Save filters for future use
14

Demo: Vulnerability Filtering
15

Reporting
•  Trending
•  Progress by Vulnerability
•  For program benchmarking
•  Portfolio Report
•  For resource prioritization
•  Comparison
•  For scanner/technology benchmarking
16

Demo: Reporting
17

Translate vulnerabilities
to developers in the
tools they are already
using
18

Mapping Vulnerabilities to Defects
•  1:1 mapping is (usually) a horrible idea
–  500 XSS turned into 500 defects?
–  If it takes longer to administer the bug than it does to fix the code…
•  Cluster like vulnerabilities
–  Using the same libraries / functions
–  Cut-and-paste remediation code
–  Be careful about context-specific encoding
•  Combine by severity
–  Especially if they are cause for an out-of-cycle release
•  Which developer “owns” the code?
19

Defect Tracker Integration
•  Bundle multiple vulnerabilities into a defect
•  Using standard filtering criteria
•  ThreadFix periodically updates defect status from the tracker
20

Demo: Defect Tracker Integration
21

Important Links
•  Main ThreadFix website: www.threadfix.org
•  General information, downloads
•  ThreadFix GitHub site: www.github.com/denimgroup/threadfix
•  Code, issue tracking
•  ThreadFix GitHub wiki: https://github.com/denimgroup/threadfix/wiki
•  Project documentation
•  ThreadFix Google Group:
https://groups.google.com/forum/?fromgroups#!forum/threadfix
•  Community support, general discussion
22

Secure DevOps with ThreadFix
•  What does your pipeline look like?
http://www.slideshare.net/mtesauro/mtesauro-keynote-appseceu
http://www.slideshare.net/denimgroup/rsa2015-blending-
theautomatedandthemanualmakingapplicationvulnerabilitymanagementyourally
https://blog.samsungsami.io/development/security/2015/06/16/getting-security-up-to-
speed.html

Demo: Scheduling a Recurring Scan

Demo: On Demand Scan Agent Task

Demo: Kicking off a Scan via Command Line

Demo: Getting Notified of Policy Violations

Demo: Jenkins Plugin
https://wiki.jenkins-ci.org/display/JENKINS/ThreadFix+Plugin

Contributor Spotlight

Pearson Links
Aaron Weaver and Matt Tesauro’s presentations at OWASP AppSecEU
2015:
•  http://www.denimgroup.com/blog/denim_group/2015/06/threadfix-pearson.html
Matt Tesauro:
•  Go client library:
•  https://github.com/mtesauro/tfclient
•  Checkmarx/ThreadFix integration
•  https://github.com/mtesauro/tfCheckmarxUpload
Adam Parson:
•  Python client library:
•  https://github.com/aparsons/threadfix_api

Pearson Notes
Many thanks to Pearson for their sponsorship of:
•  Defect Tracker Default Credentials
•  Deep Linking After Authentication
•  Scan Details REST Call
•  Scan List REST Call
•  Unmapped Findings Data in Scan Upload REST Response
•  Full URL in Vulnerability Tree
•  Custom CWE Remediation Advice on Defects
•  Set CWE Text REST Call, and CWE Text in Vuln Search
•  Multi-File Scan Upload
•  Multi-File Scan Upload Endpoint
•  Scanner-Specific Filters
•  Tag REST Calls
•  REST Application Update Call
•  REST Team Update Call
•  AppScan Enterprise Support

Samsung SSIC Links
•  Samsung blog post about their ThreadFix architecture:
https://blog.samsungsami.io/development/security/2015/06/16/getting-security-up-to-speed.html
Many thanks to Samsung SSIC for their donation of:
•  Default system for defect submissions
•  Scheduled email reports for new vulnerabilities
•  Defect description more extensive and flexible with velocity template
engine
•  Ability to submit defects from vulnerability details page

I Want to Contribute!
•  Great!
•  Let us know what you’re interested in
•  Sign a contributor agreement
•  Contribute!
Main Contributor Page:
https://github.com/denimgroup/threadfix/wiki/ThreadFix-Development-Community

Questions / Contact Information
Dan Cornell
Principal and CTO
dan@denimgroup.com
Twitter @danielcornell
(844) 572-4400
www.denimgroup.com
www.threadfix.org
34

Secure DevOps with ThreadFix 2.3

Recommended

More Related Content

What's hot (20)

Viewers also liked (10)

Similar to Secure DevOps with ThreadFix 2.3 (20)

More from Denim Group (16)

Recently uploaded (14)

Secure DevOps with ThreadFix 2.3