BlueHat v17 || Down the Open Source Software Rabbit Hole
•Transferir como PPTX, PDF•
1 gostou•259 visualizações
The document discusses open source software (OSS) security issues and strategies for addressing vulnerabilities. It notes that while open development allows many eyeballs to find bugs, in reality most don't know what to look for and vulnerabilities are still regularly found. It then provides data on vulnerabilities reported over time for several major OSS projects. The document advocates applying a secure development lifecycle and vulnerability management process to address issues early. It also discusses automating scanning of code and binaries for vulnerabilities and integrating these tools into developer workflows.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a BlueHat v17 || Down the Open Source Software Rabbit Hole
Semelhante a BlueHat v17 || Down the Open Source Software Rabbit Hole (20)
Mais de BlueHat Security Conference
Mais de BlueHat Security Conference (20)
Último
Último (20)
BlueHat v17 || Down the Open Source Software Rabbit Hole
- 2. Agenda
- 3. OSS Security Resources https://aka.ms/OSSsecurity
- 13. bashHOLE?
- 17. Not just named vulnerabilities…
- 18. Cathedral and the Bazaar 1999: “Given enough eyeballs, all bugs are shallow.” 2003: Michael Howard & David LeBlanc assert most don’t know what to look for 2006: Coverity & others release reports of selectively scanned Open & Closed source projects, claiming proof Linus’ Law works 2014: Heartbleed, Shellshock, Poodle, etc 2017: … https://www.flickr.com/photos/hades2k/7001927337
- 20. More audience participation! How many vulnerabilities do you think there have been in OpenSSL since Heartbleed?
- 22. Trending Now: compromise OSS integrity http://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-registry http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/index.html https://www.wordfence.com/blog/2017/09/display-widgets-malware/
- 23. Show Me The Data
- 24. OSS Component Vuln Data Slides 1 1 1 4 8 3 4 5 4 2 12 12 4 16 4 24 34 34 8 0 0 0 0 0 0 1 3 0 0 5 1 3 10 10 6 1 16 13 0 5 10 15 20 25 30 35 40 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 CVE Counts by Year OpenSSL Apache Struts
- 25. OSS Component Vuln Data Slides 0 10 20 30 0 20 40 60 80 100 0 50 100 150 200 250 300 0 1 2 3 4 5 0 50 100 150 200 250 300 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 Freetype FFMPEG Chromium Electron
- 27. Data from public sources is limited FFMPEG NVD: 253 CVE Details: 253
- 28. High value data isn’t free FFMPEG NVD: 253 CVE Details: 253 VulnDB: 1,200+
- 29. Efficiency At What Cost? A single application ◦ may have hundreds of different third party libraries implemented ◦ may have multiple copies of the same component or library implemented
- 30. Debate! What should you measure library quality on? ◦ Count of vulnerabilities ◦ Frequency of update releases ◦ Average severity of vulns (CVSS or other) ◦ Existence of POC or Exploit
- 31. OSS Vulnerability Lifecycle and SDL
- 34. Cost to Fix Vulnerabilities The National Institute of Standards and Technology (NIST) estimates that code fixes performed after release can result in 25+ times the cost of fixes performed during the design phase. tl;dr: Pay me now or pay me later… with interest.
- 36. Vulnerability Management Process Identify Issue1 Assess Impact2 Dev & Test Fix3 Deploy Fix4 Post Release5
- 37. OSS Vulnerability Lifecycle Identify Issue Assess Impact Dev & Test Fix Public Release w/ CVE Post Release Identify Issue Assess Impact Dev & Test Fix Public Release Post Release Identify Issue Assess Impact Dev & Test Fix Public Release Post Release Identify Issue Assess Impact Dev & Test Fix Public Release Post Release
- 38. When to Point Fix
- 40. Cloud Architecture and OSS (Generic) Data Center Facility Security HVAC Power Shared HW Network Storage Compute ILO / Serial BIOS / Firmware VM OS - IaaS/PaaS/Other Linux BSD Windows
- 42. Start Operationally Secure Vendor Build and Publish • Guidance • Attestation • Validation Marketplace • Start secure by default • Image health • Better trust decisions Deployment • Secure templates • Hardening guides Running • Stay secure • Baselines • Monitoring Agents
- 43. Zooming in on the Cloud – “Scanning” 100x • Source Code • Intellectual property • Vulnerability • Binary in builds 10x • VM / Infra / OS • Packages • Configuration • Authenticated (Internal) 1x • Edge / Port • Un-Authenticated • Authenticated (web app)
- 44. Automate and Integrate Automate what can be automated ◦ Source Code Scanning ◦ Binary Scanning ◦ Both for IP, Security, and freshness Integrate ◦ The solutions and tools *MUST* be integrated Into your developers workflow and build systems
- 46. Get It Done • Automate everything you can: ◦ Detection and inventorying of OSS implemented in source code, cloud tenants, etc ◦ Notifications of out of date and vulnerable OSS that needs updating ◦ Updating packages - Greenkeeper • Complete a Security Assessment of OSS components prior to use • Routinely update OSS components to current version • Microsoft employee? Go further down the OSS Risk Rabbit Hole and stream the STRIKE presentation. Find it at aka.ms/osssec