#MicroFocusCyberSummit Shifting Security Left Bringing security - - PowerPoint PPT Presentation

#MicroFocusCyberSummit

#MicroFocusCyberSummit

Shifting Security Left

Brenton Scott Witonski <>< , Acxiom Brandon Spruth, Target Lucas von Stockhausen, Fortify

Bringing security into continuous integration and delivery

#MicroFocusCyberSummit

WHY ARE YOU HERE

You want to know WHAT shifting security left means You want to know WHY you should shift left You want to know HOW to shift left

WHAT is Shifting Security Left

Moving current activities left Changing how you do security Changing the location of the Compromise in order to reduce risk Controlling development Becoming a part of development Software Development LifeCycle

WHY You to Shift Left

Shifting left (correctly) can change ALL of this!!!

Security

FROM TO

WHY You to Shift Left

RESULTS

Actual Risk Reduction

TRANSPARENT INTEGRATION AND AUTOMATION

THE NAME OF DEVSECOPS IS SPEED

• GO AT THE SPEED OF DEVELOPMENT (DAILY SCANS OF MODIFIED CODE)

TRANSPARENT ACTIVITY

• SCANS AND RESULTS SHOULD BE COMPLETED WITHOUT DEVELOPMENT STOPPING

DIRECT ACCESS TO SOURCE CODE

• A DEVELOPER SHOULD NOT HAVE TO MANUALLY PROVIDE CODE TO SCAN

AUTOMATED SCANNING BASED ON RELEVANT CHANGES

• A DEVELOPER SHOULD NOT HAVE TO WAIT ON RESULTS

HOW Can Security Shift Left

ALLOW CRITICALS INTO PRODUCTION tCELL’s 2018 Q2 Report “Security Report for In-Production Web Applications” Average of 34 DAYS to patch the most critical CVE’s IDEA: Patch Introduced Risk by Next Release DIFFER LEGACY VS INTRODUCED RISK Immediately address introduced risk with developers in existing or next release cycle Work with application and product

• wners to reduce technical debt
• ver time

IDEA: FOCUS ON THE NOW

Two Shift-Left Concepts for DEVSECOPS

NOW: REAL WORLD EXAMPLE

BitBucket/GitHub/SVN(TeamForge)

• You need direct access to your repos as a security team
• Use APIs and scripting to identify all repositories and branches having code changes
• IDENTIFY ALL REPOS THAT HAVE CHANGED
• CAPTURE REPO INFORMATION: ProjectName->RepositoryName->BranchName
• Validate repository changes and capture commit metadata

STEP 1: Identify Relevant Code

$github_proj_url="https://git.instance.net/api/v3/user/repos?per_page=100\\&page=$i"; chomp($github_proj_url); $curl_proj_command = "curl -s -u <password>"; $curl_proj_command .= " -X GET"; $curl_proj_command .= " $github_proj_url"; $json_proj=`$curl_proj_command`; chomp($json_proj); $decoded_json_proj=decode_json($json_proj); push @repo_values , @{$decoded_json_proj};

GITHUB Example in PERL to pull Repositories

FORTIFY PROJECT APIs

• Define a naming standard for your SSC Project based on Code Repository Data
• Generate Fortify API Access Token
• Verify SSC Project exists, if not, create it
• Pull the source code and scan it
• Upload results to SSC

STEP 2: Create Projects and Scan

my $token_response=`curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: Basic $Base64_Encoded_Password' -d '{ "type": "UnifiedLoginToken" }' 'http://ssc_server_name.net:PORT/ssc/api/v1/tokens’`; chomp($token_response); my $decoded_json_commit=decode_json($token_response); my $t_response_code=$decoded_json_commit->{'responseCode'}; print MSTRLOG "\nThe Token create response code was: $t_response_code\n"; my $token_value = $decoded_json_commit->{'data'}->{'token'};

API Snippet for generating a Fortify Access Token

FORTIFY ISSUE APIs

• For each issue, identify the issues of importance
• Severity, Age, Category, Confidence Level, etc
• Label issues based on relevant to current release or legacy issues existing prior to current release
• Initiate reporting mechanism (email, dashboard notification, etc) for issues to stakeholders
• CURRENT ISSUES – ACTIVE DEVELOPERS RESPONSIBLE
• LEGACY ISSUES - PRODUCT OWNERS AND DEVELOPER LEADS

STEP 3: Relevant Issue Identification

my $issue_response=`curl -X GET --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: FortifyToken $fortify_token' 'http://ssc_server_name.net:port/ssc/api/v1/projectVersions/$target_version_id/issues?limit=- 1&orderby=priority&fields=priority'`; chomp($issue_response); my $decoded_json_issues=decode_json($issue_response); print Dumper $decoded_json_issues;

API Snippet for Fortify Issues

What Tools Will You Need

1) TECHNICAL RESOURCE FOR PYTHON or PERL SCRIPTING 2) ACCESS TO YOUR SOURCE CODE REPOSITORY 3) SERVER WITH ACCESS TO SOURCE REPO AND SSC SERVER

NEXT 15 DAYS

• Requisition a Linux server for testing
• Research Repo and Fortify APIs and Play with Examples Provided

NEXT 30 DAYS

• Write scripts to process your repository data
• Write scripts to create SSC Projects

NEXT 60 DAYS

• Write scripting process to scan relevant repositories
• Define the official process for Automated Static Scanning

What Now – Next Steps

Thank You.

#MicroFocusCyberSummit

Brenton Scott Witonski <>< E-mail: Brenton.Witonski@acxiom.com LinkedIn: https://www.linkedin.com/in/brentonwitonski Personal: www.lovepala.com

Brandon Spruth

17

18

12 1 11 2 10 3 9 4 8 5 7 6 Security Treadmill

19

• utcomes

Contingency Planning

• perations

20

I

R

R

F

DevSecOps Scanning

21

Feedback Remediate Iterate Scan

Dynamic Application Security Test Orchestration

22

WebBreaker Demos

23

24

Security-As-A-Service Contextual Scan Orchestration

25

Bonus Content – APIs

USE FOR GETTING A LIST OF YOUR REPOS IN A STASH GIT INSTANCE my $stash_repo_url="https://stash.company.com/rest/api/1.0/projects/$proj_name/repos?limit=300"; chomp($stash_repo_url); my $curl_repo_command = "curl -s -u <password>"; $curl_repo_command .= " -X GET"; $curl_repo_command .= " $stash_repo_url"; my $json_repo=`$curl_repo_command`; die "Could not get $stash_repo_url!" unless defined $json_repo; chomp($json_repo); my $decoded_json_repo=decode_json($json_repo); print "\n\n#################\n\tSTART REPO DUMP\n#################\n"; print Dumper $decoded_json_repo;

GIT STASH API – Repository

USE TO GET COMMIT DATA FOR EACH REPO IN STASH GIT INSTANCE my $stash_commit_url="https://stash.company.com/rest/api/1.0/projects/$proj_name/repos/$repo_n ame/commits?limit=1"; chomp ($stash_commit_url); my $curl_commit_cmd = "curl -s -u <password>"; $curl_commit_cmd .= " -X GET"; $curl_commit_cmd .= " $stash_commit_url"; my $json_commit=`$curl_commit_cmd`; chomp($json_commit); my $decoded_json_commit=decode_json($json_commit); print "\n\n#################\n\tSTART COMMIT DUMP\n#################\n"; print Dumper $decoded_json_commit;

GIT STASH API – Commits

LOOP THROUGH TO GET A LIST OF REPOS FROM YOUR GITHUB INSANCE $github_proj_url="https://git.instance.net/api/v3/user/repos?per_page=100\\&page=$i"; chomp($github_proj_url); $curl_proj_command = "curl -s -u <password>"; $curl_proj_command .= " -X GET"; $curl_proj_command .= " $github_proj_url"; $json_proj=`$curl_proj_command`; chomp($json_proj); $decoded_json_proj=decode_json($json_proj); push @repo_values , @{$decoded_json_proj};

GIT GITHUB API – Repository

CREATE A TOKEN USING BASE64ENCODED PASSWORD BASE64ENCODING EXAMPLE - my $token_response=`curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: Basic $Base64_Encoded_Password' -d '{ "type": "UnifiedLoginToken" }' 'http://ssc_server_name.net:port/ssc/api/v1/tokens'`; chomp($token_response); my $decoded_json_commit=decode_json($token_response); my $t_response_code=$decoded_json_commit->{'responseCode'}; print MSTRLOG "\nThe Token create response code was: $t_response_code\n"; my $token_value = $decoded_json_commit->{'data'}->{'token'};

FORTIFY API – Generate Token

https://www.base64encode.org/

sub get_proj_id { my $all_ssc_projects_response=`curl -X GET --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: FortifyToken $fortify_token' 'http://ssc_server_name.net:port/ssc/api/v1/projects?limit=-1&fulltextsearch=false’`; chomp($all_ssc_projects_response); my $decoded_json_projects=decode_json($all_ssc_projects_response); print Dumper $decoded_json_projects; my $total_ssc_projects=$decoded_json_projects->{'count'}; print "The total number of ssc_projects are: $total_ssc_projects\n\n"; my @proj_values= @{ $decoded_json_projects->{'data'}}; foreach my $v (@proj_values) { my $project_name=$v->{'name'}; my $project_id=$v->{'id'}; chomp($project_name); chomp($project_id); if ( $_[0] eq $project_name) { print "Project name is: $project_name and Project id is: $project_id\n"; return ($project_name, $project_id); } } }

FORTIFY API – Get Project ID

sub get_version_id { my $ssc_versions_response=`curl -X GET --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: FortifyToken $fortify_token' 'http://ssc_server_name.net:port/ssc/api/v1/projects/$_[0]/versions’`; chomp($ssc_versions_response); my $decoded_json_projects=decode_json($ssc_versions_response); my @version_values= @{ $decoded_json_projects->{'data'}}; foreach my $vv (@version_values) { my $version_name=$vv->{'name'}; my $version_id=$vv->{'id'}; chomp($version_name); chomp($version_id); if ( $_[1] eq $version_name) { print "Version name is: $version_name and Version id is: $version_id\n"; return ($version_name, $version_id); } } }

FORTIFY API – Get Version ID

sub create_ssc_project { print "\t\tPassed into the sub create ssc project values are proj_name: $_[0] and repo_name: $_[1] and description: $_[2] and token: $_[3]\n"; my $create_response=`curl -X POST --header 'Content-Type: application/json' --header 'Authorization: FortifyToken $_[3]' -d '{"description": "$_[2]", "name": "$_[1]", "issueTemplateId": "Prioritized-HighRisk-Project-Template", "masterAttrGuid": "87f2364f-dcd4- 49e6-861d-f8d3f351686b", "objectVersion": 3, "project": {"description": "$_[2]", "issueTemplateId": "Prioritized-HighRisk-Project-Template", "name": "$_[0]"} }' 'http://ssc_server_name.net:port/ssc/api/v1/projectVersions’`; chomp($create_response); my $decoded_json_commit=decode_json($create_response); #print Dumper $decoded_json_commit; my $id = $decoded_json_commit->{'data'}->{'id'}; return $id; }

FORTIFY API – Create SSC Project

sub create_ssc_project_version { print "\t\tPassed into the sub create ssc project version values are proj_name: $_[0] and version_name: $_[1] and description: $_[2] and token: $_[3]\n"; my $create_response=`curl -X POST --header 'Content-Type: application/json' --header 'Authorization: FortifyToken $_[3]' -d '{"description": "$_[2]", "name": "$_[1]", "issueTemplateId": "Prioritized-HighRisk-Project-Template", "masterAttrGuid": "87f2364f-dcd4- 49e6-861d-f8d3f351686b"}' 'http://ssc_server_name.net:port/ssc/api/v1/projects/$_[0]/versions’`; chomp($create_response); my $decoded_json_commit=decode_json($create_response); print Dumper $decoded_json_commit; my $id = $decoded_json_commit->{'data'}->{'id'}; return $id; }

FORTIFY API – Create SSC Project Version

sub update_ssc_project_attributes { print "\t\tPassed into the sub create ssc project version values are proj_id: $_[0] and token: $_[1]\n"; my $update_att_response=`curl -X PUT --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: FortifyToken $_[1]' -d '[{"attributeDefinitionId":5,"values":[{"guid":"Active"}]}, {"attributeDefinitionId":6,"values":[{"guid":"Internal"}]}, {"attributeDefinitionId":7,"values":[{"guid":"internalnetwork"}]}]' 'http://ssc_server_name.net:port/ssc/api/v1/projectVersions/$_[0]/attributes’`; chomp($update_att_response); my $decoded_json_commit=decode_json($update_att_response); print Dumper $decoded_json_commit; my $u_att_response_code=$decoded_json_commit->{'responseCode'}; print "\nThe update attributes response code was: $u_att_response_code\n"; }

FORTIFY API – Update Project Attributes

FORTIFY API – Update Project Processing Rules

sub commit_ssc_project { print "\t\tPassed into the sub create ssc project version values are proj_id: $_[0] and token: $_[1]\n"; my $commit_response=`curl -X PUT --header 'Accept: application/json' --header 'Content- Type: application/json' --header 'Authorization: FortifyToken $_[1]' -d '{ "committed":"true"}' 'http://ssc_server_name.net:port/ssc/api/v1/projectVersions/$_[0]'`; chomp($commit_response); my $decoded_json_commit=decode_json($commit_response); print Dumper $decoded_json_commit; my $c_response_code=$decoded_json_commit->{'responseCode'}; print "\nThe commit project response code was: $c_response_code\n"; }

FORTIFY API – Commit SSC Project

my $issue_response=`curl -X GET --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: FortifyToken $fortify_token' 'http://ssc_server_name.net:port/ssc/api/v1/projectVersions/$target_version_id/issues?limit=

• 1&orderby=priority&fields=priority’`;

chomp($issue_response); my $decoded_json_issues=decode_json($issue_response); print Dumper $decoded_json_issues;

FORTIFY API – Get Project Version Issues

my $issue_detail_response=`curl -X GET --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: FortifyToken $fortify_token' '$issue_href’`; my $decoded_json_issues_det=decode_json($issue_detail_response); print "\n\n#############################\n\tSTART ISSUE DETAILS DUMP\n#############################\n"; print Dumper $decoded_json_issues_det;

FORTIFY API – Get Issue Details

Bonus Content – PROCESS

• 1. LOOP THROUGH API COMMAND TO CAPTURE ALL REPOSITORIES
• 2. FOR EACH REPOSITORY CAPTURE COMMIT DATA AND EVALUATE FOR RELEVANCE
• 3. CAPTURE USER DATA OF COMMITS FOR LATER REPORTING
• 4. CREATE LIST OF RELEVANT REPOSITORIES FOR PROCESSING

STEP 1: Identify Relevant Code

• 1. GENERATE YOUR FORTIFY ACCESS TOKEN
• 2. USING LIST OF REPOS FOUND VALIDATE IF SSC PROJECT EXISTS FOR CODE REPOSITORY
• 3. IF NOT, THEN CREATE THE SSC PROJECT
• 1. Create the Project
• 2. Create the Project Version
• 3. Update Project Attributes
• 4. Update Project Processing Rules
• 5. Commit SSC Project
• 4. SCAN CODE REPOSITORY AND UPLOAD RESULTS TO SSC PROJECT

STEP 2: CREATE PROJECTS AND SCAN

• 1. GENERATE YOUR FORTIFY ACCESS TOKEN
• 2. USE PROJECT ID AND VERSION ID TO CAPTURE LIST OF ISSUES
• 3. FOR EACH ISSUE, CAPTURE METADATA
• 4. EVALUATE METADATA FOR RELEVANCE (LEGACY OR INTRODUCED RISK)
• 5. CONSOLIDATE ISSUES AND REPORT TO APPROPRIATE STAKEHOLDERS
• 6. GATHER METRICS AND EVALUATE

STEP 3: Relevant Issue Identification

#MicroFocusCyberSummit