Harness Your Robot Army for Total Vulnerability Management

Transcription

1 Harness Your Robot Army for Total Vulnerability Management 2015 Triangle InfoSeCon Jonathan Knudsen October 8, Synopsys, Inc. 1

2 Contents Security Is Easy Builders and Buyers Software Vulnerabilities Your Robot Army Coders Gonna Code Summing Up 2015 Synopsys, Inc. 2

3 Security Is Easy ;^) 1. Find vulnerabilities 2. Fix vulnerabilities OK. This one is hard Synopsys, Inc. 3

4 Hacking Is Easy 1. Find vulnerabilities 2. Exploit vulnerabilities 2015 Synopsys, Inc. 4

5 Builders and Buyers Builders Create software Write code Use components Examples: Medical infusion pump Automobile Desktop software Mobile apps Nuclear cruise missile Buyers Consume software Provide a service Examples: Hospital Network operator Public utility Military Bank 2015 Synopsys, Inc. 5

6 Software Vulnerabilities 1. Design vulnerabilities 2. Configuration vulnerabilities 3. Code vulnerabilities To improve security, find and fix as many vulnerabilities as you can You will never find all of them Using resources efficiently puts you ahead of the curve 2015 Synopsys, Inc. 6

7 Human Hunters 1. Design vulnerabilities 2. Configuration vulnerabilities 3. Code vulnerabilities Code reviews: slow! Pair programming: slow! 2015 Synopsys, Inc. 7

8 Where Machines Can Help 1. Design vulnerabilities 2. Configuration vulnerabilities 3. Code vulnerabilities 2015 Synopsys, Inc. 8

9 Your Robot Army Configuration scanners For example, Nessus Find old versions of stuff Find default credentials Find incorrect access Source code analysis, a.k.a. static analysis For example, Coverity Software composition analysis, a.k.a. static binary analysis For example, AppCheck Fuzzing For example, Defensics 2015 Synopsys, Inc. 9

10 Source Code Analysis Generally impossible for buyers For locating unknown vulnerabilities Need the source code Need a tool that knows your language Produces some false positives Need somebody knowledgeable to interpret results, review 2015 Synopsys, Inc. 10

11 Static Composition Analysis No source code required good for buyers and builders Software supply chain management tool For locating known vulnerabilities Static analysis of executable code to detect used components Components can be correlated to known vulnerabilities Known vulnerabilities in contained libraries aren t always exposed on external interfaces Gives you a lot more information than you had before Can also correlate to software licenses 2015 Synopsys, Inc. 11

12 Fuzzing No source code required good for buyers and builders Dynamic testing for locating unknown vulnerabilities Fuzzing technique makes a big difference The more legitimate the fuzzer can look, the better Focuses on exposed attack surface The oracle challenge What is failure? How can your fuzzer detect failure? Simple: valid messaging to verify external interface Better: target instrumentation, like valgrind, Asan, etc. Add behavior analysis: how Heartbleed was found 2015 Synopsys, Inc. 12

13 Coders Gonna Code Developers write source code Multiple teams, perhaps Pull in third party components (More developers) Build finished product 2015 Synopsys, Inc. 13

14 Coders Gonna Screw Up Developers are mortal Third party developers are also mortal 2015 Synopsys, Inc. 14

15 Static Analysis Finds bugs in source code Developers fix bugs Static Analysis 2015 Synopsys, Inc. 15

16 Software Composition Analysis SCA Finds third party components Lists known vulnerabilities Update or patch components Static Analysis 2015 Synopsys, Inc. 16

17 Fuzzing SCA Dynamic fuzz testing Find unknown vulnerabilities Fix more bugs Static Analysis Fuzzing 2015 Synopsys, Inc. 17

18 You Never Get All the Way There SCA There are always more bugs Fewer bugs == lower risk Hard to explain to pointy heads Static Analysis Fuzzing 2015 Synopsys, Inc. 18

19 What if You Didn t Write the Software? SCA What are you getting? Trust, but verify SCA still works here Fuzzing still works here Fix by negotiating Apply pressure before paying Or exploit! Fuzzing 2015 Synopsys, Inc. 19

20 Summing Up Security is not exactly easy Applying resources wisely is important Automated tools can help find some vulnerabilities Configuration scanning Source code scanning Software composition analysis Fuzzing Most tools are useful for builders and buyers Most tools are useful for hackers 2015 Synopsys, Inc. 20

21 Thank You Jonathan Knudsen October 8, Synopsys, Inc. 21