SF OWASP September

1. Working with Developers for
Fun and Progress

2. About Me
● Red Team at Redspin
● SB OWASP + AppSec California + Bay Area OWASP
● Green Team at Bugcrowd
● Blue Team at Segment

3. The Slides are Online, I’m Online
● Link to Slideshare
● @leifdreizler

4. Topics
● Training
● Threat Modeling
● Vendor Adoption
● What’s Next?

5. Security Goes Left

6. Security Goes Left
● Hard to staff a large security org
● Not efficient to find bugs in prod
Source: https://www.experimentus.com/itm/W_06_00055_The_Cost_of_Defects.htm

7. Security Goes Left
● Hard to staff a large security org
● Not efficient to find bugs in prod
Tanya Janca, @shehackspurple Source: https://code.likeagirl.io/pushing-left-like-a-boss-part-1-80f1f007da95
● Devs want to build good software
● Devs need to be security minded

8. Training
● Part 1 - Think Like an Attacker
● Part 2 - Secure Code Review
Source: Security Solutions for Hyperconnectivity and the Internet of Things

9. Think Like an Attacker - Creating Relevant Content
● Bug bounty submissions
● Pentests
● Internal findings

10. Pre Training Setup
● Install OWASP Juice Shop
● Install Burp Suite Community

11. OWASP Juice Shop
Source: https://www.owasp.org/index.php/OWASP_Juice_Shop_Project

12. Hands-On Training Schedule
1. Vuln category 1 (Slides + Examples)
2. Vuln category 2
3. Interactive Training (Burp Suite + Juice Shop)
4. Vuln category 3
5. Vuln category 4
6. Interactive Training
Source: https://www.dreamstime.com/royalty-free-stock-photography-computer-hacker-hands-image8278907
https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/

13. Hands-on Training

15. Secure Code Review
● XSS
● Broken Access Control
● Secrets management
● Error handling
● SSRF
● Crypto
Influenced by OWASP Secure Coding Cheat Sheet
● Defence Against the Dark Web, etc.
Source: Your Personal Password Vault: A Password Journal and Logbook

16. Leif’s Hawaiian Shirt Store
Leif has rushed through building a new Hawaiian shirt store with React. Is there
anything wrong with it?
server.jsApp.js

17. McAfee’s Hawaiian Shirt Store
John has built an “unhackable store”
server.jsApp.js

18. App.js

19. server.js

20. AppSec Training
● Meet new eng hires
● Common vuln types
● “Security Judgment”
● Think about PRs in new ways
● Have fun!

21. Reviews

23. Threat Modeling
@jonathanmarcil - https://www.youtube.com/watch?v=KGy_KCRUGd4

24. Threat Modeling

25. Threat Modeling
Source: https://reqtest.com/general/a-bug-goes-skateboarding-on-boehms-curve/

26. Threat Model Prep
● Eng Team provides Sec with:
○ Links to repos
○ Architecture Diagrams
○ Docs
Source: https://articles.microservices.com/an-alternative-way-of-visualizing-microservice-architecture-837cbee575c1

27. Threat Model Prep
● Eng Team provides Sec with:
○ Links to repos
○ Architecture Diagrams
○ Docs
● Everyone should be thinking
about threats
○ Bonus points for getting EM/PMs
involved
Source: https://thegeekyleader.com/2014/12/07/good-and-bad-software-engineering-manager/

28. Threat Model
● Our process works best w/ 2+ people from Sec
○ Leader + Note-taker
● Leader keeps the conversation moving
● Note-taker creates Attack Tree and Issue Spreadsheet

29. Issue Spreadsheet

30. ●
Jonathan Marcil: Threat Modeling Toolkit AppSecCali 2018

31. Attack Tree
Source: https://schd.ws/hosted_files/appseccalifornia2018/54/Threat%20Modeling%20Toolkit%20-%20AppSecCali.pptx

32. Threat Modeling Benefits
● Great way to meet engineers
● Information exchange
○ Get engineers thinking about security in new ways
○ Learn more about systems you’re supposed to help protect
● Uncover existing risks
● Prevent problems in future development

33. Vendor Adoption
● Partner with Eng During Trial Process
● Create Implementation Examples
● Spread Awareness
● Integrate with Existing Tooling
Source: https://www.itbusinessedge.com/slideshows/nine-questions-to-ask-when-selecting-a-security-vendor.html

34. Example - Snyk
● Security eval - tested on various repos
● Partnered with App team
● Presented at Eng all hands
● Security submitted PRs to core repos
● Wrote Integration with Directory
Snyk is a tool to help companies manage vulnerabilities in their dependencies.

35. Directory Integration

37. What’s Next?
● Security 1337erboard

38. What’s Next?
● Security 1337erboard
● CTF

39. What’s Next?
● Security 1337erboard
● CTF
● Security ↔ Engineering Embed

40. Security → Engineering Embed
● Great way to meet devs
● Shows you can build useful features/tools
● Sec learns eng process/tooling/constraints

41. Security → Engineering Embed
● Great way to meet devs
● Shows you can build useful features/tools
● Sec learns eng process/tooling/constraints

42. What’s Next?
● Security 1337erboard
● CTF
● Security ↔ Engineering Embed
● Have Better Security Metrics

43. Influential Presentations
● Astha Singhal/Patrick Thomas - We Come Bearing Gifts: Enabling Product
Security with Culture and Cloud (AppSec CA 2018) -
https://www.youtube.com/watch?v=L1WaMzN4dhY
● John Melton - Starting an AppSec Program: An Honest Retrospective
(LocoMocoSec 2018) - https://www.youtube.com/watch?v=ETkHISgEh3g
● Neil Matatall/Brent Johnson - Twubhubbook: Like an AppSec Program, but for
Startups (AppSec CA 2017) -
https://www.youtube.com/watch?v=JEE7wXHa1kY
● Tanya Janca - Pushing Left, Like a Boss (DevSecCon Singapore 2018) -
https://www.youtube.com/watch?v=8kqtrX6C10c

44. Closing Thoughts