We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byMarcus Mitchell
Modified about 1 year ago
© 2008 All Right Reserved Fortify Software Inc. Hybrid 2.0 – In search of the holy grail… A Talk for OWASP BeNeLux by Roger Thornton Founder/CTO Fortify Software Inc 2
© 2009 All Right Reserved Fortify Software Inc. Before we Begin: Expectations Objectives Agenda
© 2009 All Right Reserved Fortify Software Inc. About Your Presenter 22 years of Engineering (“building stuff”) in the Silicon Valley –Semiconductors –Operating Systems –Development Tools –Brokerage / E-Commerce The Last 6 years working on Securing that Stuff –Founder & CTO of Fortify Software
© 2009 All Right Reserved Fortify Software Inc. A Simple, Reasonable, Question…. 5 Unfortunately not so simple to answer… If I run software, am I putting my business, data, customers or even life on earth at risk? If so, how serious is the threat?
© 2009 All Right Reserved Fortify Software Inc. Three Basic Approaches Hard to know if your “experts” are as good as the bad guy Prohibitively expensive to do on a regular basis No advantage over the bad guys Identifies the result – not the root cause “Badness-ometer” limitations and issues Automated crawler and web traffic analysis can yield Identifies the result – not the root cause Exactly what the bad guy does.. Cheap and easy way to find the most obvious issues Look for root cause issues from the “inside out” – the code Requires intimate access to the software Requires programming knowledge and expertise Exploitability information is not present as with other two. Identifies the root cause not the result Hire an expert Ethical Hacking Automate Hacking Black Box / Penetration Test Analyze the Software Static and Dynamic Analysis
© 2009 All Right Reserved Fortify Software Inc. Software Security Assurance (SSA) Remediate Vulnerabilities found in software Assess Software for security vulnerabilities Prevent Software security vulnerabilities The management & prevention of security risks in software Operation Construction Test
© 2009 All Right Reserved Fortify Software Inc. Software Security Maturity An info-sec project Generates awareness & support security initiatives Consulting, PenTesting & some manual code review Info-sec driven project with development support Forces a rework of code “Inside-out” Static and Dynamic Analysis required Proving the problem or meeting a basic regulatory requirement Recurring cost that does not “fix” anything Fixing security issues uncovered from assessments Secure the development and procurement lifecycle avoiding issues altogether Lowering risk but costs too high Info-sec-sponsored Development-led project Requires significant organizational buy-in Requires more than a point solution Minimizing business risk systematically Risk Awareness Vulnerability Assessment Risk Reduction Analysis & Remediation Prevention Secure SDL & Software
© 2009 All Right Reserved Fortify Software Inc. 9 Systemic Problem Software Procurement & Development Cycle Immediate Problem Existing Legacy Applications Prevention of the introduction of new risk Assessment & remediation of existing software The Challenge Compliance & Regulatory Requirements
© 2009 All Right Reserved Fortify Software Inc. Benefits of a “Hybrid” Approach A seamless flow from Assessment to Prevention –Facilitates growth in maturity from assessment to prevention Combined benefits at Testing phase - “Remediation Gap” –Application Testing & Software Analysis: Rapid identification of high priority issues (DAST) Precise description of root cause vulnerability in code (SAST) Reduced time and costs to remediate vulnerabilities By mapping each security issue to root cause in source code Developers understand security findings – faster fixes Security findings are more accurate – less research Security findings are more comprehensive – less rework Reduced time to fix Reduced false positives Less conflict between security and development
© 2009 All Right Reserved Fortify Software Inc. Dynamic Application Security Testing “Black Box” 11 Security Tester Web Application Development HP WebInspect Results Challenges -Visibility to “root cause”… -It is called “Black Box” -1 Issue may be indicative of many -Multiple issues may trace back to one problem -Communicating to developers -URLs and hacking technique vs. code errors -Validating behavior (FP)
© 2009 All Right Reserved Fortify Software Inc. 12 Security Tester Development
© 2009 All Right Reserved Fortify Software Inc. 13 Security Tester
© 2009 All Right Reserved Fortify Software Inc. Hybrid Integrated Security Testing 14 Source Code Development Fortify Source Code Analysis Security Tester Web Application Results Hybrid Results HP WebInspect Results
© 2009 All Right Reserved Fortify Software Inc. FortifyHybrid Integration Demo 15
© 2009 All Right Reserved Fortify Software Inc. 16 “Runtime Data” comes from Runtime Analysis Today Fortify leverages this to monitor and guard applications Fortify Runtime Analysis + WebInspect = Hybrid 2.0 Runtime Analysis is required to ensure proper mapping of SAST/DAST results Runtime Analysis allows testers and programmers to see “inside” the app Runtime analysis makes black box testing – white box testing How did we do that?
© 2009 All Right Reserved Fortify Software Inc. Introducing Hybrid Source Code Development Pen Tester Results Hybrid+ Results Fortify Runtime Analysis HP WebInspect Results Fortify Source Code Analysis Web Application
© 2009 All Right Reserved Fortify Software Inc. 18 Hybrid Aggregation: The complete set of results Unified management & reporting Ability to combine SAST and DAST findings for integrated prioritization and reporting. Reduced time and cost to fix vulnerabilities Ability to follow test findings “into” the program and the code to see the root cause. Hybrid 1.0 (2005 Technology – Available since 2006) Hybrid Correlation The accurate results Hybrid Insight The actionable results Hybrid 2.0 (An HP/Fortify exclusive advantage)
© 2009 All Right Reserved Fortify Software Inc. Thank you !
Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP.
1 Software Engineering and Security DJPS April 12, 2005 Professor Richard Sinn CMPE 297: Software Security Technologies.
Infosec 2012 | 25/4/12 Application Performance Monitoring Ofer MAOR CTO Infosec 2012.
Engineering Secure Software. The Power of Source Code White box testing Testers have intimate knowledge of the specifications, design, Often done by.
Web Vulnerability Assessments NEWDUG January, 2015.
VULNERABILITY MANAGEMENT Moving Away from the Compliance Checkbox Towards Continuous Discovery.
Cisco Consulting Services for Application-Centric Cloud Your Company Needs Fast IT Cisco Application-Centric Cloud Can Help.
Lean and (Prepared for) Mean: Application Security Program Essentials Philip J. Beyer - Texas Education Agency John B. Dickson.
Matin Barmare Technical Consultant Scalable Secure Applications Optimize Application Quality.
Using the Cloud and SaaS to Secure the SDLC. About Me Andy Earle HP/Fortify – Security Solutions Architect / Presales Engineer – Sell, deliver solutions.
An Introduction to AlarmInsight. Agenda Alarm Management Overview –Definition –Scope of the Problem –Causes of the Problem –Consequences of the Problem.
Secure Software Development SW Penetration Testing Chapter 6 Rasool Jalili & M.S. Dousti Dept. of Computer Engineering Fall 2010.
Delivering Enterprise Projects Using Agile Methods Brent Barton May 23, 2006.
Reverse Benchmarking -- Tom Stracener, Sr. Security Analyst, Cenzic Inc. Toorcon 9.
Understanding of Automation Framework A Storehouse of Vast Knowledge on Software Testing and Quality Assurance.
Software Quality Assurance and Testing Fazal Rehman Shamil.
OWASP APPSEC, 2013 JEREMIAH GROSSMAN Founder and THE REAL STATE OF WEBSITE SECURITY and THE TRUTH ABOUT ACCOUNTABILITY and “BEST-PRACTICES.”
Copyright © 2007 OSIsoft, Inc. All rights reserved. Ekho - MES Applications that leverages AF 2.0 Yannick Galipeau Inexcon Technologies Patrick Ramsey.
Gray, the New Black Gray-Box Web Vulnerability Testing Brian Chess Founder / Chief Scientist Fortify Software, an HP Company June 22, 2011.
SEC835 Database and Web application security Information Security Architecture.
How We Got Here PC and Internet changed the rules –Viruses, information sharing, “outside” and “inside” indistinguishable –Vulnerability research for.
1. Topics to be discussed Introduction Objectives Testing Life Cycle Verification Vs Validation Testing Methodology Testing Levels 2.
Testing Tools. Categories of testing tools Black box testing, or functional testing Testing performed via GUI. The tool helps in emulating end-user actions.
Chapter 10 Testing and Quality Assurance. Testing Related topics 1.Understand basic techniques for software verification and validation 2. Analyze basics.
HP World September 2002 Scott S. Blake, CISSP Vice President, Information Security BindView Corporation Vulnerability Assessment and Action.
Razieh Rezaei Saleh Supervisor: Dr. Mohsen Kahani.
What Exactly are the Techniques of Software Verification and Validation A Storehouse of Vast Knowledge on Software Testing.
Large-scale application security Charlie Eriksen.
Customer confidential 1 Privilege Management Sean Moore Solutions Specialist.
Alert Logic Security and Compliance Solutions for vCloud Air High-level Overview.
CPIS 357 Software Quality & Testing I.Rehab Bahaaddin Ashary Faculty of Computing and Information Technology Information Systems Department Fall 2010.
Security Services and AppScan. Why Develop Secure Applications 1.Prevent Vulnerabilities. [account and data theft] 2.Prevent Breaches. [$200/record notifications]
Security and Privacy Services Cloud computing point of view October 2012.
Static and Integration Testing. Static Testing vs Dynamic Testing To find defects This testing includes verification process without executing.
Boost your network security with NETASQ Vulnerability Manager.
Web Security Demystified Justin C. Klein Keane Sr. InfoSec Specialist University of Pennsylvania School of Arts and Sciences Information Security and Unix.
PwC New Technologies New Risks. PricewaterhouseCoopers Technology and Security Evolution Mainframe Technology –Single host –Limited Trusted users Security.
CSCI 521 Final Exam Review. Why Establish a Standard Process? It is nearly impossible to have a high quality product without a high quality process. Standard.
Introduction Telerik Software Academy Software Quality Assurance.
Testing – A Methodology of Science and Art. Agenda To show, A global Test Process which work Like a solution Black Box for an Software Implementation.
Risk Analysis Best Practices By Gabriel Rodriguez.
CSCE 548 Secure Software Development Risk-Based Security Testing.
CSCE 522 Secure Software Development Best Practices.
Web Application Testing with AppScan Terry Labach.
CodeSets Inc. into Healthcare solutions for last 18 year in USA Technology Aspirations into ERP, CIS, EIMS, DMS in Malaysia, Singapore and India
Tripwire Threat Intelligence Integrations. 2 Threat Landscape by the Numbers Over 390K malicious programs are found every day AV-Test.org On day 0, only.
© 2017 SlidePlayer.com Inc. All rights reserved.