Securing and automating your application infrastructure meetup 23112021 b

Join Us:
https://www.linkedin.com
/company/application-
security-virtual-meetups
QR Link:

Erez Yashar
Director of Product Management

3
© Fortinet Inc. All Rights Reserved. utoesthesia

4
© Fortinet Inc. All Rights Reserved.
Agenda
• Application Deployment Evolution
• Monolithic Vs. Microservices
• Pros and Cons
• Uber case study
• Into CI/CD pipeline
• Pros and Cons
• Application Security Challenges
• The Fortinet Way

5
Application Evolution Deployment
https://cd.foundation/blog/2020/03/27/comparing-monolithic-pipeline-to-microservice-pipeline/

6

7
Monolithic Vs Microservice Applications
https://medium.com/hengky-sanjaya-blog/monolith-vs-microservices-b3953650dfd

8
Microservices Computing
Pros:
• Fast Service Provision - easy to build and deploy
• Increased agility - each individual can build a module and deploy a module independently
• Scalability - since your services are separate, you can more easily scale the most needed ones
Cons:
• Complexity – microservices can add complexity to an application delivery workflow
• Security - dynamic changes may leads to a security problems
• Performance – A microservice-based application may have to make multiple different API calls to
other microservices to load one UI screen

9

10
From Monolithic to Microservices - Uber
https://blog.dreamfactory.com/microservices-examples/
Here’s how Uber’s monolithic structure worked at
the time:
• Passengers and drivers connected to Uber’s
monolith through a REST API.
• There were three adapters – with embedded API
for functions like billing, payment, and text
messages.
• There was a MySQL database.
• All features were contained in the monolith.
Moving to Microservice architectural style:
• Assigned clear ownership of specific services to
individual development teams, which boosted the speed,
quality, and manageability of new development.
• Facilitated fast scaling by allowing teams to focus only on
the services that needed to scale.
• Ability to update individual services without disrupting
other services.
• Achieved more reliable fault tolerance.

11
Uber’s microservice architecture mid-2018
https://eng.uber.com/microservice-architecture/

12
Into CI/CD Pipeline
https://dzone.com/articles/learn-how-to-setup-a-cicd-pipeline-from-scratch
CI/CD Pipeline is a set of methods that enables developers to deliver code changes
more frequently to customers through the use of automation.

13
Into CI/CD Pipeline - Pros & Cons
• Pros:
• Speed of deployment
• Faster testing and analysis
• Smaller code changes
• Better and faster fault isolation
• Automatic deploy to production
• Tons of open source tools available
• Cons:
• Devops skills must be learned
• Steep learning curve to implement automation
• Big upfront investment
• Legacy systems rarely support CI/CD

Application Security Challenges

15
Attacks on Web Applications Increasing
“43% of breaches (in 2020) were
attacks on web applications,
more than double the results
from last year.”
Source: “2020 Data Breach Investigations Report: Official,”
Verizon Enterprise Solutions, https://enterprise.verizon.com/en-gb/resources/reports/dbir/

16
How often do your applications change?
Source: “2021 APPLICATION SECURITY REPORT”
Fortinet: https://www.fortinet.com/content/dam/maindam/PUBLIC/02_MARKETING/08_Report/report-cybersecurity-insiders-application-security-fortinet.pdf

17

18
Web Applications are Evolving and Expanding
Constant design/application changes requires constant validation to match
your changes in design/applications
Applications are Extremely Dynamic
 How do you keep security policies up to date?
 How to react to real-time events?
 Support Scalable solution to cope with performance growth
 How the changes affect application availability and security?
Application Anywhere
 Availability is crucial for any organization
 The Application MUST be accessible from anywhere
response (𝑓)

19
Web Application validation
DevSecOps teams need to validate every new deployment/New App version
• Fast release - less focus on security
• No full regression tests
• Auto testing (new libraries/services)
• Miss-configuration
• Vulnerable 3rd party dependencies
• Authentication validation

20
OWASP Top 10 - 2021
• Applications running in a serverless environment still execute code. If this code is
written in an insecure manner, it can still be vulnerable to application-level attacks.
• OWASP Top 10 report:
• Examines the differences in attack vectors, security weaknesses, and the business impact of
application attacks in the serverless world
• Suggests ways to prevent those attacks

22
Fortinet Security
Fabric
Broad
visibility and protection of the entire
digital attack surface to better
manage risk
Integrated
solution that reduces management
complexity and shares threat
intelligence
Automated
self-healing networks with AI-driven
security for fast and efficient
operations
Security-Driven
Networking
Zero Trust
Access
Adaptive Cloud
Security
FORTIOS
FortiGuard Threat
Intelligence
Open
Ecosystem
Fabric Management
Center
NOC SOC

23
Fortinet Application Security Solution
SAP Kubernetes Cluster
Application Connector
• Web Application Firewall
• User Authentication
• SSL Services
• Cloud Connector
• Machine Learning
Application Automation
• Autoscaling
• Auto Security
• Performance Boost
Web App
Key Benefits:
• Application Security & Availability
• Cloud Connector for visibility and dynamic changes
• Fabric Connector to multiple application for automation and
service scaling
• Multi Service solution - SLB, WAF, DDoS, ZTNA, GSLB,
API Protection and more…
• Automation actions based on application events
• Business continuity (Application Anywhere)
Action (𝑓)
Fabric Driven Application services
Adaptive Cloud
Security

24
Fortinet Application Security Suite
Application
Expansion App/Net protection
• Lift and shift from DC
• Connect applications
• Protect resources,
applications and data
against Apps threats
• Simplify hybrid / multi-
cloud deployments
Web Application
Firewall Protecting
organization-deployed
web applications &
APIs with Machine
Learning
Application delivery
Improve application
experience, security,
and availability based
on Application events
Embeds security
throughout container
lifecycle, builds CI/CD
pipeline, enhances
compliance to Security
best practices and
visibility into runtime
container activities
Penetration-testing-as-a-
service tool based upon the
OWASP Top 10 list of
application vulnerabilities,
which can be used to find
issues before they’re
exploited.
FortiGate FortiWeb FortiADC FortiCWP FortiPenTest
Fabric API Extended Fabric
Ecosystem
Automation Action

25
Open Fabric Ecosystem -Application Security
470+ Best-in-Class integrated solutions for comprehensive protection

A P P L I C A T I O N
S E C U R I T Y
I N C O N T A I N E R
N I S H A N T R A J P U T

$ W H O A M I N I S H A N T R A J P U T
S E N I O R S E C U R I T Y E N G I N E E R @ S N O W F L A K E
28
Disclaimer : Presentation is intended for Education purpose only. Statements of fact and opinions expressed are my own. No affiliation to the related practices of current or past organizations

A G E N D A
• C O N T A I N E R S O V E R V I R T U A L
M A C H I N E S
• T R O U B L E A R E A S
- T R U S T I S S U E S W I T H C O N T A I N E R S
• M I T I G A T I O N - A S O L V A B L E W A Y
- C O N T A I N E R I S O L A T I O N
- C O N T A I N E R I M A G E S E C U R I T Y
- V U L N E R A B I L I T Y C H E C K S I N I M A G E S
- S E C R E T S & N E T W O R K S E C U R I T Y
• D O C K E R B E S T P R A C T I C E S

C O N T A I N E R S O V E R V I R T U A L
M A C H I N E S

V I R T U A L M A C H I N E S
• Compute Resource : Advantage of
Software over Physical Hardware
• Platform Independent programming
environment
Advantages :
• Multiple OS environments on a single
physical server
• Integrated Disaster Recovery &
Application Provisioning options
31

F R O M A N
O N - P R E M
T O V M
D E P L O Y M E N T
M A C H I N E
32

F I R E P O W E R O F
C O N T A I N E R S
• Compute Resource : Works on OS
Virtualization
• Include only the binaries, libraries and other
required dependencies, and the apps
• Containers : On the same host share the
same operating system kernel, making
containers much smaller than virtual
machines
• Boot faster, Maximize Server
Resources, and make delivering Apps easie
r
33

I N N E R L O O P
O F
D E V E L O P M E N
T
34

O U T E R L O O P
D E V E L O P M E N T
35

T R U S T I S S U E S W I T H
C O N T A I N E R S

I S S U E S W I T H
C O N T A I N E R S
:
T H E
T H R E A T
M O D E L
W A Y
• Vulnerable App Code
• Badly Configured Container Images
• Build Machine Attacks
• Supply Chain Attacks
• Badly Configured Containers
• Vulnerable Hosts
• Exposed Secrets
• Insecure Networking
38

M I T I G A T I O N : A S O L V A B L E W A Y

C O N T A I N E R I S O L A T I O N

D O C K E R K E R N E L N A M E S P A C E
• Docker makes use of kernel namespaces to
provide the isolated workspace called
the container.
• On spinning a Container, Docker creates a
set of namespaces for that container.
• Provide an extra layer of isolation.
• Each aspect of a container runs in a separate
namespace and its access is limited to that
namespace.
• E.g : Network Namespace, Cgroup
Namespace, etc
41

C O N T A I N E R I M A G E S
S E C U R I T Y

M E A S U R E S
• Identifying Images -
<Registry URL>/<Organization or user
name>/<repository>@sha256:<digest>
• Image Integrity
• Build time Security –
- Dockerfile to Image formation
• Image Storage Security
- Running in own registry
- Signing Images
43

V U L N E R A B I L I T Y C H E C K S I N
I M A G E S

V U L N E R A B I L I T Y C H E C K S D U R I N G
D E V
• Application Level Vulnerabilities –
Packages and Patches
• Out of Date Sources
• Won’t Fix Vulnerabilities
• Subpackages Vulnerabilities
• Zero-Days
45

C O D E
B U I L D
F A I L U R E
I N
A W S

S E C R E T S & N E T W O R K
S E C U R I T Y

S E C R E T S S T O R A G E
• Storing the Secrets in the
Container Image
• Passing over the network
• Passing the Secrets in
Environment Variables
• Passing Secrets through files
48

N E T W O R K C H E C K S
• Container Firewalls
• Network Isolation
• Network Policy Best Practices
• Default Deny
• Default Deny Egress
• Restrict Pod to Pod Traffic
• Restrict Ports
49

D O C K E R B E S T
P R A C T I C E S

D O C K E R B E S T P R A C T I C E S
• Prefer Minimal Base Image
• Least Privilege
• Sign & Verify Images to mitigate MiTM attacks
• Find, Fix & Monitor for Open Source Vulnerabilities
• No Sensitive Info in Docker Images
• Use fixed tags for immutability
• Use scanning tools like Claire, Twistlock, etc
• Securing the network
51

W I S E W O R D S O F T H E S A I N T S : S E C U R I T Y
P R I N C I P L E S
• Least Privileges
• Defense in Depth
• Reduce Attack Surface
• Segregation of Duties

T H A N K Y O U !
Q U E S T I O N S ?

Vulnerable VS Code
extensions are now at your
front door
Application Security Meetup 🌍
By Raul Onitza-Klugman, Security Researcher@ Snyk

Why VS Code?
VS Code? Developers?

SECURITY TESTING
Security is shifting left...
DEVELOPERS

Raul Onitza-Klugman
● Security Researcher@ Snyk
● Studied Electrical Eng. + Physics
● Started as C/C++ embedded dev
● Love web, binary and growing vegetables

https://pypl.github.io/IDE.html
most popular ides

Visual Studio Code
https://marketplace.visualstudio.com/
Extension marketplace
Used by more than 4k
companies worldwide
Industry Adoption
(out of 24M worldwide)
One of the most popular
code editors
~14M Active Users

Editor Extensions
Turn this Into this!
Out-of-the-box features Add langs, debuggers, parsers...

Extension Basics
Essentially : Extension = NPM + VS Code Extension API
1. Javascript/Typescript and package.json manifest
2. https://code.visualstudio.com/api
3. Packaged in *.vsix file - Zip archive
4. Most of them are open-source (and on Github)!

Lets see some examples shall
we?

Instant Markdown
127,538 installs

Securing and automating your application infrastructure meetup 23112021 b

GET http://localhost:8888/index.html
/Users/kirill/server/public-html/index.html

GET http://localhost:8888/?/../../../../../etc/passwd
/Users/kirill/server/public-html/?/../../../../../etc/passwd
/etc/passwd

http://localhost:8888/../../../../etc/passwd
http://localhost:8888/?/../../../../etc/passwd
query parameters
path
path

Why should I care about a
local web server?!

VS Code
Instant Markdown extension
Preview HTTP server
Chrome
Markdown preview
Path Traversal

Cross-Site Request 🔥
Browser
http://localhost:8888/
Markdown preview
http://evil.com
GET

Browser
http://localhost:8888/
Markdown preview
GET

How to bypass CORS?
Top 10 answers from Google:
“you need XSS on the website you wanna hack”

GET
GET
http://evil.com http://localhost:8888/
❌
http://localhost:8888/?xss= http://localhost:8888/
✅
✅ GET/POST
<payload>

1. Open
2. Download XSS Payload
payload.html <iframe>
http://localhost:8888/?/../../../Download
s/payload.html
http://localhost:8888/?/../../..
/../../../etc/passwd
4. (same-origin)
GET
❗3. XSS happens here❗
localhost
CORS disabled
<script>...</script>

LaTeX Workshop
1,449,449 installs

LaTeX Workshop is an extension for Visual Studio Code, aiming to
provide core features for LaTeX typesetting with Visual Studio Code.

VS Code
LaTeX Workshop extension
PDF preview HTTP
Chrome
PDF preview page
Websocket server http://evil.com

Handles a click by a
URL in PDF file

file:///System/Applications/Calculator.app/Contents/MacOS/Calculator
🤔

Ephemeral port bruteforce
(about 16,000 ports)

1. Open
localhost
WebSocket
doesn’t come
with CORS
built-in
<script>...</script>
Port #1
Port #2
Port #n
2. Bruteforce port
...
OS Command
3. Execute command

COMMAND INJECTION
execute
commands

Marketplace
ssh
.env
source code
configs
THE ORG
Private Data
Persistence
Supply Chain
1 - Exploit
3 - Compromise
2 - Obtain
Installs (vulnerable)
extension

Mitigations
Similar hygiene to 3rd-party packages:
1. Developer
○ Use only maintained and popular extensions
○ Don’t use extensions with unfixed security issues
2. Extension maintainer
○ Use security best practices when developing your extensions
○ Test your code with a vulnerability scanner
○ Fix disclosed vulnerabilities in a timely fashion

105
NOC/SOC Challenges
Challenges
DO MORE
WITH LESS
COMPLIANCE
REPORTING
MANUAL
OPERATIONS
SINGLE PANE
VISIBILITY
DEPLOYMENT
FLEXIBILITY
INTEGRATE WITH
EXISTING TOOLS

106
Fortinet
Security
Fabric
Broad
visibility and protection of the entire
digital attack surface to better
manage risk
Integrated
solution that reduces management
complexity and shares threat
intelligence
Automated
self-healing networks with AI-driven
security for fast and efficient
operations
Security-Driven
Networking
Zero Trust
Access
Adaptive Cloud
Security
FORTIOS
FortiGuard Threat
Intelligence
Open
Ecosystem
Fabric Management
Center
NOC SOC
02012021

Fabric-Ready and Fabric
Connectors

108
Fabric-Ready Partner Program - objectives
• Increase Fortinet brand value via partnerships with industry-leading partner companies
• Demonstrates Openness of Security Fabric to analysts & industry
• Revenue generation – sell with, sell through partners
• Reduce sales timeline with pre-validated integrated solutions
• Updated partner list:
• https://www.fortinet.com/partners/partnerships/alliance-partners.html

109
Types of partner integrations
Fabric Connectors
• Fortinet develops specific code in our
products
• Explicitly referenced in our GUI/CLI
• Mainly based on APIs
• Feature development made by FTNT
• Validation usually require testing with
the partner
Fabric-Ready (Fabric APIs)
• Partner developed solutions to integrate
with FTNT products
• Based on existing APIs and/or standard
protocols(RADIUS, SYSLOG, SSH, etc)
• (usually) no specific code development
from FTNT side
• FTNT tests solution to assure it works
as expected

110
• AWS
• API
• Azure
• API
• Cisco ACI
• API
Fortinet Fabric Connectors
• SPLUNK
• SYSLOG
• Arista
• APIs (standard FOS APIs)
Fabric-ready Integrations
Fabric-ready vs Fabric Connectors - examples
Internal and Confidential – Do not distribute

External Fabric Connectors
Connectors to partner products and solutions

112
External Fabric Connectors - types
Fabric Connector Type Description
Public SDN Integration with multi-cloud platforms (PaaS, IaaS) for dynamic policy objects
Private SDN Integration with SDN platforms (private, public) for dynamic policy objects
IaaS Visibility Fabric visibility into cloud infrastructure service resources
Automation Action Integration of Fabric Automation rules to automatically trigger actions based on events
ITSM Integration with IT service management and incident response
Threat Feeds Integration to obtain external sources of threat feeds and automate security remediation for workloads
Endpoint/Identity
Integration to leverage existing directory & identity servers to centrally manage user information and
automatically apply security protection profiles assigned to each user
Endpoint CVE Integration to invoke auto quarantine of compromised endpoints when IOC is suspected
Storage Integration to store FAZ logs directly into Cloud Storage locations

113
400+ Best-in-class integrated solutions for comprehensive protection
And many more…
Note: Logos are a representative subset of the Security Fabric Ecosystem
Fabric Connectors
Fabric DevOps
Fabric APIs
Extended Ecosystem
Wireless
Switching
Firewalls
Endpoint
Security
Open Ecosystem
Fortinet-developed deep integration automating security operations and policies
Partner-developed integration using Fabric APIs providing broad visibility with end-to-end solutions
Community-driven DevOps scripts automating network and security provisioning, configuration, and orchestration
Integrations with threat sharing initiatives and other vendor technologies

• Thank You!
• Questions?
• To be continued…
Join Us:
https://www.linkedin.com/company/ap
plication-security-virtual-meetups

Securing and automating your application infrastructure meetup 23112021 b

Recommended

More Related Content

What's hot (20)

Similar to Securing and automating your application infrastructure meetup 23112021 b (20)

More from lior mazor (20)

Recently uploaded (20)

Securing and automating your application infrastructure meetup 23112021 b