Continuous security nl.linkedin.com/kimvanwilgen kimvanwilgen@gmail.com Kim van Wilgen | Schuberg Philis www.kimvanwilgen.com @kimvanwilgen
September 2017 Cybercriminals accessed the personal data of 145.5M consumers 209K credit card credentials were taken $ 300M was paid to victims and $275M in fines Continuous security @kimvanwilgen | www.kimvanwilgen.com
Open invitation • Forced browsing to get millions of results • Type admin / admin as username and password • Usage of http instead of https • Linking to phishing sites in their tweets • Alerts by security researchers were ignored • 30 days until notification, selling shares in the meantime Continuous security @kimvanwilgen | www.kimvanwilgen.com
Continuous security @kimvanwilgen | www.kimvanwilgen.com
20 20 19 20 Hello world Head of IT Head of Customer director Klaverblad software Schuberg Philis 14 17 80 18 Verzekeringen development ANVA Continuous security @kimvanwilgen | www.kimvanwilgen.com
Schuberg Philis Mission critical digital transformations Financially independent Started in 2001 300 team members (Dec 2018) EUR 60m revenue Market Quality leader in Business Critical IT Outsourcing Single KPI 100% customer satisfaction 6
Our customers 7
8
Why focus on security? Continuous security @kimvanwilgen | www.kimvanwilgen.com
Focus shifted to speed…and nothing else Continuous security @kimvanwilgen | www.kimvanwilgen.com
Constant change Continuous security @kimvanwilgen | www.kimvanwilgen.com
Everything is connected into the heart of your business Continuous security @kimvanwilgen | www.kimvanwilgen.com
Autonomous teams Continuous security @kimvanwilgen | www.kimvanwilgen.com
Changing roles Continuous security @kimvanwilgen | www.kimvanwilgen.com
Security in an agile world Continuous security @kimvanwilgen | www.kimvanwilgen.com
Security should support the delivery of value Continuous security @kimvanwilgen | www.kimvanwilgen.com
Continuous security @kimvanwilgen | www.kimvanwilgen.com
“If you are doing DevOps without security, you are doing it wrong” Thiago de Faria – Head of solutions engineering, LINKIT Continuous security @kimvanwilgen | www.kimvanwilgen.com
Secure Defensible coding infrastructure Situational Supporting way awareness of working DecSecOps model Continuous security @kimvanwilgen | www.kimvanwilgen.com
Secure Defensible coding infrastructure Situational Supporting way awareness of working DecSecOps model Continuous security @kimvanwilgen | www.kimvanwilgen.com
Integration in the pipeline: Automate everyting Continuous security @kimvanwilgen | www.kimvanwilgen.com
SAST Static Analyses Security Testing Tools:https://www.owasp.org/index.php/Source_Code_ Analysis_Tools We use SonarQube + Find problems early in lifecycle, detailed feedback, scalable - Limited scope, configuration out of scope, false positives & negatives Continuous security @kimvanwilgen | www.kimvanwilgen.com
DAST Dynamic Application Security Testing Tools: https://www.owasp.org/index.php/Category:Vulnerability_Scanning _Tools We use Nessus, Sentinel and ZAP + Tests the application at runtime, realistic view - More complex, harder to track, needs a running instance (late feedback, limitedly scalable, slow) Continuous security @kimvanwilgen | www.kimvanwilgen.com
Continuous security @kimvanwilgen | www.kimvanwilgen.com Dependency checks Eliminate known vulnerabilities Vulnerable libraries We use Jfrog Xray Alternatives • SonaType • OWASP dependency checker • Semmle (variant analysis) 24
Licensing threat assessment Continuous security @kimvanwilgen | www.kimvanwilgen.com
Evil user stories As a Malicious Hacker, I want to gain access to all repositories so that I can look for vulnerabilities and secrets and destroy their entire business. Continuous security @kimvanwilgen | www.kimvanwilgen.com
Secure Defensible coding infrastructure Situational Supporting way awareness of working DecSecOps model Continuous security @kimvanwilgen | www.kimvanwilgen.com
Immutable infrastructure Continuous security @kimvanwilgen | www.kimvanwilgen.com
@kimvanwilgen | www.kimvanwilgen.com Continuous security One of the benefits of using containers, especially in microservices-based applications, is they make it easier to secure applications via runtime immutability — or never- changing — and applying least-privilege principles that limit what a container can do. Tsvi Korren - Chief Solutions Architect at Aqua Security
Continuous security @kimvanwilgen | www.kimvanwilgen.com Immutable infrastructure mindset • Scan infrastructure scripts against the security policy • Configuration and patches are code changes • Apply least privilege principles • Apply pervasive visibility • Systematic workload re-provisioning – difficult to persist across rebuilds Source: Gartner report on cloud security
Continuous security @kimvanwilgen | www.kimvanwilgen.com Testing the infrastructure Compare the infrastructure with CIS best practices, eg admin account, encryption and patch level • Hardening your system with feedback in the pipeline • Auditable approval process of deviations through pull request @securityteam
Secure Defensible coding infrastructure Situational Supporting way awareness of working DecSecOps model Continuous security @kimvanwilgen | www.kimvanwilgen.com
Have security champions Continuous security @kimvanwilgen | www.kimvanwilgen.com
Don’t eliminate all risk Continuous security @kimvanwilgen | www.kimvanwilgen.com
Alignment of security and business value Continuous security @kimvanwilgen | www.kimvanwilgen.com
Learn and adapt first before you break the build Continuous security @kimvanwilgen | www.kimvanwilgen.com
Continuous security @kimvanwilgen | www.kimvanwilgen.com Application Security Verification Standard Unrelevant / Sast / Dast / RAST / other Train for risks we can’t automate
Fix your vulnerabilities Continuous security @kimvanwilgen | www.kimvanwilgen.com
I’ve added over a 100 security rules in SonarQube and sent the top 10 screwups to the team. We sat down and discussed them. They are more aware now. I enabled a dependency check. We had 550 vulnerabilities. We solved more than half by removing an obsolete dependency in the test framework for Opera testing. We ran some critical upgrades. Now we have 17. Continuous security @kimvanwilgen | www.kimvanwilgen.com
Security upfront Continuous security @kimvanwilgen | www.kimvanwilgen.com
Secure Defensible coding infrastructure Situational Supporting way awareness of working DecSecOps model Continuous security @kimvanwilgen | www.kimvanwilgen.com
Automate security Check for logical flaws manually, educate and features and scan against raise context awareness bugs and vulnerabilities
Train for the basics Continuous security @kimvanwilgen | www.kimvanwilgen.com
Contextual awareness Continuous security @kimvanwilgen | www.kimvanwilgen.com
Hack yourself first too Chaos Engineering: Make rare events regular Continuous security @kimvanwilgen | www.kimvanwilgen.com
Continuous security @kimvanwilgen | www.kimvanwilgen.com “Think as an offender will show the real threats of your application and grow awareness from finding out how easy it is.” Troy Hunt, MVP for developer security and creator of ‘Have I been PWNED”
“Did you check the cake for hard and sharp objects before bringing this inside?” Red teaming Continuous security @kimvanwilgen | www.kimvanwilgen.com
Continuous security @kimvanwilgen | www.kimvanwilgen.com Trusted source and lowering our fences
Config as code Immutability SAST Test against DAST CIS config Defensible Dep.check Secure CDN Licensing infrastructure coding SIEM Evil stories Supporting SecLead Situational Train Value based Raise way of awareness Start small awareness working Adapt to context Hack yourself Fix issues Red teaming Detect change Version control DecSecOps model Continuous security @kimvanwilgen | www.kimvanwilgen.com
Continuous security @kimvanwilgen | www.kimvanwilgen.com Sources https://sdtimes.com/developers/gartners-guide-to-successful-devsecops/ https://cybersecurity.isaca.org/static-assets/documents/State-of-Cybersecurity-part- 2-infographic_res_eng_0517.pdf https://www.sans.org/reading-room/whitepapers/critical/continuous-security- implementing-critical-controls-devops-environment-36552 10 Things to Get Right for SuccessfulDevSecOps, Gartner, 2017, IDG00341371 https://www.gartner.com/doc/reprints?id=1-4TI72Y2&ct=180320&st=sb https://www.thoughtworks.com/radar/techniques https://www.mmc.com/content/dam/mmc-web/Global-Risk-Center/Files/MMC- Cyber-Handbook_2016-web-final.pdf Reimagining Security and IT Resilience for a Cloud-Native DevSecOps World, Gartner, 2018
Recommend
More recommend
