Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero - PowerPoint PPT Presentation

Mar 16, 2024 •374 likes •723 views

Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero Day Vulnerabilities The Data Set Applications from over 300 commercial and US government customers Scanned 9,910 applications over past 18 months Ranged in size

Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero Day Vulnerabilities
The Data Set • Applications from over 300 commercial and US government customers • Scanned 9,910 applications over past 18 months • Ranged in size from 100KB to 6GB • Software was pre-release and in production • Internally built, outsourced, and commercial ISV code
▸ Flaw counts ▸ Flaw percentages ▸ Application count ▸ Industry vertical ▸ Risk-adjusted ▸ Application rating supplier (internal, third- ▸ First scan Applicatio party, etc.) acceptance rate n Data ▸ Application type ▸ Time between ▸ Assurance level scans Enterpris ▸ Days to ▸ Language e Metrics remediation ▸ Platform ▸ Scans to remediation ▸ PCI-DSS (pass/ fail) ▸ Scan number ▸ CWE/SANS Top25 Scan ▸ Scan date (pass/fail) Data ▸ Lines of code ▸ OWASP Top Ten (pass/fail) ▸ Custom policies
The latent Vulnerabiliesvs. The Attacks
Top 5 Attacked Web Application Vulnerabilities
Let’s take a closer look at the numbers
Top 3 Vulnerabilities by Language
Top 3 Vulnerabilities by Language
Different developers deliver different vulns
Different developers deliver different Vulnerability distribution by industry ulnerability distribution by industry vulns
Are DEVELOPERs making any progress at eradicating cross- site scripting or sql injection?
Dare we ask, How is the U.S. government sector doing?
a) 34% What percentage of WEB b) 57% applications fail c) 86% OWASP TOP TEN? d) 99%
Who is holding their software vendors accountable?
So I hear you can run applications on smart phones?
a) Receive an A When given an exam on b) Receive a B or worse application security c) Receive a C or fundamentals, worse over half of d) Fail (receive a D or developers… F)
Q UESTIONS ? Chris Wysopal cwysopal@veracode. com @weldpond

Recommend

DATA MINING LECTURE 2 What is data? The data mining pipeline What is Data Mining? Data

DATA MINING LECTURE 2 What is data? The data mining pipeline What is Data Mining? Data mining is the use of efficient techniques for the analysis of very large collections of data and the extraction of useful and possibly unexpected

2.4k views • 94 slides

Web Mining Web Mining Web Mining Web Mining Web mining is the use of data mining techniques

What is Web Mining? Wh t i W b Mi i What is Web Mining? Wh t i W b Mi i ? ? Web Mining Web Mining Web Mining Web Mining Web mining is the use of data mining techniques to automat cally d scover and extract nformat on automatically

774 views • 20 slides

Web Mining Web Mining Web mining is the use of data mining techniques to automatically

What is Web Mining? What is Web Mining? Web Mining Web Mining Web mining is the use of data mining techniques to automatically discover and extract information from Web documents/services (Etzioni, 1996, CACM 39(11)) Web mining aims to

566 views • 22 slides

DATA MINING LECTURE 1 Introduction What is data mining? After years of data mining there is

DATA MINING LECTURE 1 Introduction What is data mining? After years of data mining there is still no unique answer to this question. A tentative definition: Data mining is the use of efficient techniques for the analysis of very large

1.28k views • 62 slides

Observations Regarding Past and Potential Future Mining and Its Impacts At Bokan Mountain, Prince

Observations Regarding Past and Potential Future Mining and Its Impacts At Bokan Mountain, Prince of Wales Island, Alaska: Potential Rare Earth Element Mining and Uranium Mine Remediation Presented at Organized Village of Kasaan Mining Symposium

397 views • 26 slides

THE DATA MINING PIPELINE What is data? The data mining pipeline: collection, preprocessing,

DATA MINING THE DATA MINING PIPELINE What is data? The data mining pipeline: collection, preprocessing, mining, and post-processing Sampling, feature extraction and normalization Exploratory analysis of data basic statistics What is data

2.11k views • 139 slides

Introduction What is data mining? to Data Mining: On what kind of data? Data Mining

Introduction Motivation: Why data mining? Introduction What is data mining? to Data Mining: On what kind of data? Data Mining Data mining functionalities Major issues in data mining 2 Motivation: Necessity is

438 views • 14 slides

LECTURE 1: INTRODUCTION TO DATA MINING Dr. Dhaval Patel CSE, IIT-Roorkee What is data mining?

LECTURE 1: INTRODUCTION TO DATA MINING Dr. Dhaval Patel CSE, IIT-Roorkee What is data mining? Data mining is also called knowledge discovery and data mining (KDD) Data mining is extraction of useful patterns from data sources , e.g.,

1.29k views • 50 slides

Data Mining: A Powerful Data Mining: A Powerful Tool for Data Cleaning Tool for Data Cleaning

Data Mining: A Powerful Data Mining: A Powerful Tool for Data Cleaning Tool for Data Cleaning Jiawei Han Department of Computer Science University of Illinois at Urbana-Champaign Nov. 4, 2003 1 Data mining for data quality assurance

721 views • 40 slides

Modeling Data the different views on Data Mining Views on Data Mining Fitting the data

Modeling Data the different views on Data Mining Views on Data Mining Fitting the data Density Estimation Learning being able to perform a task more accurately than before Prediction use the data to predict future data

517 views • 29 slides

Data Mining: Concepts and Techniques Web Mining Li Xiong Slides credits: Jiawei Han and

Data Mining: Concepts and Techniques Web Mining Li Xiong Slides credits: Jiawei Han and Micheline Kamber; Anand Rajaraman, Jeffrey D. Ullman Olfa Nasraoui Bing Liu 4/9/2008 1 Web Mining Web mining vs. data mining Structure (or lack

997 views • 60 slides

Introduction to Web Mining What is Web Mining? Discovering useful information from the

CS 345A Data Mining Lecture 1 Introduction to Web Mining What is Web Mining? Discovering useful information from the World-Wide Web and its usage patterns Web Mining v. Data Mining Structure (or lack of it) Textual information and

744 views • 31 slides

Contents Text Mining Concept Tasks Twitter Data Analysis with R Twitter Extracting Tweets

Text Mining with R Yanchang Zhao http://www.RDataMining.com R and Data Mining Course Beijing University of Posts and Telecommunications, Beijing, China July 2019 Chapter 10: Text Mining, in R and Data Mining: Examples and Case Studies

904 views • 64 slides

Introduction to Data Mining Methods and Tools by Michael Hahsler Agenda What is Data Mining?

Introduction to Data Mining Methods and Tools by Michael Hahsler Agenda What is Data Mining? Data Mining T asks Relationship to Statistics, Optimization, Machine Learning and AI T ools Data Legal, Privacy and Security

1.02k views • 69 slides

Week 5 Video 2 Relationship Mining Causal Mining Causal Data Mining These slides developed in

Week 5 Video 2 Relationship Mining Causal Mining Causal Data Mining These slides developed in partnership with Stephen Fancsali, Carnegie Learning, Inc. Causal Data Mining Distinct from prediction or correlation mining The goal is not

491 views • 33 slides

Course Content Principles of Knowledge Introduction to Data Mining Discovery in Data

Course Content Principles of Knowledge Introduction to Data Mining Discovery in Data Data warehousing and OLAP Data cleaning Fall 2004 Data mining operations Chapter 9: Web Mining Data summarization

582 views • 30 slides

Da Data Min a Minin ing What at i is it? Ch. 1 I-DM- 1 IRDM 15/16 What is Data Mining?

Da Data Min a Minin ing What at i is it? Ch. 1 I-DM- 1 IRDM 15/16 What is Data Mining? Data mining is the process of extracting hidden patterns from data. An Unethical Econometric practice of massaging and manipulating the

475 views • 24 slides

Web Mining Andreas Andersson Gustav Strmberg Sandra Stendahl Introduction Web mining o

2011-11-30 Web Mining Andreas Andersson Gustav Strmberg Sandra Stendahl Introduction Web mining o Structure mining o Content mining o Usage mining Web usage mining o Acquire the data o Preprocess the data o Detect patterns in the data o

84 views • 5 slides

CS6220: DATA MINING TECHNIQUES Mining Graph/Network Data Instructor: Yizhou Sun

CS6220: DATA MINING TECHNIQUES Mining Graph/Network Data Instructor: Yizhou Sun yzsun@ccs.neu.edu November 16, 2015 Methods to Learn Matrix Data Text Set Data Sequence Time Series Graph & Images Data Data Network Classification

936 views • 38 slides

CS6220: DATA MINING TECHNIQUES Mining Graph/Network Data Instructor: Yizhou Sun

CS6220: DATA MINING TECHNIQUES Mining Graph/Network Data Instructor: Yizhou Sun yzsun@ccs.neu.edu March 16, 2016 Methods to Learn Matrix Data Text Set Data Sequence Time Series Graph & Images Data Data Network Classification

724 views • 54 slides

CS145: INTRODUCTION TO DATA MINING Sequence Data: Sequential Pattern Mining Instructor: Yizhou

CS145: INTRODUCTION TO DATA MINING Sequence Data: Sequential Pattern Mining Instructor: Yizhou Sun yzsun@cs.ucla.edu November 27, 2017 Methods to Learn Vector Data Set Data Sequence Data Text Data Logistic Regression; Nave Bayes for

616 views • 42 slides

Mining Data Streams (Part 1) CS345a: Data Mining Jure Leskovec and Anand Rajaraman Stanford

Mining Data Streams (Part 1) CS345a: Data Mining Jure Leskovec and Anand Rajaraman Stanford University In many data mining situations, we know the entire data set in advance Sometimes the input rate is controlled externally Google

502 views • 34 slides

Web Mining Web Mining to automatically discover and extract information from Web

What is Web Mining? What is Web Mining? Web mining is the use of data mining techniques Web Mining Web Mining to automatically discover and extract information from Web documents/services (Etzioni, 1996, CACM 39(11)) (another definition:

287 views • 15 slides

Discrete Topics in Data Mining Dr. Pauli Miettinen Discrete Topics in Data Mining Universitt

Discrete Topics in Data Mining Dr. Pauli Miettinen Discrete Topics in Data Mining Universitt des Saarlandes, Saarbrcken Winter Semester 2012/13 Intro- 1 Introduction Advanced course in data mining Assumes IR&DM, Machine

740 views • 37 slides