Real-world supply chains can involve planes, ocean freighters, trains, trucks, and even bike couriers. So it’s no surprise that software supply chains also involve a wide variety of complementary production, distribution, and deployment channels.
One of the challenges with securing software supply chains is that solutions must be combined to address each conduit supporting the entire chain. Patching the libraries your software engineers copied into your final build is insufficient—you must also consider your base images, the packages and platforms brought in via provisioning scripts, and even possibly plugins deployed by admins post-deployment!
Unfortunately, these disparate channels often have different weaknesses and vulnerabilities and require different security approaches.
Watch this webinar with our special guest speaker and expert in open-source software ecosystems, John Speed Meyers, and the vulnerability scanning implementor, Julius Musseau, as they discuss the important perspectives on software supply chains.
What they will go through:
An understanding of today’s sophisticated and multi-channel software supply chains
What are the risks, and how to manage them
Software Supply chains security best practices
Take a look at the big picture and discuss specific techniques tailored to protect some of these critical pieces better.
Open Source Research
A lot of people will claim that open source is everywhere, but how much open source software is actually out there? In this paper, we propose a methodology and associated tool that can analyze Java binaries and determine the proportion of open source that comprises them. The result of our research shows that around 80 to 90% of the software is made from open source.
Ready to start to mitigate risks in your software supply chains?
How To Avoid “All Your Base Are Belong To Everyone!”
As you are probably well aware, access control is the biggest problem in Application Security. OWASP research in 2021 pointed this out, as did Verizon’s well-respected 2022 DIBR report.
Why is this important? The same report points out that web application attacks are the second most frequent attack pattern after DoS. So, if your organization has not been hit in this area, chances are you will be. Get ready!
The good, the bad and the ugly
Be warned; there are no quick fixes! No magical tools resolve this for you. Developers’ first response is mostly to ignore access control as an issue and to make matters worse. Application frameworks rarely provide details about their functionality since it’s not particularly generalizable.
But don’t despair! Approaches to resolve this are mature and well-developed. Watch this webinar with Application Security experts Jim Manico (OWASP Top Ten contributor), Erwin Geirnaert (Co-founder & Chief Hacking Officer at Shift Left Security) and Julius Musseau (CTO at Mergebase) to learn about guidelines, patterns, as well as pitfalls to avoid it.
What will you learn in this course?
– First, What defines the terms “access control” and “authorization,” and why are these still hard to get right?
– The building blocks developers need to know about it:
Learn how to apply the principle of least privilege when building access control in your applications.
Learn how to use the suitable data types for access control decisions
Learn how to build data-centric access control system to avoid Indirect Object Reference (IOR) issues.
We are going to look at some of the building blocks around good access control. Talk about principal lease privilege we want to look at, like what data we should be using at the point of making an ac decision.
– Best protection strategies to prevent it and then one of the more difficult things, indirect object reference. It is data-specific access control, and we’re going to come up with some protection strategies and design principles.
So, if you want to learn more about what makes applications so vulnerable and what you can do about it, this is the webinar you won’t want to miss!
The recording was made on June 20th.
Webinar’s Highlights
What is Access Control and Authorization?
AC is about selectively restricting access in a piece of software right various features and various resource access. Authorization is when you give permission to a particular user or entity to access certain features or data again. In other words, access control is the act of restricting access, and authorization is the act of giving someone access to a specific part of your software.
How do most people do access control?
They use Role Based Access Control (RBAC), which is the most common access control implemented in most web frameworks. Usually, you check in a hard-coded way what role the user is correct. This is a policy enforcement point somewhere in the software where you can check if the user has permission to execute this feature.
However, hard coding has some problems:
It makes “proving” the policy of an application difficult for audit or Q/A purposes.
Any time the access control policy changes to be updated, new code needs to be pushed.
It does not support horizontal ac.
It is often not “automatic” and needs to be “hand-coded” for each application feature.
It does not support multi-tenancy.
Why is it still difficult? What is the challenge?
It is difficult for developers to build. Frameworks rarely provide detailed ac functionality.
It is difficult to test from automated tools. Scanning tools are rarely aware of your custom access control policies.
Best Practices
SQL Integrated.
Access Control Sequence: If you have a big sequence and it is hard to look down everything, protect the steps that will hurt your business
The latest OWASP Top 10 ranks “Cryptographic Failures” as the 2nd worst security problem currently facing software engineers today. In this webinar AppSec experts Jim Manico (OWASP Top Ten contributor), Farshad Abasi (OWASP Chapter Lead), and Julius Musseau will discuss why this is the case, and offer the best practices and resources for developers trying to avoid such failures in their own systems.
As the very recent (and very serious) CVE-2022-21449 shows – this problem never goes away! It’s hard for software practitioners to stay up-to-date, because new critical cryptographic weaknesses and configuration disasters are discovered and disseminated every year, and seemingly tiny benign mistakes can be game over.
Answers to the following questions are critical in avoiding cyber failure:
Should you use Argon2 or bcrypt?
When should you salt things?
What parameters should you feed into your TLS endpoints?
Anything to be careful about with JWT?
Watch the video of our webinar on How To Avoid Cryptographic Failures from June 3rd, 2022
In this webinar, application security heavyweights Jim Manico (OWASP Top Ten contributor), Farshad Abasi (OWASP Chapter Lead), and Julius Musseau will talk about the best thing that can happen to you if your application security team is overwhelmed, overworked and over-worried.
What is OWASP ASVS?
The OWASP Application Security Verification Standard (ASVS) is a balanced way for organizations to approach application security and align it with their organization’s risk appetite and resources.
ASVS is a set of best practices that can be used by any organization, large or small, to assess the security of their applications. It takes a proactive, risk-based approach to secure applications and is designed to be flexible enough for you to customize it for your specific needs.
Are you thinking of establishing a balanced appsec process, or are you looking at fine-tuning your existing process?
What you will learn in this section:
The first application security standard by developers for developers!
That defines three risk levels with 200+ controls.
And gives you a similar value to ISO 27034 for a fraction of the hassle
recording webinar on OWASP ASVS from May 11, 2022
Did you like this webinar? Don’t miss the next ones! Secure your spot today!
In this webinar, application security experts Jim Manico (OWASP top 10’s contributor), Farshad Abasi (OWASP Chapter Lead), and Julius Musseau will go over best practices for rolling out an effective Application Security Toolset to your software development and security teams.
How can you best get started, and how can you best optimize your AppSec toolset over time? Watch this webinar NOW!
How can you best get started, and how can you best optimize your AppSec toolset over time?
Are you just thinking of implementing AppSec tools, or are you looking at optimizing your existing toolset? Watch Jim, Farshad and Julius in this webinar to hear:
What combination of tools gives you maximum protection?
What tool gives you the highest value out of the box?
How are threats likely to evolve, and how to use your AppSec tool set to stay one step ahead of cyber advisories?
Webinar’s Highlights
Definition / Acronyms
SAST – Static Application Security Testing
It looks at the source code. The scanner will investigate the source code of the system, looking for bad coding practices. For example, static application security testing can spot SQL injection or hard-coded tokens and hard-coded passwords.
2. DAST – Dynamic Application Security Testing
It looks at the running applications. If you have the running application, perhaps production, a pilot or a staging environment, the DAST tools enable you to detect security vulnerabilities in running applications using penetration tests. However, it tends to be a very slow process.
It is specifically about open source libraries. It looks at all the open source libraries in a software system. For example, protect your business against the Equifax attack or the log4j problem back in December.In other words, It looks at bad software components and lets everyone know you need to upgrade you need not. The SCA tools are essential because open source reusable libraries are here to stay; everyone’s using them. MergeBase has a research work about open source uses. The results show, for example, that Jira has around 80% at this point.
It is about installing a runtime agent in the programming language, which is usually like the profiling or monitoring API of a core runtime engine and instrumentation API, and you will install an agent at the level of instrumentation to see how objects and classes and the like are executed by the runtime engine. So you are installing an agent at the runtime level of the software and watching how the program runs, not from an external point of view, but from an agent that you have installed within the application itself. Get more visibility supposedly into how the app is running.
5. RASP – Runtime Application Self Protection
It provides personalized protection to applications. It uses the app’s data and state to enable it to identify threats at runtime. It automatically isolates and identifies vulnerabilities.
Matrix – Categorize Cybersecurity tools and Information Security Tools
What are common/typical challenges teams face when implementing these tools?
The challenges faced are:
It lights up a lot of false positive number
It requires an expert operator.
Normally, they get flooded with uh findings right like thousands of findings; what do you do, and how do you prioritize them? And the solution is to bring in an expert to tune.
Application Security Best Practices
Three approaches with a different focus:
SCA – > External Libraries/ Supply Chain
Analyze applications for know vulnerabilities, and secure your software supply chain.
DAST – Test Application Surface
Try to break into production applications. It will catch configuration issues and some of the above vulnerabilities.
SAST – Source code, developed in-house
Analyze source code for bad coding practices
These tools complement each other, and the best practice is to us all there.
Watch if this webinar about Dependabot applies to you and find out how to fix this :).
from the “Webinar Wednesday“ from March 30th, 2022, with Jim and Julius
Why should you care about using Dependabot?
Because if you’re using industry-standard software leader Dependabot, then your devs didn’t fix the recent Log4J problem properly.
If you’re using it, then the tools you’re using now aren’t getting the job done.
In practice, it has a serious implementation flaw: it can only see transitive dependencies (aka sub-dependencies) in languages and dependency managers that support lock files.
Dependabot: Theory vs Reality
In theory, Dependabot is exactly what the world needs to keep software dependency chains safe from known vulnerabilities: tightly integrated with Github; auto-generates pull requests; plugged into Github Security Advisories (GHSA); it also supports a wide range of programming languages and dependency managers.
But in practice it has a serious implementation flaw: it can only see transitive dependencies (aka sub-dependencies) in languages and dependency managers that support lock files.
Do you know any languages that currently DO NOT support lock files?
Java / Maven!
This has some bad implications if you’re using it to protect yourself from Log4J (since Log4J is a Java library).
Compromises in the application layer are now responsible for 40% of breaches. Two years ago that was 24%. Obviously, time to pay attention to application security. OWASP will give you a running start with their Top 10.
Why use OWASP top 10 vulnerabilities?
Imagine if a dozen of the top cybersecurity experts in the world reviewed your software for security problems. Since application security is generally not well covered in university, college, and bootcamp software courses, it’s likely they would probably find a lot of problems!
Of course, hiring even 1 security expert to review your work is out of reach for a lot of software teams – let alone 12 experts. But you can do the next best thing, you can check out the OWASP Top Ten 2021: https://owasp.org/Top10/
What is the OWASP Top 10 list?
The OWASP Top 10 is an important awareness document for web developers and web application security professionals. It represents a broad industrial consensus from cyber security experts about the most critical security risks to web applications.
OWASP Top-10 in-depth
This webinar provides defensive instruction in relation to the OWASP Top Ten to aid developers in authoring secure software. Jim Manico and Julius Musseau covered the OWASP Top-10 (2021 Edition) in-depth:
A01:2021-Broken Access Control
A02:2021-Cryptographic Failure
A03:2021-Injection
A04:2021-Insecure Design
A05:2021-Security Misconfiguration
A06:2021-Vulnerable and Outdated Components
A07:2021-Identification and Authentication Failures
You’re leaving up to 90% of what you run exposed to threats. Today’s software and applications are predominantly built with third-party components. Don’t let third-party vulnerabilities run wild! It isn’t enough to analyze your own code–your Software Composition Analysis (SCA) tools need to also consider any third-party components used by your offering and services.
Learn what you can do to not let third-party vulnerabilities happen
How to ensure your DevOps and DevSecOps teams are equipped with the tools they need to identify new threats
How to integrate remediation tools and processes that consider your entire CI/CD pipeline and code in production
How to develop and implement a complete and accurate software bill of materials (SBOM) process for your code and third-party software
How to apply a mechanism for obtaining detailed reports on risk and suppression
