Secure App Aspirations: Why it is very difficult in the real world
-
Upload
ollie-whitehouse -
Category
Technology
-
view
445 -
download
1
description
Transcript of Secure App Aspirations: Why it is very difficult in the real world
![Page 1: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/1.jpg)
Secure App Aspirations: Why it is very difficult in the real world
![Page 2: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/2.jpg)
Why it’s difficult
![Page 3: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/3.jpg)
Secure Apps, Applications & Code
• Developed using: Waterfall / Agile / Wagile etc..
• Secure code costs: ~14% more*
• Microsoft’s SDLC is too expensive for most
• BSIMM is far more practical
• Segregation costs
![Page 4: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/4.jpg)
Accepted wisdom
• Requirements / Stories: Risk review
• Design / Architecture: Threat model and review
• Implementation: Secure* frameworks and code review
• Test: Fuzzing, penetration tests etc.
• Sustainment: DiD and quick patching
![Page 5: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/5.jpg)
Architecture assessment: challenges
• Data flows
• Component functionality knowledge
• Framework selection
• Security capability knowledge
![Page 6: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/6.jpg)
Threat modelling
• Teams: rarely have the skills
• All: see it as a chore / gate
• Distributed teams make it complex
• Natural ability for geeks to communicate also a challenge
• COTS / components make it complex
![Page 7: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/7.jpg)
Threat modelling: Example
Web app that uses full patched JQuery
What’s the threat?
![Page 8: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/8.jpg)
Threat modelling: Example - Reality
![Page 9: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/9.jpg)
Code: where is it coming from?
![Page 10: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/10.jpg)
Code: where is it coming from?
source: https://sourceclear.com/
![Page 11: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/11.jpg)
Code review
![Page 12: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/12.jpg)
Code review: static analysis example
![Page 13: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/13.jpg)
Code review
![Page 14: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/14.jpg)
Code review
• Good code review is hard
• Good code reviewers are rare
• Difficult to keep people focused (~3 hours a day)
• Most reliable vulnerabilities are logic which need confidence, understanding and time
![Page 15: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/15.jpg)
DevOps
![Page 16: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/16.jpg)
DevOps: Network Zones Ideal
![Page 17: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/17.jpg)
DevOps: Network Zones Reality
![Page 18: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/18.jpg)
General developer, test & ops hygiene
• Often high privileges on their box
• Responsible for own patching
• External e-mail / web on machines
• Test often contractors due to flux requirement
• Code signing certs in CVS etc.
![Page 19: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/19.jpg)
Beyond: Dev Ops – cloud services!
![Page 20: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/20.jpg)
But…
No one has the source code!
![Page 21: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/21.jpg)
Why security via obscurity might not work…
![Page 22: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/22.jpg)
Why security via obscurity might not work…
Chinese case study
![Page 23: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/23.jpg)
Why security via obscurity might not work…
!Chinese case study
![Page 24: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/24.jpg)
Why security via obscurity might not work…
![Page 25: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/25.jpg)
Why security via obscurity might not work…
![Page 26: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/26.jpg)
Final thought….
![Page 27: Secure App Aspirations: Why it is very difficult in the real world](https://reader033.fdocuments.us/reader033/viewer/2022061213/547bb193b4795968098b4d9f/html5/thumbnails/27.jpg)
UK Offices
Manchester - Head Office
Cheltenham
Edinburgh
Leatherhead
London
Milton Keynes
North American Offices
San Francisco
Atlanta
New York
Seattle
Austin
Australian Offices
Sydney
European Offices
Amsterdam - Netherlands
Munich – Germany
Zurich - Switzerland
Thanks? Questions?
Ollie [email protected]