Tactical Security
Improving AppSec Coverage with Fewer Resources

Rich Newman, CISSP, Sales Engineer, Synopsys Software Integrity GroupMay 2023

1

© 2023 Synopsys, Inc.

Rich Newman
13 years in software development

8 years field engineering,
Wind River Operating Systems and Tools
6 years field engineering,
Wind River Test Management
11 years (minus 12 days) field engineering,Coverity and Synopsys
rnewman@synopsys.com
949.466.5283

2© 2023 Synopsys, Inc.

Today’s Agenda
1.
2.
3.
4.
5.
6.

Software Development Process
SASTSCADAST (IAST/Fuzz)
ASOC
Help!

3

© 2023 Synopsys, Inc.

SAST - Static Application Security Testing
SCA - Software Composition Analysis
DAST - Dynamic Application Security Testing
IAST - Interactive Application Security Testing
Fuzz - Malformed protocol testing
ASOC - Application Security Orchestration and Correlation

Software Development Process
Automation

Education

DesignValidate
System/Feature Testing

ProductRequirements

ASOC

Test Phase Verification

Design Phase
Verification

Planning

Fuzz

SW Testing / Test
Phase Verification

Cybersecurity
Requirements

DAST / IAST

Architectural
DesignImplementation4© 2023 Synopsys, Inc.

SCASASTToday’s Agenda
1.
2.
3.
4.
5.
6.

Software Development Process
SASTSCADAST (IAST/Fuzz)
ASOC
Help!

Application
Application
Application
Application
Application

SAST
SAST
SAST
SAST
SAST

SCA
SCA
SCA
SCA
SCA

DAST
DAST
DAST
DAST
DAST

5

© 2023 Synopsys, Inc.

Simple Web Application

6© 2023 Synopsys, Inc.

What are the Components?

7© 2023 Synopsys, Inc.

What are the risks?
Many issues in a small
area of the application
may indicate a designconcern (fever)Too many issues reveals
high technical debt
(general malise)8© 2023 Synopsys, Inc.

Issue Density
Writing invalidated user input tolog files can allow an attacker toforge log entries or inject
malicious content into the logs
• Injection of misleading events• Injection of XSS attacks,
hoping that the malicious log
event is viewed in avulnerable web application• Injection of commands thatparsers (like PHP parsers)
could execute9© 2023 Synopsys, Inc.

Technical Debt
Any code that
decreases agility as theproject matures
Agility decreases asadditional time isneeded to investigate,
resolve and test delayed
issue resolution

Another task on thethings to do list:
Develop an inaccessible
properties file10© 2023 Synopsys, Inc.

IaC – Infrastructure as Code11© 2023 Synopsys, Inc.

Static Application Security Testing

Analyze the entire application
Divide and conquer by components
Understand the risk of the issues identified

Set goals; technical debt, issue density,
OWASP Top 10, etc. KPIs

13

© 2023 Synopsys, Inc.

Today’s Agenda
1.
2.
3.
4.
5.
6.

Software Development Process
SAST
SCA
DAST (IAST/Fuzz)
ASOC
Help!

Application

SASTDAST14© 2023 Synopsys, Inc.

SCA

Automating Risk Awareness

There are 25 components withsecurity risk, how do we prioritize?

15© 2023 Synopsys, Inc.

Jackson-databind Deserialization
Remote Code Execution (RCE)
Triggered policy Exploit:✓ Known exploit✓ Zero-click RCE✓ CVE >= 916© 2023 Synopsys, Inc.

Research17© 2023 Synopsys, Inc.

Vulnerabilities Found at CyRC

18

© 2023 Synopsys, Inc.

What about SAST?
UNSAFE_DESERIALIZATION finds unsafe deserialization
injection vulnerabilities, which arise when
uncontrolled dynamic data is used within an API that candeserialize or unmarshall an object. This security
vulnerability might allow an attacker to bypass securitychecks or to execute arbitrary code.
SAST can detect unsafe and untrusted
deserialization, but the open-sourcecomponent source code must be included in
the analysys, not just the classes

Coverity included jackson-databind-2.4.3.jar(only class files) which were used for theanalysis of the source captured, but not part ofthe captured code which contained this issue

The DISTRUSTED_DATA_DESERIALIZATION checker
reports an issue any time distrusted data is passed
into a deserialization API. An attacker who can control thedeserialized object might be able to subvertaspects of the application functionality. This audit mode
checker flags these code patterns for review.
19© 2023 Synopsys, Inc.

Software Composition Analysis

Use the type of scanning necessary to produce the results needed(detector, signature, binary, snippet, etc.) - some require manualvalidation
Use policies to prioritize, someone has already done the ethical hacking
and risk assessment for you!
When a quick component update is not practical, use the research
provided to understand the risk and mitigation20© 2023 Synopsys, Inc.

Today’s Agenda
1.
2.
3.
4.
5.
6.

Software Development Process
SASTSCADAST (IAST/Fuzz)
ASOC
Help!

Application

SASTDAST

21© 2023 Synopsys, Inc.

SCA

Ethical Hacking (DAST)
Many tools may be used toautomate ethical hacking,sending compromising data to
an application and reviewing
responses

Products like IAST deploy
agents to watch and validate
issues as web applications
are exercised22© 2023 Synopsys, Inc.

The password used via
the JDBC API to accessthe local database wasweak

A weak databasepassword allows lateralhacking from acompromised host toaccessible databases23© 2023 Synopsys, Inc.

What about SAST?
Dynamic testing may not havebeen required to detect thisissue
But SAST only detected thehardcoded password in a test
program (also a no-no)
The password is hardcoded in
appContext-jdbc.xml which isok if the file is encrypted andaccess is limited

24© 2023 Synopsys, Inc.

Fuzzing
Applying additional automation, afuzzer may send all kinds of data to
the application endpoints
In combination with DAST, this is a
powerful detection system25© 2023 Synopsys, Inc.

15 newissues
detected!

26© 2023 Synopsys, Inc.

Dynamic Application Security Testing

Automate whenever possible
Results may take investigation

Correlation with other tools is beneficial

27© 2023 Synopsys, Inc.

Today’s Agenda
1.
2.
3.
4.
5.
6.

Software Development Process
SASTSCADAST (IAST/Fuzz)
ASOC
Help!

28

© 2023 Synopsys, Inc.

LateralHacking
TechnicalDebt
Clickjacking

Issue Density
Design Concern

29© 2023 Synopsys, Inc.

Zero-Click RCE
Oracle Attack

Today’s Agenda
1.
2.
3.
4.
5.
6.

Software Development Process
SASTSCADAST (IAST/Fuzz)
ASOC
Help!

30

© 2023 Synopsys, Inc.

Thank You!
Rich Newman
rnewman@synopsys.com
949.466.5283

31© 2023 Synopsys, Inc.