streamline the fix ms vsip 022513
TRANSCRIPT
![Page 1: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/1.jpg)
Streamline the FixDiminish the Impact of Software Vulnerabilities with CAT.NET and TeamMentor Integration in
Visual Studio
![Page 2: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/2.jpg)
Today’s Presenter
Dinis Cruz
Principal Software Architect
Security Innovation
Blog: Blog.diniscruz.comTwitter: @DinisCruz
![Page 3: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/3.jpg)
Today’s AgendaWhat are the challenges?
What’s the best approach?
What process can I apply for better/repeatable results?
How do I select my applications? My tools?
Visual Studio/TeamMentor/CAT.NET demonstration
Development and Security are looking for a better way to identify, verify,
prioritize and fix software vulnerabilities.
![Page 4: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/4.jpg)
Who We AreApplication Security Experts•10+ Years vulnerability research •Security Testing Methodology adopted by SAP, Microsoft, Symantec
•Authors of 8+ books
Products and Services•Standards - Best Practices•Education - CBT & Instructor-Led•Assessment - Software and SDLC
Reducing Application Security Risk•Critical Vulnerability Discovery•Secure SDLC Rollout•Internal Competency Development
![Page 5: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/5.jpg)
Our Approach• Standards: Create security policies, align dev activities with standards and compliance requirements, fix vulnerabilities.
• Education: Create internal expertise through eLearning, Instructor-led and virtual classroom training.
• Assessment: Audit software apps against policies and compliance requirements and recommend remediation techniques.
![Page 6: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/6.jpg)
Life is a BreachCompanies who suffered 1-10 breaches over the past 2 years, as a result of a software app being compromised.
![Page 7: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/7.jpg)
A Process is LackingState they either have no process (like an SDLC) at all, or
an inefficient ad-hoc process for building security into their applications.
![Page 8: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/8.jpg)
What Motivates Action?State there is no formal state that there is no formal
mandate in place to remediate vulnerable application code.
![Page 9: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/9.jpg)
Common Use Cases1. Development teams don’t
know where to go for best practices guidance on software vulnerabilities.
2. There’s a need to communicate and share intelligence around specific vulnerabilities with your team.
3. Teams need to fix vulnerabilities and map to internal policies.
4. There’s a market need for making more sense of static analysis results to get to full-circle remediation.
![Page 10: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/10.jpg)
Where can developers go?
• A software vulnerability has been identified.
• You need to verify it and need more information about it.
• What do you do, and where do you go for guidance?
Use Case 1- Security Team
![Page 11: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/11.jpg)
How can you share the information?
Use Case 1I - Security Team• You’ve verified a software vulnerability.
• You need to communicate the details of that vulnerability or set of vulnerabilities to your team.
• How is this accomplished most effectively?
![Page 12: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/12.jpg)
Integrating with what you already have
Use Case III - Development Team• You’ve verified a given vulnerability, and can now prioritize it.
• You have knowledge internally, or security policies you need to map to.
• How can I do this in a streamlined way?
![Page 13: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/13.jpg)
Doing more with test results
Use Case IV - Development Team with Tools• The tool reports findings.
• You need to make more sense of the results.
• The findings point to guidance specific to the findings.
• Fix what you’ve found. Re-scan.
![Page 14: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/14.jpg)
Determine your risk toleranceUnderstand your level of risk first. Determine your apps
second.•Take an inventory of your high-risk applications.
•Determine the business criticality of those applications.
•What’s your attack probability and how do you define your attack surface?
•Consider the overall business impact, security threats and compliance mandates.
•Rank your applications accordingly.
•Start thinking about the most effective set of testing tools.
![Page 15: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/15.jpg)
Define data and applicationsClassify sensitive data. Then, prioritize your applications. •How sensitive is your data in a given application(s)?
•Does that data pertain to internal mandates or federal regulations?
•Threat modeling can determine threats, attacks, and the frequency and severity they are executed with.
•Rank and prioritize your applications accordingly.
•Compile the most effective set of testing tools.
![Page 16: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/16.jpg)
Prioritize your applicationsRank your applications using a formulaic approach to
measuring risk.
Threat Rating
Sensitive Data Lifespan Compliance
StringencyCustomer-
Facing
Tier 1 Restricted Long High Yes
Tier 2 Private Mid Medium Yes
Tier 3 Public Short N/A No
Application Criteria
![Page 17: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/17.jpg)
Map activity to your criteriaImplement your security testing strategy.
Depth, Breadth, Frequency
Threat Rating
Static Analysis
Dynamic Analysis
Manual Pen Test
Threat Modeling
Complete/Frequency
Complete/Frequency
Complete/Frequency
Complete/Frequency
Tier 1Required/
Major code changes
Required/Major code
changes
Required/Per Milestone
Required/Per Release
Tier 2 Suggested/Monthly
Required/Quarterly
Required/Per Release
Suggested/Per Release
Tier 3 Optional/Quarterly
Required/Annually
Optional/As Needed
Optional/As Needed
![Page 18: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/18.jpg)
Select your toolsSelecting your tool(s) should be the final step before
you start testing.•Apply your rankings to your tools selection.
•Determine your combination of automated vs manual tools.
-Consider how many applications, how much code and time-to-result.
-Do you need them to run on their own, or are they better used for a singular, manual purpose?
-Assume that automated tools cannot target business logic attacks.•Interpret your scan results with remediation in mind
![Page 19: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/19.jpg)
Secure Development GuidanceA Real-Time In-Practice Companion Containing
4500+ Articles of Prescriptive Guidance and Code
![Page 20: Streamline the fix ms vsip 022513](https://reader036.vdocument.in/reader036/viewer/2022062419/558fc10d1a28abe7668b462d/html5/thumbnails/20.jpg)
Sign up for a TeamMentor account:
Take the TeamMentor Challenge!
TeamMentor for the individual, enterprise or partners:
• Go to: https://tm-msft.azurewebites.net/ • This is the web version – a 2-week trial.
• Solve the challenge question and submit.• The winner will receive a new Microsoft Surface RT tablet.
• Full guidance library contains 4,500+ articles• Prescriptive guidance across technologies (.NET, Java, iOS, Android, C/C++)• Single user, cloud instance, business unit, enterprise-wide licensing available.• Partner organization licensing available also.• Contact us: [email protected]