Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero - PowerPoint PPT Presentation

Mar 16, 2024 •374 likes •723 views

Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero Day Vulnerabilities The Data Set Applications from over 300 commercial and US government customers Scanned 9,910 applications over past 18 months Ranged in size

Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero Day Vulnerabilities
The Data Set • Applications from over 300 commercial and US government customers • Scanned 9,910 applications over past 18 months • Ranged in size from 100KB to 6GB • Software was pre-release and in production • Internally built, outsourced, and commercial ISV code
▸ Flaw counts ▸ Flaw percentages ▸ Application count ▸ Industry vertical ▸ Risk-adjusted ▸ Application rating supplier (internal, third- ▸ First scan Applicatio party, etc.) acceptance rate n Data ▸ Application type ▸ Time between ▸ Assurance level scans Enterpris ▸ Days to ▸ Language e Metrics remediation ▸ Platform ▸ Scans to remediation ▸ PCI-DSS (pass/ fail) ▸ Scan number ▸ CWE/SANS Top25 Scan ▸ Scan date (pass/fail) Data ▸ Lines of code ▸ OWASP Top Ten (pass/fail) ▸ Custom policies
The latent Vulnerabiliesvs. The Attacks
Top 5 Attacked Web Application Vulnerabilities
Let’s take a closer look at the numbers
Top 3 Vulnerabilities by Language
Top 3 Vulnerabilities by Language
Different developers deliver different vulns
Different developers deliver different Vulnerability distribution by industry ulnerability distribution by industry vulns
Are DEVELOPERs making any progress at eradicating cross- site scripting or sql injection?
Dare we ask, How is the U.S. government sector doing?
a) 34% What percentage of WEB b) 57% applications fail c) 86% OWASP TOP TEN? d) 99%
Who is holding their software vendors accountable?
So I hear you can run applications on smart phones?
a) Receive an A When given an exam on b) Receive a B or worse application security c) Receive a C or fundamentals, worse over half of d) Fail (receive a D or developers… F)
Q UESTIONS ? Chris Wysopal cwysopal@veracode. com @weldpond

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

DATA MINING LECTURE 2 What is data? The data mining pipeline What is Data Mining? Data

DATA MINING LECTURE 2 What is data? The data mining pipeline What is Data Mining? Data mining is the use of efficient techniques for the analysis of very large collections of data and the extraction of useful and possibly unexpected

2.4k views • 94 slides

Web Mining Web Mining Web Mining Web Mining Web mining is the use of data mining techniques

What is Web Mining? Wh t i W b Mi i What is Web Mining? Wh t i W b Mi i ? ? Web Mining Web Mining Web Mining Web Mining Web mining is the use of data mining techniques to automat cally d scover and extract nformat on automatically

774 views • 20 slides

Web Mining Web Mining Web mining is the use of data mining techniques to automatically

What is Web Mining? What is Web Mining? Web Mining Web Mining Web mining is the use of data mining techniques to automatically discover and extract information from Web documents/services (Etzioni, 1996, CACM 39(11)) Web mining aims to

566 views • 22 slides

DATA MINING LECTURE 1 Introduction What is data mining? After years of data mining there is

DATA MINING LECTURE 1 Introduction What is data mining? After years of data mining there is still no unique answer to this question. A tentative definition: Data mining is the use of efficient techniques for the analysis of very large

1.28k views • 62 slides

Observations Regarding Past and Potential Future Mining and Its Impacts At Bokan Mountain, Prince

Observations Regarding Past and Potential Future Mining and Its Impacts At Bokan Mountain, Prince of Wales Island, Alaska: Potential Rare Earth Element Mining and Uranium Mine Remediation Presented at Organized Village of Kasaan Mining Symposium

397 views • 26 slides

THE DATA MINING PIPELINE What is data? The data mining pipeline: collection, preprocessing,

DATA MINING THE DATA MINING PIPELINE What is data? The data mining pipeline: collection, preprocessing, mining, and post-processing Sampling, feature extraction and normalization Exploratory analysis of data basic statistics What is data

2.11k views • 139 slides

Introduction What is data mining? to Data Mining: On what kind of data? Data Mining

Introduction Motivation: Why data mining? Introduction What is data mining? to Data Mining: On what kind of data? Data Mining Data mining functionalities Major issues in data mining 2 Motivation: Necessity is

438 views • 14 slides

LECTURE 1: INTRODUCTION TO DATA MINING Dr. Dhaval Patel CSE, IIT-Roorkee What is data mining?

LECTURE 1: INTRODUCTION TO DATA MINING Dr. Dhaval Patel CSE, IIT-Roorkee What is data mining? Data mining is also called knowledge discovery and data mining (KDD) Data mining is extraction of useful patterns from data sources , e.g.,

1.29k views • 50 slides

Data Mining: A Powerful Data Mining: A Powerful Tool for Data Cleaning Tool for Data Cleaning

Data Mining: A Powerful Data Mining: A Powerful Tool for Data Cleaning Tool for Data Cleaning Jiawei Han Department of Computer Science University of Illinois at Urbana-Champaign Nov. 4, 2003 1 Data mining for data quality assurance

721 views • 40 slides

Modeling Data the different views on Data Mining Views on Data Mining Fitting the data

Modeling Data the different views on Data Mining Views on Data Mining Fitting the data Density Estimation Learning being able to perform a task more accurately than before Prediction use the data to predict future data

517 views • 29 slides

Data Mining: Concepts and Techniques Web Mining Li Xiong Slides credits: Jiawei Han and

Data Mining: Concepts and Techniques Web Mining Li Xiong Slides credits: Jiawei Han and Micheline Kamber; Anand Rajaraman, Jeffrey D. Ullman Olfa Nasraoui Bing Liu 4/9/2008 1 Web Mining Web mining vs. data mining Structure (or lack

997 views • 60 slides

Introduction to Web Mining What is Web Mining? Discovering useful information from the

CS 345A Data Mining Lecture 1 Introduction to Web Mining What is Web Mining? Discovering useful information from the World-Wide Web and its usage patterns Web Mining v. Data Mining Structure (or lack of it) Textual information and

744 views • 31 slides

Contents Text Mining Concept Tasks Twitter Data Analysis with R Twitter Extracting Tweets

Text Mining with R Yanchang Zhao http://www.RDataMining.com R and Data Mining Course Beijing University of Posts and Telecommunications, Beijing, China July 2019 Chapter 10: Text Mining, in R and Data Mining: Examples and Case Studies

904 views • 64 slides

Introduction to Data Mining Methods and Tools by Michael Hahsler Agenda What is Data Mining?

Introduction to Data Mining Methods and Tools by Michael Hahsler Agenda What is Data Mining? Data Mining T asks Relationship to Statistics, Optimization, Machine Learning and AI T ools Data Legal, Privacy and Security

1.02k views • 69 slides

Week 5 Video 2 Relationship Mining Causal Mining Causal Data Mining These slides developed in

Week 5 Video 2 Relationship Mining Causal Mining Causal Data Mining These slides developed in partnership with Stephen Fancsali, Carnegie Learning, Inc. Causal Data Mining Distinct from prediction or correlation mining The goal is not

490 views • 33 slides

Course Content Principles of Knowledge Introduction to Data Mining Discovery in Data

Course Content Principles of Knowledge Introduction to Data Mining Discovery in Data Data warehousing and OLAP Data cleaning Fall 2004 Data mining operations Chapter 9: Web Mining Data summarization

582 views • 30 slides

Mining the Semantic Web: the Knowledge Discovery Process in the SW Claudia d'Amato Department of

Mining the Semantic Web: the Knowledge Discovery Process in the SW Claudia d'Amato Department of Computer Science University of Bari Italy Grenoble, January 24 - EGC 2017 Winter School Knowledge Disovery: Definition Knowledge Discovery (KD)

623 views • 60 slides

Data Mining The Social Web By Gary Short Developer

Data Mining The Social Web By Gary Short Developer Evangelist Developer Express Introduc>on Gary Short Developer Evangelist gary@garyshort.org

191 views • 15 slides

Language Resources, Language Technology, Text Mining, the Seman8c

Language Resources, Language Technology, Text Mining, the Seman8c Web: How interoperability of machines can help humans in the mul8lingual web Felix Sasaki

737 views • 30 slides

Data Mining Practical Machine Learning Tools and Techniques Slides for Chapter 7 of Data Mining by

Data Mining Practical Machine Learning Tools and Techniques Slides for Chapter 7 of Data Mining by I. H. Witten and E. Frank Engineering the input and output Attribute selection Scheme-independent, scheme-specific Attribute

634 views • 59 slides

Technologies for Web-based Adaptive Interactive Systems: Personalization Categories, and

EPL344: Internet Technologies Technologies for Web-based Adaptive Interactive Systems: Personalization Categories, and Adaptation Mechanisms and Effects Marios Belk High-level Adaptive and Interactive System Architecture User Modeling Component

628 views • 31 slides

Intro: What is datamining? Mining , Keim, IEEE Transactions on Visualization and Computer Graphics

Information Visualization and Visual Data Intro: What is datamining? Mining , Keim, IEEE Transactions on Visualization and Computer Graphics 8(1), 2002. Data are generated in large amount. E.g. transactions, telephone calls.

208 views • 9 slides

Web Programming in Django Introduction to its Model-View-Controller Architecture CS 370 SE

Web Programming in Django Introduction to its Model-View-Controller Architecture CS 370 SE Practicum, Cengiz Gnay (Some slides courtesy of Eugene Agichtein and the Internets) Snowpacolypse ATL 2014 CS 370, Gnay (Emory) Django MVC intro

1.56k views • 31 slides

Stanford University 1995-1999 University of Tokyo JSK Lab 1999-2001 Carnegie

James Kuffner Google Research & The Robotics Institute Carnegie Mellon University Digital Human Research Center (AIST) 1 James Kuffner (CMU/Google) Cloud Robotics and the Future of Distributed Intelligence IROS2011

467 views • 34 slides