Jumpstarting Your DevSECOps Pipeline with IAST and RASP Jeff - - PowerPoint PPT Presentation

▶
jumpstarting your devsecops pipeline with iast and rasp
SMART_READER_LITE
LIVE PREVIEW

Jumpstarting Your DevSECOps Pipeline with IAST and RASP Jeff - - PowerPoint PPT Presentation

May 01, 2023 222 likes •601 views

Jumpstarting Your DevSECOps Pipeline with IAST and RASP Jeff Williams @planetlevel CTO and Co-FOUNDER Contrast Security The Average 26.7 Vulnerabilities application is extremely 21% CustomCode vulnerable 8% USED Libraries 2

slide-1
SLIDE 1

Jumpstarting Your DevSECOps Pipeline with IAST and RASP

Jeff Williams –@planetlevel CTO and Co-FOUNDER – Contrast Security

slide-2
SLIDE 2

The Average application is extremely vulnerable

71% unusedLibraries

26.7 Vulnerabilities 2 Vulnerabilities

8% USED Libraries 21% CustomCode

slide-3
SLIDE 3

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

3

You are Under AttacK

slide-4
SLIDE 4

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

4

What is DevSecOps?

https://itrevolution.com/the-three-ways-principles-underpinning-devops/

1.Establish work flow 2.Ensure instant feedback 3.Culture of experimentation 1.Establish security work flow 2.Ensure instant security feedback 3.Build a security culture

DEVOPS DEVSECOPS

slide-5
SLIDE 5

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

5

Keys to Security automation

Accurate REAL TIME Continuous Reliable

Any inaccuracy requires experts. And there aren’t enough experts The best window to fix a vulnerability is within seconds after introducing it The days of gigantic security PDF reports are hopefully long behind us. Application protection in production has to be safe and testable

slide-6
SLIDE 6

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

6

DEVSECOPS Enabling technologies

n Finds vulnerabilities n Highly accurately n From inside the application n Across custom code and libraries n In real time n Without scanning

IAST

Interactive application security testing

n Prevents vulnerabilities from being exploited n Highly accurately n From inside the application n Across custom code and libraries n In real time n Without “learn mode”

RASP

RUNTIME APPLICATION SELF-PROTECtion

slide-7
SLIDE 7

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

7

How IAST and RASP WOrk

Your Application or API

Exploit Prevented Vulnerability Confirmed

✘

IAST

  • Detects vulnerabilities in both

custom code and libraries during normal use

RASP

  • Prevents vulnerabilities from

being exploited in both custom code and libraries

Runtime Application Self-Protection

Config Sensors Code Sensors Control Flow Sensors HTTP Sensors Backend Sensors Data Flow Sensors Library Sensors

AGENT

Interactive Application Security Testing

slide-8
SLIDE 8

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

8

Turning Devops into DevSECOPS

Development CI/CD/QA Operations

IAST/RASP IAST/RASP IAST/RASP

slide-9
SLIDE 9

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

9

  • 1. Add Security to

Development

Today’s MISSION…

  • 2. Lock Down Open

Source libraries

  • 3. Enable automatic

SecurityTesting

  • 4. Prevent exploits

in Operation

slide-10
SLIDE 10

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

10

GET an iast/RASP agent

  • 1. Download
  • 2. install

https://www.contrastsecurity.com/ce

  • 3. Enjoy
slide-11
SLIDE 11

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

11

Using IAST from within Maven

slide-12
SLIDE 12

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

12

HQL injection

slide-13
SLIDE 13

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

13

Automatic vulnerability detection

slide-14
SLIDE 14

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

14

IDE Chatops Browser

How do you want your security?

slide-15
SLIDE 15

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

15

  • 1. Add Security to

Development

Today’s MISSION…

  • 2. Lock Down Open

Source libraries

  • 3. Enable automatic

SecurityTesting

  • 4. Prevent exploits

in Operation

slide-16
SLIDE 16

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

16

Actual attack on CVE-2017-5638

slide-17
SLIDE 17

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

17

How fast can you respond?

March 7 CVE-2017-5638 Disclosed, Apache releases fixed version March 8 We observe widespread attacks Mid-May Equifax breach

  • ccurs

July 29 Equifax learns of breach Sept 7 Equifax discloses, Four more Struts2 CVEs disclosed No updates

You musthave the infrastructure in place to respond within hours.

Disaster No detection

slide-18
SLIDE 18

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

18

PROD DEV CI/CD

APIs Containers Private

Cloud

APIs Containers Private

Public Cloud

  • 1. continuously

Inventory all oSS

  • 2. Automatically detect

vulnerabilities in OSS

ASSESS OSS with IAST

slide-19
SLIDE 19

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

19

PROTECT WITH RASP

  • 1. Prevent known OSS

vulnerabilities from being exploited

  • 2. Defend applications from

attacks on unknown OSS vulnerabilities

slide-20
SLIDE 20

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

20

  • 1. Add Security to

Development

Today’s MISSION…

  • 2. Lock Down Open

Source libraries

  • 3. Enable automatic

SecurityTesting

  • 4. Prevent exploits

in Operation

slide-21
SLIDE 21

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

21

IAST works the same in CI/CD

slide-22
SLIDE 22

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

22

IAST works with all types of testing… …even production

Vulnerabilities Anywhere

slide-23
SLIDE 23

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | @planetlevel

23

Security Coverage with JACOCO

slide-24
SLIDE 24

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

24

  • 1. Add Security to

Development

Today’s MISSION…

  • 2. Lock Down Open

Source libraries

  • 3. Enable automatic

SecurityTesting

  • 4. Prevent exploits

in Operation

slide-25
SLIDE 25

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

25

Getting started with RASP

  • 1. Download
  • 2. install

https://www.contrastsecurity.com/ce

  • 3. Enjoy
slide-26
SLIDE 26

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

26

Web application firewalls both

  • verblock and

underblock

Application Untrusted deserialization

Name: Smith, James Record ID: 123456 Owner: Finance

Application expects to receive this

  • bject

Bad Guy

AcmeInternalType#cmd: java.lang.Runtime AcmeInternalType#mtd: getRuntime().exec AcmeInternalType#args: ‘cmd.exe’,’/C’,’calc’ AcmeInternalType#cmd: java.lang.Runtime AcmeInternalType#mtd: getRuntime().exec AcmeInternalType#args: ‘cmd.exe’,’/C’,’calc’

Attacker sends malicious object

slide-27
SLIDE 27

27

RASP protects from within

Who is attacking? What techniques are they using? Which apps and aPIsare they targeting?

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

slide-28
SLIDE 28

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

28

RASP Deploys automatically with your application

  • Ansible
  • Puppet
  • Docker
  • Kubernetes
  • Whatever…
slide-29
SLIDE 29

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

29

RASP IS FAST

+50 µs

100x faster than SSL Contrast Protect SSL

+5 ms

slide-30
SLIDE 30

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

30

Is your soc blind to appsec?

slide-31
SLIDE 31

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

31

  • 1. Add Security to

Development

You can start today!

  • 2. Lock Down Open

Source libraries

  • 3. Enable automatic

SecurityTesting

  • 4. Prevent exploits

in Operation

IAST and RASP are a platform for “security as code”

slide-32
SLIDE 32

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com

32

Velocity Early Access

Get started for free at: http://contrastsecurity.com/ce Contrast Community Edition (FREE)

Contrast CE provides full-featured IAST and RASP for Java applications and APIs. Finally, you can replace your SAST, DAST, and WAF with something better… For free. Contrast CE works with…

slide-33
SLIDE 33

Ask me anything

Jumpstarting Your DevSecOps Pipeline with IAST and RASP Jeff Williams @planetlevel

THANK YOU!

slide-34
SLIDE 34

34

IAST and RASP

  • Find vulnerabilities
  • Secure open source
  • Prevent exploits

Ordinary Insecure Application AGENT Self- Protecting Application

IAST and RASP use an instrumentation agent to empower apps with security capabilities at runtime without changing existing code…

“…works like AppDynamics for security”

slide-35
SLIDE 35

35

Struts 2 Dependencies

slide-36
SLIDE 36

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | contrastsecurity.com 36

Dozens of CVEs every week

“Possible” ?!!

slide-37
SLIDE 37

Jumpstarting Your DevSecOps Pipeline with IAST and RASP | @planetlevel

37