Jaap Karan Singh Despite increasing application security budgets, testing platforms and tools, the same security errors are routinely found in applications day after day, year after year. According to a 2017 industry report based on 400,000 scans, applications passed OWASP Top 10 policy only 30% of the time, and this is consistent for the past 5 years. Astonishingly, SQL injections appeared in almost 1 in 3 newly scanned applications over the past 5 years, including last year. The fact that the same flaws are consistently found is evidence of an endemic problem, and so too are reports that show developers are not fixing the vast majority of them. Anecdotally, we know that many companies become so frustrated with the sheer volume of flaws they find and the conflict-ridden process of trying to get developers to fix them, they stop scanning altogether and cross their fingers. The “developer vs security game” is currently an unhappy one, and the only winners appear to be the black hat hackers. However, as software takes over the world and becomes part of everything, every day, and the threat landscape continues to expand, it is time to change the game. Positive security is the fastest and easiest way to improve application security. Imagine a scenario where developers embraced their responsibility for security; where they were taught to write secure code from the start, including in real time, and to actually avoid creating many of the bugs in the first place. Imagine if they could fix secure coding problems as they arise and share that knowledge with their peers, so every developer didn’t have to figure it out for themselves. Imagine if highly skilled security managers and testers could focus on finding and fixing the really challenging, complex bugs rather than sending developers after nebulous minor issues with limited instructions. This presentation showcases the principles and practice of “positive security” and explains why it is an important game changer that will substantially improve application security. * Understanding the conflict security and development and how to change it to a positive * Why moving the focus from finding vulnerabilities to writing secure code is so important * How to motivate developers to think and act with a security mindset every day * A blueprint for making developer security training more simple, scalable and positive * How to ‘shift left’ on the SDLC in a way that helps developers get better at secure coding, as they code * Case studies of success - and what doesn’t work.

1. Singapore | 28 Feb - 01 Mar 2019
Jaap Karan Singh
jaap@scw.io
Co-Founder and Chief Singh, Secure Code Warrior
Why ‘Positive Security’ is the next
software security game changer

2. Singapore | 28 Feb - 01 Mar 2019Working or saving lives?
> Work for
We empower developers to write secure code
> Developer >> Pentester >> Developer
> Help organisations build kick-ass
training awareness programs

3. Singapore | 28 Feb - 01 Mar 2019
> Today’s challenges with
software security

4. Singapore | 28 Feb - 01 Mar 2019
Software developers around the world ~ Evans Data
22M
Source: https://evansdata.com/reports/viewRelease.php?reportID=9

5. Singapore | 28 Feb - 01 Mar 2019
Lines of code written by developers
every year ~ CSO Online
111BN
Source: https://www.csoonline.com/article/3151003/application-development/world-will-need-to-secure-111-billion-lines-of-new-software-code-in-2017.html

6. Singapore | 28 Feb - 01 Mar 2019
Exploitable Security Bugs in every 50 000
Lines of Code
1 to 4
Source: StackOverflow

7. Singapore | 28 Feb - 01 Mar 2019
Security incidents result from defects in the design
or code ~ DHS
90%
Source: https://www.us-cert.gov/sites/default/files/publications/infosheet_SoftwareAssurance.pdf

8. Singapore | 28 Feb - 01 Mar 2019
Of data breaches caused by software vulnerability ~
Verizon
21%
Source: Verizon, Data Breach Report, 2018 (but in there the last 10 years)

9. Singapore | 28 Feb - 01 Mar 2019
of newly scanned applications had SQL injections
over the past 5 yrs ~ Cisco
1 in 3
Source: Cybersecurity as a Growth Advantage, Cisco, 2016

10. Singapore | 28 Feb - 01 Mar 2019

11. Singapore | 28 Feb - 01 Mar 2019
> How did we end up here?

12. Singapore | 28 Feb - 01 Mar 2019
AppSec in 2000
Corporates had a branding website, the
Internet was mostly for geeks
> AppSec was virtually non-existent in corporate world
> Hacking was focussed on exploiting infrastructure
vulnerabilities (bof, race conditions, fmt str*)
> Research on first web app weaknesses
> OWASP started and Top 10 released!
> Penetration testing was black magic

13. Singapore | 28 Feb - 01 Mar 2019
We’ve got bigger problems (Y2K) than worrying
about Application Security

14. Singapore | 28 Feb - 01 Mar 2019
AppSec in 2010
Companies started offering web-based services;
Web 2.0 and Mobile are new
> Penetration testing was THE thing
> Web Application Firewalls will stop everything
> Paper-based secure coding guidelines
> Static Code Analysis Tools (SAST) emerge

15. Singapore | 28 Feb - 01 Mar 2019
Monthly data breaches,
Hackers everywhere,
Privacy, GDPR, PCI-DSS, HIPAA
Putin

16. Singapore | 28 Feb - 01 Mar 2019
AppSec in 2019
Everything runs on software.
Cybersecurity & AppSec are hot topics.
> Pen-testing is still here…
> Static Code Analysis Tools (SAST) is still here…
> Runtime Application Security Protection (RASP)
> Dynamic Application Security Testing (DAST)
> Interactive Application Security Testing (IAST)
> Crowd-Sourced Security Testing (CSST?)
> DevSecOps is getting traction
- Shift left
- Containerisation
- Integrating security and ops into dev
- Security pipelining

17. Singapore | 28 Feb - 01 Mar 2019
AppSec in 2019
Challenge - Pen-testing mostly sucks
DevelopersSecurity Experts

18. Singapore | 28 Feb - 01 Mar 2019
BUILDERS
Know their code
Do not speak
“security”
BREAKERS
Always pointing out
problems
Not developers
SQL Injections
XSS
Object
Deserialization
IDOR
Constructors
JAVA Spring
SWIFT
Angular.JS
vs

19. Singapore | 28 Feb - 01 Mar 2019
AppSec in 2019
Challenge - AppSec is often a bottleneck

20. Singapore | 28 Feb - 01 Mar 2019
Software Developers (Agile)
A BA
B
A
B
A
B
A
B
A
B
Application Security Experts
200
1

21. Singapore | 28 Feb - 01 Mar 2019
AppSec in 2019
Challenge - Security Pipelining is in its infancy

22. Singapore | 28 Feb - 01 Mar 2019
AppSec in 2019
Challenge - Tools mostly suck
> SAST - Expertise, false positives, slow, framework
support
> I/DAST - Expertise, false negatives, slow
> RASP - WAF++, nobody uses block mode, tech
specific
> Testing tools spit out long, mostly inaccurate reports
with often useless advice

23. Singapore | 28 Feb - 01 Mar 2019
AppSec in 2019
Challenge - “Black Hole” of security knowledge

24. Singapore | 28 Feb - 01 Mar 2019
We’re failing to learn from our mistakes

25. Singapore | 28 Feb - 01 Mar 2019
AppSec @ Work

26. Singapore | 28 Feb - 01 Mar 2019
> SHIFT START left
Scale and Make an Impact as an AppSec Pro

27. Singapore | 28 Feb - 01 Mar 2019
SHIFT START left
Solution – Better Pen-Testing
> Bobby’; DROP TABLE pentesting_attitude;
> Provide a FIX more than input_validation();
> Create a JIRA ticket with advise/fix
> Create a pull request (wishful thinking)
> Lessons Learned to dev teams to distribute
knowledge
Less finding problems, more security engineering

28. Singapore | 28 Feb - 01 Mar 2019
SHIFT START left
Solution – Weaknesses vs Controls

29. Singapore | 28 Feb - 01 Mar 2019
Solution – Distribute Knowledge
Application Security
Secure Coding Guidelines
e.g.
● Ensure application logging (Where, What, When, Who, Why)
● Use context encoding on untrusted user input
1

30. Singapore | 28 Feb - 01 Mar 2019
200
Secure Coding Guidelines
1. Ensure application logging (Where, What, When, Who, Why)
2. Use context encoding on untrusted user input
Project X - Secure Coding rules for
<insert your favourite coding framework>
1. Use SecureLogger log_object;
2. Don’t use GetParameter(), Use LibSafe_GetParam()
Solution – Distribute Knowledge

31. Singapore | 28 Feb - 01 Mar 2019
Secure Coding Guidelines
1. Ensure application logging (Where, What, When, Who, Why)
2. Use context encoding on untrusted user input
Project X - Secure Coding rules for
<insert your favourite coding framework>
1. Use SecureLogger log_object;
2. Don’t use GetParameter(), Use LibSafe_GetParam()
Upon Commit
1. Your code violates security rules: You shall not pass!
2. Your code violates security rules: Fill in your get out of jail card
(JIRA ticket)
3. Points++ for delivering secure code
Solution – Distribute Knowledge
200

32. Singapore | 28 Feb - 01 Mar 2019
Application Security
1
Developer fixes issue
● Use TLS() for any sensitive data
Security Vulnerabilities
● Sensitive data not
transported securely
Solution – Learn from Mistakes

33. Singapore | 28 Feb - 01 Mar 2019
Developer fixes issue
● Use TLS() for any sensitive data
Security Vulnerabilities
● Sensitive data not transported securely
Project X - Secure Coding rules for
<insert your favourite coding framework>
1. Use SecureLogger log_object;
2. Don’t use GetParameter(), Use LibSafe_GetParam()
3. Use TLS() for any sensitive data
200
Solution – Learn from Mistakes

34. Singapore | 28 Feb - 01 Mar 2019
> Build a positive
security culture
Break down “us” vs “them” culture

35. Singapore | 28 Feb - 01 Mar 2019
Positive
Security Culture
Create a brand
> People remember a memorable brand
> Make it fun and geeky!
> AppSec are not marketing experts,,get help from
Security Awareness

36. Singapore | 28 Feb - 01 Mar 2019

37. Singapore | 28 Feb - 01 Mar 2019
Positive
Security Culture
Answer the “why”
> Teachable moments
> Make it personal

38. Singapore | 28 Feb - 01 Mar 2019
Positive
Security Culture
Build a community
> Special interest group for those interested in AppSec
and cyber security
> Not a one-time event, self-sustaining community that
carries the culture forward
> Fun events and competitions – write your best
phishing email, lock picking, hack internal applications

39. Singapore | 28 Feb - 01 Mar 2019
Security Champions
Jane Doe John Smith
> Interested in AppSec
> Great grasp of security concepts
> coding_skills++ - best coder in the team
> Well respected by peers
> Not part of other communities
Works with AppSec doing security
engineering
> Interested in AppSec
> Good grasp of security concepts
> Good coding skills
> Well liked by peers
> Part of internal communities
Helps spread the word and drive behaviour
change

40. Singapore | 28 Feb - 01 Mar 2019
Positive
Security Culture
Reward good behaviour
> Cash prize - reward developers for finding security
bugs you would pay pen-tester for
> Level up program
> Peer and executive recognition
> Speeding pass - prove security awareness, introduce
security pipelining and skip manual security checks

41. Singapore | 28 Feb - 01 Mar 2019
Positive
Security Culture
Remember – it’s not easy!
> Crawl…walk…RUN
> Visible management buy-in
> Harder to change mindset of existing employees,
easier to introduce to new starters
If at first you don’t succeed, try again

42. Singapore | 28 Feb - 01 Mar 2019Secure Developers Are Superheroes
Takeaways:
● Demand better outcomes in security testing
● Distribute knowledge to scale AppSec
● Build a positive security culture
● Reward good behaviour

43. Singapore | 28 Feb - 01 Mar 2019
Jaap Karan Singh
jaap@scw.io
Co-Founder & Chief Singh, Secure Code Warrior
> the_end();