Take Control: Design a Complete DevSecOps Program

© 2017 WhiteHat Security, Inc.
Take Control:
Design a Complete DevSecOps
Program
Siamak Pazirandeh
Chief Architect
WhiteHat Security Inc.

© 2017 WhiteHat Security, Inc. 2
Siamak Pazirandeh
Chief Architect
Founding Engineer for over 14 years at
WhiteHat Security Inc. Specialized in
DAST (Dynamic Application Security
Testing), scalability, and deployment
automation.

About WhiteHat Security
150+ TOP SECURITY RESEARCHERS
Santa Clara
Houston
Belfast

Gartner, 01 February 2017, “Market Insight: Security Market Transformation Disrupted by the Emergence
of Smart, Pervasive and Efficient Security”, Elizabeth Kim, Deborah Kish, Avivah Litan, Ruggero Contu,
Perry Carpenter, Sid Deshpande, Lawrence Pingree, Eric Ahlm, Jacqueline Heng, Dale Gardner
By 2020, 60% of digital businesses will suffer
major service failures due to IT security
teams' inability to manage digital risk.
It’s All About Risk
5

Earlier Security = Saving $$
6

Agenda
 What is DevSecOps?
 Basics of a Security Program
 Adding Security Checks into your DevOps Chains
 Example Scenarios
7

Agenda
 What is DevSecOps?
 Adding Security Checks into your DevOps chains
 Example scenarios
8

Forces behind the DevSecOps movement
 Agile development dictates fast pace
 IT managed Infrastructure needs to keep up
 Must automate as much as possible in : development, deployment,
and operational environment
9

DevSecOps
 IT teams responsible for Security
 Software iterates faster than IT can keep up
 DevSecOps : Weaves security into the fabric of your SDLC
 DevSecOps is to Security as DevOps is to IT
10

Agenda
 What is DevSecOps
 Basics of a Secure Development
11

The Challenge of Secure Software Development
• Security not the core competency for most
• Most organizations do not foster secure coding culture
• Most devs are not trained in Secure Coding practices
• Most devs are not supported well for Secure Coding
• Security often an after-thought
12

Basics of Secure Development
 Understand your business risk exposure
 What is your company’s SDLC and DevOps maturity level?
 What is your architectural complexity?
 What is your current security stance?
 Answer, Document, Review periodically
13

Basics of Secure Development
 Produce a supportive environment
 Customize security documentation to your tech-stack
 All tiers of an application (UI, APIs, Data-Access, Business Logic) need to be
developed with Security in mind
 Security practices need to be reinforced early and often
 Developer Training
 Come up with a Secure Development policy
14

Security Practice Checklist
 1. Verify for Security Early and Often
 2. Parameterize Queries
 3. Encode Data
 4. Validate All Inputs
 5. Implement Identity and Authentication Controls
 6. Implement Appropriate Access Controls
 7. Protect Data
 8. Implement Logging and Intrusion Detection
 9. Use Security Frameworks and Libraries
 10. Error and Exception Handling
15

Agenda
 What is DevSecOps
16

Reframing Security as a DevOps
Initiative
17

DevSecOps – The Beginning
So, what if we …
 Treat security testing like feature testing
 Incorporate security requirement and checks into SDLC
 Use available tooling to tie vulnerability scanning into DevOps
build chains
 Automate defect state management
18

Practice Security Throughout the SDLC
19

A Typical Development Cycle
Code
Repo
Code /
Developer
Run
Tests
Build
Artifacts
Object
Registry
Team
Integration
QA Integration Pipeline
Nightly
Stage

Incorporate Security Checks
Code
Repo
Run
Tests
2 Pull-Request:
Code Review
Static Analysis
Security Unit Tests
Build
Artifacts
Object
Registry
Team
Integration
Integration QA Pipeline
Jenkins
(Nightly)
Stage
1 Pre-Commit:
Static Analysis
Security Unit Tests
IDE integration
3 Integration:
Dynamic testing
Result Verification
File Vulnerability Tickets
5 Release:
Production safe
Dynamic testing
File Vulnerability Tickets
WAF / RASP
Rules
6 WAF/RASP
Pass, merge
4 QA Integration:
Dynamic testing
Result Verification
Production

DevSecOps Trigger Points
1. Static scanning during development
2. Pull-Requests: Static scans of data-flow, semantic and configurational
3. Integration branch: Dynamic scanning
4. QA Release Candidate Integration: Dynamic scanning
5. Production Acceptance : Production-safe dynamic scanning
6. Post-Production: RASP (runtime application self-protection,) WAF (Web App Firewalls) both need
rules updated – automation is better
22

Scenario 1 – Small Organization/App
Assume a Single Repo with a few components :
 UI static JS client-side APP
 REST API
 Data Interface - SQL Layer
23

Scenario 1 – Small Application
Code
Repo
Code /
Developer
Run
Tests
PR hook
Build
Artifacts
Stage Prod
• Integration Tests
• Performance
• Security
1 Static analysis
IDE integration
Pre-commit
checklist
2 Static Analysis
Quick Feedback analysis
Verification a Challenge
3 Dynamic Analysis
Poll for results
24

Create a supportive dev environment
Code
Repo
Code /
Developer
Run
Tests
PR hook
Build
Artifacts
Stage Prod
• Performance
• Security
1 Static analysis
IDE integration
Pre-commit
checklist
2 Static Analysis
Quick Feedback analysis
3 Dynamic Analysis
Poll for results
25

Security Integrated tools for developers

“I fire up my IDE and triage my issues…”
• Search application vulnerabilities

• Step through vulnerability in code

• Review remediation guidance

• Ask for help from TRC

• Ask for help from TRC
• Apply Directed Remediation patch if available

Code
Repo
Code /
Developer
Run
Tests
PR hook
Build
Artifacts
Stage Prod
• Performance
• Security
1 Training,
Documentation
Dissemination
Code Reviews
2 Static Analysis
Quick Feedback
analysis
3 Dynamic Analysis
Poll for results
32

Code
Repo
Code /
Developer
Run
Tests
PR hook
Build
Artifacts
Stage Prod
• Performance
• Security
1 Training,
Documentation
Dissemination
Code Reviews
2 Static Analysis
Quick Feedback
analysis
3 Dynamic Analysis
Poll for results
33

Example:
API Integration to Trigger a Dynamic Scan
PUT
https://sentinel.whitehatsec.com/api/site/6/scan_schedule
{
"schedule":{
"name":"Scan Once Now”,
"specs":[
{
"type":"scan-once-now”
}
]
}
}
200 OK
{
"creator": 524,
"job": {
"id": "10"
},
"specs": [
{
"id": "1503",
"type": "single",
"cron_spec": "53 14 15 6 * 2017"
}
],
"timezone": "America/Los_Angeles",
"href": "/api/job/10/schedule",
"id": "1503",
"api-version": 2,
"name": "Scan Once Now"
}
34

Example:
API Integration to Query for Results
GET https://sentinel.whitehatsec.com/api/job/10/instance/1402?format=json
200 OK
{
"end": 1497564375,
"duration": 4,
"id": 1402,
"timestamp": 1497564358,
"requested_status": "",
"job": 10,
"status": "completed",
"begin": 1497564371,
"href": "/api/job/10/instance/1402“
}
35

Example:
API Integration to Find Vulnerabilities
GET https://sentinel.whitehatsec.com/api/vuln?query_site=6&query_status=open&format=json
200 OK
{
"collection": [
{
"status": "open",
"site": "6",
"opened": "2017-06-15T19:07:54Z",
"threat": "2",
"url": "testsite.localdomain.lan/app.cgi?var=<script>alert(123)<%2Fscript>",
"id": "260",
"modified": "2017-06-15T22:06:12Z",
"first_opened": "2017-04-15T19:07:54Z",
"site_name": "Testsite",
"service_level_abbr": "BE",
"accepted": 0,
"found": "2017-04-15T19:07:54Z",
…
…
"severity": "3",
"score": 8,
"class": ”Cross Site Scripting",
"href": "/api/vuln/260",
"impact": 3
}
]
}
36

Plugins Simplify Triggering Interactions

Plugins = Automate Ticket Generation

DevSecOps Pain Points
 Scanner Result Verification, False Positives
 Static / Dynamic Scan Speeds
 Results Need Interpretation and Prioritization within Business Context
39

Scenario 2 – Medium-Size Organization/App
DevOps 1 -> team integration branch
(team integration commit hooks)
• Black Box dynamic testing in QA
• Business logic assessment
• Pen testing
Team needs to vet results, assess risk,
prioritize, apply sec policy to green/red
light)
DevOps 2 -> team integration branch
QA integration — Prod push
• Production safe dynamic testing
• Remediate using WAF technologies for
short term
• Queue up for fixing original ticket
Team needs to vet results, prioritize,
generate tickets, apply company security
policy to bubble up priorities
Each team does pre-commit hooks static analysis, verify results, accept/fix per security policy
40

Scenario 2 – Common Challenges
Static analysis of individual repositories is too narrow-minded
(think micro-services)
Verification of results is time-consuming
Increasing need for analytics and overall risk analysis
41

Scenario 3 - Large Company – Mature DevOps
42
➢ Compliance is more a factor
➢ Policy & records need documentation
➢ Risk management platforms can be integrated with vulnerability data
➢ Reports need to be available on-hand for audits

Risk Management: Asset Enumeration
Evaluate Operational Risk, enumerate assets, produce security
policies for different groups
 Customize policies and requirements based risk profile of asset
 Platforms like RSA’s Archer evaluate your overall risk and integrate with
security vendors
 Integrations between your Risk model (BI, VM) software and scanning
services
43

Asset Enumeration Example:
Fictitious Healthcare company
➢ Documentation content for customers (Low risk)
➢ Customer Health data portal (High risk, HIPAA)
➢ Online personalized medical appliances shopping website (High Risk, PCI, HIPAA)
➢ Backend Insurance/EHR Processing/B2B integrations (High risk, HIPAA)
➢ Backend statistics integrations for website usage statistics (Medium Risk, Non-
authenticated content only)
➢ New Mobile App portal (High risk, HIPAA)
44

DevSecOps Integrations & Touchpoints:
Healthcare Example cont.
✓ Add ticketing system checkbox for architectural security review by feature.
✓ Add code review checkboxes on “pull-requests”. Integrate with ticketing.
✓ Codify security tests as part of unit/integration testing where possible.
✓ Tie static analysis security testing and make a gating factor for code check-ins. Integrate with
Tickets.
✓ Require Manager approval to by-pass security test failures.
✓ Test QA integration branches with verified security testing services – QA teams codify
negative security tests for verified vulnerabilities.
45

© 2017 WhiteHat Security, Inc.© 2017 WhiteHat Security, Inc.
Other Resources
How about mobile?
https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10
OWASP Top 10 in practice, great page
: https://www.owasp.org/index.php/OWASP_Top_10/Mapping_to_W
HID
OWASP site also has links to many tools that can be integrated into
your SDLC automations
46

Thank You
Siamak Pazirandeh
WhiteHat Security Inc.
max.pazirandeh@whitehatsec.com
47

Take Control: Design a Complete DevSecOps Program

Recommended

More Related Content

What's hot (20)

Similar to Take Control: Design a Complete DevSecOps Program (20)

More from Deborah Schalm (20)

Recently uploaded (20)

Take Control: Design a Complete DevSecOps Program