WIXLIB

OWASP BeNeLux 201723/11/2017Assessment Exercise Use SAMM to evaluate thedevelopment practices in your own company Focus on Governance Business Function Applicable to both Waterfall and Agile models Using distributed sheets and questionnaires (toolbox)OWASP Benelux 2017 - Secure Development TrainingAssessment wrap-up What’s your company’s score ? What’s the average scores for the group ? Any odd ratings ?OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win28

OWASP BeNeLux 201723/11/2017ConstructionBusiness FunctionOWASP Benelux 2017 - Secure Development Training12 Security PracticesOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win29

OWASP BeNeLux 201723/11/2017Threat Assessment1. The goal of this practice is to focus on the attacker perspective of thingsTo make sure that security is not only functionality-drivenRemember that software security white black2. Very common practice in safety-critical systemsLess so in others3. This is where “the magic” kicks inYour imagination is the limitOWASP Benelux 2017 - Secure Development TrainingThreat AssessmentOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win30

OWASP BeNeLux 201723/11/2017Security Requirements1. Goal is to make security specification more explicitTurn security into a positively-spaced problem2. Source of security requirements Compliance Risk Functionality Quality3. Requirements should be specified in a S.M.A.R.T. wayOWASP Benelux 2017 - Secure Development TrainingSecurity RequirementsOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win31

OWASP BeNeLux 201723/11/2017Secure Architecture1. Key practice for securityPoor decisions at this step can have major impact,and are often difficult (or costly) to fix.2. CharacteristicsTake into account security principlesRisk is a factor of all components (incl. 3rd party)3. Use proven solutionsDon’t roll you own cryptoUse company standards and best practicesOWASP Benelux 2017 - Secure Development TrainingSecure ArchitectureOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win32

OWASP BeNeLux 201723/11/2017Assessment Exercise Use SAMM to evaluate thedevelopment practices in your own company Focus on Construction Business Function Applicable to both Waterfall and Agile models Using distributed sheets and questionnaires (toolbox)OWASP Benelux 2017 - Secure Development TrainingAssessment wrap-up What’s your company’s score ? What’s the average scores for the group ? Any odd ratings ?OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win33

OWASP BeNeLux 201723/11/2017VerificationBusiness FunctionOWASP Benelux 2017 - Secure Development Training12 Security PracticesOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win34

OWASP BeNeLux 201723/11/2017Design Review security assessment of attacksurface, software design andarchitecturesoftwaredesign securityreview lightweight activities formalinspection of data flows & securitymechanisms enforcement of baselineexpectations for conducting designassessments and reviewing findingsbefore releases are accepted.cross-checksecuritydesign bestpracticesensureknown risksare covered Assess and validate artifacts to understand protection mechanismsOWASP Benelux 2017 - Secure Development TrainingDesign ReviewOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win35

OWASP BeNeLux 201723/11/2017Implementation ReviewAssessment of source code:Start vulnerability discovery lightweight checklists inspect critical software related mitigation activities establish secure coding baselineImproveWill require tool investment: Language specific Basic open source toolingMature Automation Increase coverage / efficacy Integrate in development Produce audit evidence Test & production release gates Commercial tools maturingProcess & education important!OWASP Benelux 2017 - Secure Development TrainingImplementation ReviewOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win36

OWASP BeNeLux 201723/11/2017Security Testing Based on security & compliancerequirements / checklist of commonvulnerabilities Manual testing can be done, scaled withtooling: intercepting proxy and/orscannerDynamic securitytesting Detected defects will require validation,risk analysis & recommendations to fix Automate to repeat tests for each release Introduce security test-drivendevelopmentpenetrationtesting automationDetectvulnerabilities &misconfigurations Test results to be reported to & acceptedby owner for each deploymentOWASP Benelux 2017 - Secure Development TrainingSecurity TestingOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win37

OWASP BeNeLux 201723/11/2017Assessment Exercise Use SAMM to evaluate thedevelopment practices in your own company Focus on Verification Business Functions Applicable to both Waterfall and Agile models Using distributed sheets and questionnaires (toolbox)OWASP Benelux 2017 - Secure Development TrainingAssessment wrap-up What’s your company’s score ? What’s the average scores for the group ? Any odd ratings ?OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win38

OWASP BeNeLux 201723/11/2017OperationsBusiness FunctionOWASP Benelux 2017 - Secure Development Training12 Security PracticesOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win39

OWASP BeNeLux 201723/11/2017Issue ManagementPrepare for WHEN, not IF!Symptoms of malfunctioning SDLC handling vulnerability reports and operational incidents lightweight assignment of roles formal incident response &communication process Use vulnerability metrics and root-cause analysis to improve SDLC spoc per team & security response team communication & information flow is key! patch release process & responsible/legal disclosureOWASP Benelux 2017 - Secure Development TrainingIssue ManagementOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win40

OWASP BeNeLux 201723/11/2017Environment Hardening Underlying infrastructure hardening & patching Track (3rd party) libraries & componentsTOP-10 - A9 – Using Known Vulnerable Components Add WAF layer (virtual patching)ModSecurityMalicious web trafficLegitimate web trafficPort 80Web llWebServerOWASP Benelux 2017 - Secure Development TrainingEnvironment HardeningOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win41

OWASP BeNeLux 201723/11/2017Operational EnablementSupport users & operatorsSecurity documentation!Feed/document application security logs into SIEMLightweight documentation operational security guidesChange management & end to end deployment integrityEven more important for outsourced development!OWASP Benelux 2017 - Secure Development TrainingOperational EnablementOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win42

OWASP BeNeLux 201723/11/2017Assessment Exercise Use SAMM to evaluate thedevelopment practices in your own company Focus on Deployment Business Functions Applicable to both Waterfall and Agile models Using distributed sheets and questionnaires (toolbox)OWASP Benelux 2017 - Secure Development TrainingAssessment wrap-up What’s your company’s score ? What’s the average scores for the group ? Any odd ratings ?OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win43

OWASP BeNeLux 201723/11/2017Setting the Target/Roadmap1. Roadmap templates can provide direction for targetsWhat type of company are you ?2. Take into account the company’s risk appetite3. Only include activities where you see added value for thecompany, even for lower levels4. SAMM activities have dependencies – use them !5. Think about links with other practices in the companyE.g., training, release management, OWASP Benelux 2017 - Secure Development TrainingStaged RoadmapSecurity Practices/PhaseStrategy & metricsPolicy & ,522,5Security Requirements0,51,523Secure Architecture0,51,523Education & GuidanceThreat AssessmentDesign Review0122,5Code ent Hardening2,52,52,52,5Operational Enablement0,50,51,53Security TestingVulnerabilityTotal Effort per Phase7,57,57,5OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win44

OWASP BeNeLux 201723/11/2017Improvement Exercise Define a target for your company andthe phased roadmap to get there Focus on the most urgent/heavy-impact practices first Try balancing the complexity and effort of the different stepupsOWASP Benelux 2017 - Secure Development TrainingConclusion Applying SAMMLightweight assessment of 12 security practicesYour thoughts: Representative summary ? New insights learned ? Anything not covered ? OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win45

OWASP BeNeLux 201723/11/2017Today’s Agenda1. Introduction to SDLC and SAMM2. Applying SAMMMethodologyAssessment GovernanceAssessment ConstructionAssessment VerificationAssessment OperationsSetting Improvement Targets3. Secure Agile development4. SDLC Tips and tricks5. Wrap-upOWASP Benelux 2017 - Secure Development TrainingAgile Models: ScrumOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win46

OWASP BeNeLux 201723/11/2017Agile & Secure development: a mismatch?Agile Dev.SecuritySpeed & FlexibilityStable & RigorousShort cyclesExtra activitiesLimited documentationExtensive analysisFunctionality-drivenNon-functionalOWASP Benelux 2017 - Secure Development TrainingSecure Agile is enablement, rather than controlscalabilityOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win47

OWASP BeNeLux 201723/11/2017Secure Agile – Where’s the difference ?PeopleProcess Roles & Responsibilities Activities Deliverables Control GatesRiskTrainingKnowledgeTools &Components Standards & Guidelines Compliance Transfer methods Development support Assessment tools Management toolsSecAppDev 2013OWASP Benelux 2017 - Secure Development TrainingSecure Agile: general principles Make security a natural part of the process, but don’t overdo Lightweight, in-phase and iterative Preventive and detective controls Be involved at key moments in the process Leverage important agile concepts Small steps at a time (i.e. continuous improvement)OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win48

OWASP BeNeLux 201723/11/2017User Stories Capture security requirements, policiesand regulations in user stories Simple, concrete and actionable Reusable? Mark all user stories with security labels Integrate security into user stories as: Definition of Done Acceptance criteriaOWASP Benelux 2017 - Secure Development TrainingThreat Modelling & Abuser Stories Consider writing application security risks as stories Security stories: “As a developer, I want to prevent SQLi intomy application” Not a real user story (not relevant for product owner,but to help the development team) Never really finished Thinking like the bad guy: “User X should not have access tothis type of data” Think about what users don’t want to and can’t do,how to trust users, what data is involved, OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win49

OWASP BeNeLux 201723/11/2017Sprint Planning Features to be implemented per sprint are selected duringsprint planning. Ensure security tasks are not “stuck” on the backlog Presence of security-savvy person during sprintplanning Establish rules upfront to deal with security stories Security labels can be used to drive selectionOWASP Benelux 2017 - Secure Development TrainingExample: MS SDL-Agile Basic approach: Fit SDL tasks to the backlog as nonfunctional stories Non-Technical vs. Technical Requirement vs. Recommendation Each SDL task goes in one of three types of requirements:EverySprintBucketOneTimeOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win50

OWASP BeNeLux 201723/11/2017Example: Every-Sprint Requirements(excerpt) All team members must have had security training in thepast year All database access via parameterized queries Fix security issues identified by static analysis Mitigate against Cross-Site Request Forgery Update Threat models for new features Use Secure cookies over HTTPS Link all code with the /nxcompat linker option Encrypt all secrets such as credentials, keys and passwords Conduct internal security design reviewOWASP Benelux 2017 - Secure Development TrainingExample: Bucket Requirements (excerpt)Bucket A: Security Verification Perform fuzzing (network/ActiveX/File/RPC/ ) Manual and automated code review for high-risk code Penetration testingBucket B: Design Review Conduct a privacy review Complete threat model trainingBucket C: Planning Define or update the security/privacy bug bar Define a BC/DR planOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win51

OWASP BeNeLux 201723/11/2017Example: One-Time Requirements(excerpt) Create a baseline threat modelEstablish a security response planIdentify your team’s security expertUse latest compiler versionsOWASP Benelux 2017 - Secure Development TrainingSecurity testing Automated testing is an important element in agile qualitycontrol For security, this can be realized by: Unit testing (e.g., authorisation checks, logging, ) Regression testing Static analysis (SAST) based on coding guidelines Dynamic analysis (DAST) based on scenarios and/orvulnerability tests FuzzingOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win52

OWASP BeNeLux 201723/11/2017Thou shall use Iteration Zero Many agile projects start with an “Iteration Zero” toGet the team togetherChoose tools and frameworksGet to know the domain This is an opportunity for security too, to Assign security responsibles Select security tools Determine risk levelsOWASP Benelux 2017 - Secure Development TrainingSecure Agile process: key take-aways Ensure that security-savvy people are involved at importantphases: Sprint planning (to enhance/verify requirements) Development (daily follow-up) Review (to support acceptance) Retrospective (to improve dev. Practices for security) Different profiles can be distinguished: Security architect Security engineer Risk Manager/GovernanceOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win53

OWASP BeNeLux 201723/11/2017Secure Agile Tool Chain: general principles Secure agile is about enabling, rather than controlling Embedding security tools to support development Given short sprint cycles, automation is important. Good tools: Work continuously (to avoid developers beingblocked) Integrate well into developer’s world Avoid causing too much overhead or confusion Evaluate carefully which tools to implement (and which toavoid)OWASP Benelux 2017 - Secure Development TrainingSecure Coding Integrate security tools in the development IDE’s: Support for secure coding guidelines Static analysis tools Ensure common development environment: Programming run-time Security components (e.g., SSO IdP’s, .) Proper source control and versioningOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win54

OWASP BeNeLux 201723/11/2017Security testingDaily BeforereleasePer sprint Unit tests StaticAnalysis Regressiontests DynamicAnalysis PeerIntegrated with backlogs where appropriatereviews Fuzzing PenetrationtestingOWASP Benelux 2017 - Secure Development TrainingSecure Build Central build, using central configuration files Consider: Code signing Obfuscation OWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win55

OWASP BeNeLux 201723/11/2017Secure Deploy / DevOps Automated deploy, using central configuration files Consider: Random key generation Appropriate key/certificate protection (config files,key stores, ) Proper hardening of application servers Security appliance configuration (e.g., WAF) Security monitoring OWASP Benelux 2017 - Secure Development TrainingHybrid models Many companies are combining waterfall and agile Studies indicate better resulting quality For security, easier to hook into E.g., full architecture cycleOWASP Benelux 2017 - Secure Development TrainingSecure Development Training by Bart De Win56

OWASP BeNeLux 201723/11/2017Best Practices / Lessons Learned Use small steps at a time – the agile way Build on agile concepts (backlog, retrospective) Find a way to prioritize security in the planning Use automation as much as possible Review samples independent of project sprints Rely on security champions E.g., security requirements, design review, code review Agile should not be an excuse for not having documentationOWASP Benelux 2017 - Secure Development TrainingToday’s Agenda1. Introduction to SDLC and SAMM2. Applying SAMMMethodologyAssessment GovernanceAssessment ConstructionA

Best Practices Bart De Win Bart.DeWin@owasp.org OWASP Benelux 2017 - Secure Development Training . will reduce configuration management and incident response costs by 75 percent each. OWASP Benelux 2017 - Secure Development Training . The goal of this practice is to focus on the attacker perspective of things