DIY Continuous Security

Building a security program for free

seceng.guide ·

Use ← → to navigate. Click the slide number to jump.

Agenda

Introductions

  • Who We Are
  • Who You Are
  • What is Continuous Security
  • What We’ll Be Covering

Labs

  • SAST & Exercises
  • DAST & Exercises
  • AI-assisted Code Review

Introductions

Why we created this workshop?

What is Continuous Security?

You may have seen it referred to as “shifting left”

Think about it in the simplest cases: a SQL injection is much easier to fix in the development phase compared to the maintenance phase

The “continuous” part here refers to automation

Image: “Cost of Fixing Security Vulnerabilities Increases”

What is this workshop?

Our goal for this workshop is for you to build familiarity with the concepts of Continuous Security, not the tools. Of course, we’ll use the tools first to get a handle on what we’re doing, but that won’t be our focus.

The idea is for you to take these concepts and apply them to other contexts

We like the tools we recommend in this workshop, but each organization has their own needs and preferences.

This is what the “DIY” part of the DIY Continuous Security refers to: doing it yourself by selecting off-the-shelf open source tools that make the most sense for you, without having to depend on paid products to do everything for you.

Who’s this workshop for?

The intended audience for this workshop are

This isn’t an exhaustive list — it’s just meant more so for assuming a baseline level of experience before we start jumping into workshops.

Feel free to interrupt to ask questions at any time. If there’s something that feels unclear or you run into an error, chances are you might not be the only one!

What will we be covering?

SAST: Static Application Security Testing

DAST: Dynamic Application Security Testing

SCA: Software Composition Analysis

Secrets Detection

AI-Assisted Code Review

Getting started

  1. Create a Github account if you don’t already have one

    • Tell us your username so we can invite you to our organization

  2. Install Docker

  3. Fork & clone seceng-sandbox/jester-social to your computer

    • This will only work after being added to the Github organization
    • No need to do anything with this code — we will be using it for labs later

We will be using the Github Web UI to make our code changes, so don’t worry about setting up a developer environment.

Part 2

Static Application Security Testing

(or, SAST for short)

What is Static Application Security Testing (SAST)?

Fundamentally, it’s automating the code review process

When performing an application security code review, you might ask questions like

SAST tools allow you to answer questions like these automatically, but faster and more efficiently.

SAST for Vulnerability Detection

from django.urls import path
from django.http import JsonResponse
from django.db import connection

def item_view(request, item_id):
    with connection.cursor() as cursor:
        cursor.execute(f"SELECT * FROM store_item WHERE id = {item_id}")
        row = cursor.fetchone()

    if row:
        return JsonResponse({
            "id": row[0],
            "name": row[1],
            "price": row[2],
        })
    else:
        return JsonResponse({"error": "Item not found"}, status=404)

urlpatterns = [
    path("items/<item_id>/", item_view),
]

Enter Semgrep

Semgrep is an open source tool that can automatically detect many types of vulnerabilities in code

These detections are made public as community maintained rules

Let’s run Semgrep against the sample from before.

Image: Semgrep Logo

Running Semgrep

view_item.py
>> python.lang.security.audit.formatted-sql-query.formatted-sql-query
      Detected possible formatted SQL query. Use parameterized queries instead.
      Details: https://sg.run/EkWw

        7| cursor.execute(f"SELECT * FROM store_item WHERE id = {item_id}")

This is feedback that a developer can make sense of without us having to get involved!

It told us the line number, included a sample of the affected code, tells us what we might have done wrong and even makes a recommendation.

How is automating SAST useful?

It frees up time for us to work on other security problems

It increases the impact you can have as a security practitioner

It means you’re not the blocker for providing a baseline level of security

But what are its limitations?

Like all automated tooling, SAST has its limitations.

We need to be aware of these limitations before going into this kind of work, or we risk wasting our time and annoying our coworkers.

SAST Tools Don’t Have Context

SAST tools can only find vulnerabilities they’re designed to look for; this may sound obvious but in practice this means they can only operate on context available in code

SAST tools are meant to augment your capabilities — not replace them.

Cipher.getInstance("AES/ECB/NoPadding");

Cipher.getInstance("AES/GCM/NoPadding");

Static analysis tools can tell the difference between these, but will not be able to tell you that you should probably use something like bcrypt instead.

SAST Tools are False Positive Prone

Static analysis tools can have high false positive rates

Typically you will have some sort of “tuning” stage where you disable rules that are false positive prone

Deploying Static Analysis Tools

For larger organizations and codebases, deploying a static analysis tool is more complicated than just installing it and walking away

Any security tool — not just static analysis ones — need to be set up in such a way that maintenance and overhead is addressed ahead of time, otherwise you risk wasting time and effort