Artifacts from processes 

and tools to maintain 

trusted source code and 

verifying and mitigating 

software vulnerabilities
Our Team

2

My Background

Rohit Sethi

CEO, 

Security Compass

• 17 years experience focused on secure 

SDLC with Fortune 1000 customers

• Featured on Bloomberg, CNBC, FoxNews, 

CNN.com, Huffington Post and many others

• “Balancing Act” podcast host interviewing 

product security leaders from Cisco, Adobe, 

Honeywell, JCI, SAP, Dell, Carrier, Goldman 

Sachs, Yahoo, LinkedIn, Xylem & others

Organizations that have not patched this 

Confluence Server and Confluence Data Center 

vulnerability should do so on an emergency basis.

-- Rapid7

-- Kasperskey

CVE-2021-26084: Atlassian Confluence OGNL 

Injection Vulnerability Exploited in the Wild

-- Tenable
This isn’t about Atlassian, 

this an industry-wide problem
After an incident like this, all attention is on:

● Patching

● Detecting & blocking attacks in the wild

● Incident response
7

Reviewing the Root Cause

“The vulnerability is an Object-Graph Navigation Language (OGNL) 

injection...”
8

A Framework for Prevention

Plan and Prevent

Identify Implement

Potential software weaknesses 

for a given product

Controls to mitigate those 

weaknesses

Find and Fix

Validate

Existence of controls and 

absence of vulnerabilities
Nothing will prevent 100% of vulnerabilities, 

we are focused on significant reduction of 

known, preventable vulnerabilities
10

Current State of Best Practice: Software Security

Plan and Prevent

Identify Implement

Potential software weaknesses 

for a given product

Controls to mitigate those 

weaknesses

Find and Fix

Validate

Existence of controls and 

absence of vulnerabilities
11

Current State of Best Practice: Software Security

Plan and Prevent

Identify Implement

Potential software weaknesses 

for a given product

Controls to mitigate those 

weaknesses

Find and Fix

Validate

Existence of controls and 

absence of vulnerabilities

Activities like:

● Static, dynamic & interactive 

application security testing

● Software composition analysis

● Penetration testing and/or bug 

bounties
The “Find and Fix Addiction”
13

Ideal State of Best Practice: Software Security

Plan and Prevent

Identify Implement

Potential software weaknesses 

for a given product

Controls to mitigate those 

weaknesses

Activities like:

● Developer education

● Security requirements

● Threat modeling

Find and Fix

Validate

Existence of controls and 

absence of vulnerabilities

Activities like:

● Static, dynamic & interactive 

application security testing

● Software composition analysis

● Penetration testing and/or bug 

bounties
14
15

What Artifacts Should we Aim For? 

• Should not perpetuate the “Find and Fix Addiction”, need to incorporate “Plan and 

Prevent”

• Needs to recognize the current state of software development with DevOps -> 

certifying a “release” is antiquated

⁃ Focus on process over focus on releases

• To be useful to the broader public, must be easily understood by a non expert

• Needs to protect vendor IP

• Should be practical to implement (e.g. open source & commercial tool supported)

• Software Bill of Materials (SBOM) – separate discussion
16

Current State of Best Practice: Software Vendor Security

Enterprise security certifications are not product/software security certifications
17

Existing Standards Already Implement Holistic Software Security

Industrial Society of Automation 

62443 set of Standards

Payment Card Industry: Software 

Security Framework

NIST: Secure Software 

Development Framework

19

Certification / Labelling Options

• Self attestation to NIST SSDF and/or equivalent software security framework (with 

penalties for non-compliance)

• ISA & PCI Approach: 3rd party life-cycle assessment by accredited auditors
We have an opportunity to measurably 

improve cybersecurity posture forever
Thank You

For more information, contact us at www.securitycompass.com