Sicherheit beim Build

Transcription

1 Sicherheit beim Build Java Forum Stuttgart 2017 Dominik Schadow bridgingit

2 Verify your security activities

3 Integration into the build pipeline Find security issues as early as possible

4 Catch the low hanging fruits

5 What to scan for?

6 OWASP Top 10 Proactive Controls 2016 C01 Verify for Security Early and Often C02 Parameterize Queries C03 Encode Data C04 Validate All Inputs C05 Implement Identity and Authentication Controls C06 Implement Appropriate Access Controls C07 Protect Data C08 Implement Logging and Intrusion Detection C09 Leverage Security Frameworks and Libraries C10 Error and Exception Handling

7 OWASP Top 10 Proactive Controls 2016 C01 Verify for Security Early and Often C02 Parameterize Queries C03 Encode Data C04 Validate All Inputs C05 Implement Identity and Authentication Controls C06 Implement Appropriate Access Controls C07 Protect Data C08 Implement Logging and Intrusion Detection C09 Leverage Security Frameworks and Libraries C10 Error and Exception Handling

8 OWASP ZAP OWASP Dependency Check FindBugs / Find Security Bugs

9 Scan for vulnerabilities in web applications

10

11 Open source web proxy and dynamic application security testing tool

12 Active scan for anything you like

13 Demo

14 OWASP Top 10 Proactive Controls 2016 C01 Verify for Security Early and Often C02 Parameterize Queries C03 Encode Data C04 Validate All Inputs C05 Implement Identity and Authentication Controls C06 Implement Appropriate Access Controls C07 Protect Data C08 Implement Logging and Intrusion Detection C09 Leverage Security Frameworks and Libraries C10 Error and Exception Handling

15 Works on my machine

16

17 Identify libraries with known vulnerabilities

18 OWASP Top

19

20 Demo

21 OWASP Top 10 Proactive Controls 2016 C01 Verify for Security Early and Often C02 Parameterize Queries C03 Encode Data C04 Validate All Inputs C05 Implement Identity and Authentication Controls C06 Implement Appropriate Access Controls C07 Protect Data C08 Implement Logging and Intrusion Detection C09 Leverage Security Frameworks and Libraries C10 Error and Exception Handling

22 Works on my machine

23

24

25 Identify vulnerabilities in source code

26

27

28

29

30

31

32

33 OWASP Top 10 Proactive Controls 2016 C01 Verify for Security Early and Often C02 Parameterize Queries C03 Encode Data C04 Validate All Inputs C05 Implement Identity and Authentication Controls C06 Implement Appropriate Access Controls C07 Protect Data C08 Implement Logging and Intrusion Detection C09 Leverage Security Frameworks and Libraries C10 Error and Exception Handling

34 Works on my machine

35

36

37

38

39 OWASP Top 10 Proactive Controls 2016 C01 Verify for Security Early and Often C02 Parameterize Queries C03 Encode Data C04 Validate All Inputs C05 Implement Identity and Authentication Controls C06 Implement Appropriate Access Controls C07 Protect Data C08 Implement Logging and Intrusion Detection C09 Leverage Security Frameworks and Libraries C10 Error and Exception Handling

40 Alternatives and Extensions Burp Suite Vulnerability scanner Clair Static analysis of vulnerabilities in Docker containers Gauntlt Provides hooks for a variety of security tools SourceClear Cloud based dependency checker

41 Scan early, scan often

42 Scans slow down your build

43 No duplicate scans in Jenkins AND SonarQube

44 Full scan in a nightly build only

45 Filter false positives right away

46 Build tools do not replace other activities

47 Summary Catch the low hanging fruits yourself Create a (nightly) build to do all security scans Take care of findings as soon as possible

48 Marienstr Stuttgart Blog blog.dominikschadow.de Burp Suite Clair FindSecBugs Gauntlt OWASP Dependency Check OWASP_Dependency_Check OWASP Zed Attack Proxy OWASP_Zed_Attack_Proxy_Project SourceClear Pictures