https://www.meetup.com/SoftwareSecurityNetherlands/

1. Welcome bij
First Software Security Netherlands meet up
Delft, May 18, 2017
Sponsored by:
https://www.meetup.com/SoftwareSecurityNetherlands

2. Goal of this group
Make Software Security challenges visible
Collaborate and learn together the practices across organizations that help them deliver secure
software
Promote defensive programming strategies

3. Introductions
Name :
Role at work :
Work background :
How did you hear the group / event ?
How do you like to contribute to the group ?
What are your expectations ?

4. Today’s Agenda
What’s new in OWASP Top 10 2017?
Introduction to Docker Security
Web Security Automation Strategies / Open House

5. What’s new in OWASP Top 10

6. The OWASP Top 10 2017
……… from the beginning of time
2010
2013
2017
…. To raise awareness about application security by identifying some of the most critical risks
facing organizations

7. The Data for OWASP Top 10 2017
11 large datasets: 8 consulting companies, 3 product vendors
Vulnerabilities gathered from over 50,000 real world applications and APIs
Prioritized with exploitability, detectability, and impact
Still in beta stages, the Top 10 list presented here is highly subjected
to change based on community feedback

9. Additions, Deletions, and Merges
2017-A7: Insufficient Attack Protection
2017-A10: Unprotected APIs
2013-A10: Unvalidated Redirects and Forwards
2013-A4: Insecure Direct Object References
+
2013-A7: Missing Funtion Level Access Control  2013-A4: Broken Access Control

10. Application Security Risks

11. 2017 - A4 – Broken Access Control
Demo

12. 2017 - A7 Insufficient Attack Protection
Demo

13. 2017 - A7 Unprotected APIs
Case Study

14. 2013 – A10 Unvalidated Redirects and Forwards
Case Study

15. :q!

16. Introduction to Docker Security

17. Docker – What is this containerization?

18. Docker – Challenges with downloading and installing software
Is there a documentation, tutorials, inconsistent documents
Where is it located? Do I need to run it with a different working directory
How to start, stop?
Is it a service? Do I need to change configuration files?
Dependencies
Security
Shared library updates
Which platform?
Which Operating System?
Portable format?
Executable
Source code download and building it?

19. Hardware
Kernel, Drivers
Libraries
(Win32)
OS Applications
(CMD,
powershell)
Applications
mysql, dotnet
Libraries
(Win32)
OS Applications
(CMD,
powershell)
Applications
mysql, dotnet
Libraries
(Win32)
OS Applications
(CMD,
powershell)
Applications
mysql, dotnet
Libraries
(Win32)
OS Applications
(CMD,
powershell)
Applications
mysql, dotnet
Hardware
Kernel, Drivers
Libraries (Win32)
OS Applications (CMD, powershell)
Applications mysql, dotnet
Isolation is approximately equal to security

20. Process isolation
Network Isolation
File System Isolation
Users Isolation
Registry Isolation
Environment Variables
Docker security – Isolation models
*

21. Linux isolations
• http://man7.org/linux/man-pages/man7/namespaces.7.html

22. Isolation – Process
• Get-Process

23. Isolation – File System
• ls C:

24. Isolation – Network
• ipconfig

25. Isolation – Environment Variables
• ls env:

26. Isolation – Registry
• ls hkcu:
• Get-PSDrive

27. Isolation – Users and Groups
• Get-LocalUser

28. Scanning docker images for known vulnerabilities
https://dockerbench.com/