AppSec 2.0:
Reimagine AppSec with
Runtime Analysis
OWASP LA Meetup
August 23, 2023
KIRAN KAMITY, CEO AND FOUNDER, DEEPFACTOR

What we’ll cover today:
1. Limitations of first-gen AppSec tools
2. AppSec 2.0 powered by runtime
3. What can it help us accomplish?
A. Runtime Enriched SCA
B. Runtime Security
4. Technical deep dive & Demo# # #Alert Fatigue w/ SCA?

//

// AppSec 2.0
Correlate
Prioritize SCA & SBOM
findings based on usage

Scan (OSS or Containers)

Run• SCA scan at runtime• Detect unknown vulns by observing runtime

Generate SBOM and detect known vulns by scanningdependencies & containers during dev and CI

Integrate
With dev and CI tools

// How Can Runtime Visibility Turbocharge AppSec

1. Runtime
Enriched SCA
Correlate SCA
scans withruntime toprioritize CVEs
that matter andremove unusedpackages

Dev

2. Runtime
Analysis In
Dev & Test
Identify unknown
vulnerabilities that
can’t be detected by
SAST/SCA byanalyzing runningapps

3. Runtime
Container
Scans
Scan containers/
dependencies forCVEs in K8S
environments

4. Runtime
Security
In ProdDetect insecure
file, network &memory
behaviors forcompliance with
SOC2 & other

Prod

DEEPFACTOR CONFIDENTIAL 2022. ALL RIGHTS RESERVED.

5

Runtime Software
Composition Analysis# # #// The Holy Grail: Prioritize Based On Actual Usage
TOTAL

1336

VULNERABLE

569

SEVERITY64

Provided by
Static SCA Scan

CVSS >8 score

USED
Actual Data for ‘Bank ofAnthos’ application
with 9 microservices

11

Prioritized based on usage

// Filtering SCA False Positives & Reducing Alerts
USAGE

APPLICABILITYREACHABILITYEXPLOITABILITYTOPOLOGY

SEVERITY

// Reachability & Usage: Technical Approaches
Runtime Analysis
Ability to detect reachable modules independencies
Support for OS packages used incontainers
Ability to detect actual usage fordependencies and/or OS packages
Ability to detect dynamically loaded
modules (such as reflections)De-prioritization of deadcode/unused
code
Language Agnostic

Call Graph Analysis

Runtime Analysis &Security# # #// Detecting Insecure Behaviors at Runtime
Runtime
Security•

Execution•

File system behavior•

System calls•

Remote code execution•

Library behavior•

Memory behavior•

Network behavior•

Privilege escalation•

Buffer overflow•Secrets
DEEPFACTOR CONFIDENTIAL 2022. ALL RIGHTS RESERVED.

11

Technical Deep-dive & Demo# # #// Userspace Interception vs eBPF
DeepfactoreBPF

Dev (shift left runtime security &correlation with SCA)

Ops (Live threat detection)

LD_PRELOAD & language agents

Enabling eBPF in the host OS

Granularity

Enable at a process/container level

Enable at host level

Performance Overhead

Low

Low

Language Agents

Visibility into classes loaded etc.
(required for correlation with SCA)

No visibility at the language agent level

Support for AWS Fargate, Lambda w/
containers, AWS ECS, Docker Swarmetc..

Supported (Docker build w/ libdf.so)

No support

Visibility into userspace of process

Yes (visibility into certificates, memory
allocation behaviors, process behaviors..)

No visibility above system call layer

Best suited forTechnical Approach// Observing Running Apps For Various Deployment Types•

Monolithic applications••Containers••

dfctl run -a "my application" --docker-run DOCKER_RUN_OPTIONS --image IMAGE

Kubernetes••

dfctl run -a "my application" --cmd COMMAND_WITH_ARGUMENTS

helm --install df-webhook-stable -n df-webhook deepfactor/webhook --setclusterName=CLUSTER_NAME_OF_YOUR_CHOICE --create-namespace -f webhook-override.yaml

Docker Swarm, AWS ECS, Lambda w/ container …
•docker build -f Dockerfile.df --build-arg "APP_IMAGE=${APP_IMAGE}" --build-arg "APP_IMAGE_ID=`docker inspect${APP_IMAGE} --format '{{.Id}}'`" --build-arg "DF_APP_NAME=my application" .

DEEPFACTOR CONFIDENTIAL 2022. ALL RIGHTS RESERVED.

14

// Demo

// Learn More?
Deepfactor
Free Trial

An integrated approach to next-gen AppSec:
SCA, SBOM, Container Scans, Runtime
SCA & Runtime Security

SCA 2.0
Whitepaper

A Framework to Prioritize Risk, Reduce
False Positives, and Eliminate SCA AlertFatigue”

Questions?
###Thank you
Kiran Kamity
Connect on Linkedin
Email: kiran@deepfactor.io