1 00:00:14,430 --> 00:00:16,230 Welcome back to AppSec Village. 2 00:00:16,230 --> 00:00:18,170 We've made it to the end of the third day. 3 00:00:18,170 --> 00:00:23,630 The next talk will be the final talk for AppSec Village for DEF CON 2020. 4 00:00:23,830 --> 00:00:32,990 Now before we go into our final discussion, I'd like to take a minute and thank the organizers for putting on AppSec Village 2020. 5 00:00:32,990 --> 00:00:34,490 This is our second year. 6 00:00:34,490 --> 00:00:36,070 It's been a phenomenal year. 7 00:00:36,070 --> 00:00:42,870 The team has done a great job with very unique circumstances as we look around the world right now. 8 00:00:42,870 --> 00:00:47,710 So if you have a minute, jump out to AppSec Village, hit them up on Twitter, and just say thanks. 9 00:00:47,710 --> 00:00:55,490 Because they put in a lot of work trying to get this done in a short amount of time under really, really weird circumstances. 10 00:00:55,490 --> 00:00:57,210 So thanks organizers. 11 00:00:57,210 --> 00:00:58,770 Thanks all the volunteers. 12 00:00:58,850 --> 00:01:00,690 Thank you to all of our speakers. 13 00:01:00,770 --> 00:01:05,070 It's been a fun run, and I cannot wait to do this again next year. 14 00:01:05,070 --> 00:01:09,650 With that, let's talk about our final speaker for this year's DEF CON. 15 00:01:09,650 --> 00:01:17,950 The final topic is going to be Running an AppSec Program with Open Source Projects by Vandana Verma Sehgal. 16 00:01:17,950 --> 00:01:26,590 Vandana is a seasoned security professional with experience ranging from application security to infrastructure, and now dealing with DevSecOps. 17 00:01:26,590 --> 00:01:38,690 She has been a keynote speaker, a speaker, and a trainer at various public events, ranging from global OWASP AppSec events, to Black Hat, to regional events like B-Sides events in India. 18 00:01:38,690 --> 00:01:41,890 She is part of the OWASP Global Board of Directors. 19 00:01:41,890 --> 00:01:48,850 She also works in various communities towards diversity initiatives, including InfoSec Girls, WOSEC, and NULL. 20 00:01:49,310 --> 00:02:03,350 Vandana has been the recipient of several prestigious awards, and has also been listed as one of the top women leaders in the field of technology and cybersecurity in India by InstaSafe. 21 00:02:03,350 --> 00:02:09,990 Please welcome to the AppSec Village stage, one more time, for Vandana. 22 00:02:13,280 --> 00:02:16,040 Hi everyone, thanks for joining the session today. 23 00:02:16,040 --> 00:02:21,160 Today we are going to talk about how to run an AppSec Program with Open Source Projects or OWASP Projects. 24 00:02:21,260 --> 00:02:27,360 We can also say that how to build an AppSec Program in an organization. 25 00:02:27,500 --> 00:02:30,780 We are all heading toward modernization of applications. 26 00:02:30,780 --> 00:02:37,160 We are all trying to use microservices, application programming interface, or APIs. 27 00:02:37,160 --> 00:02:40,700 However, we still see that the breaches are happening. 28 00:02:40,700 --> 00:02:47,840 And the breaches are happening because of SQL injection, sensitive data exposure, or security misconfiguration. 29 00:02:47,960 --> 00:02:52,010 There's a big gap which our industry is grappling. 30 00:02:52,460 --> 00:03:01,200 Organizations who want to set up an AppSec Program, especially from scratch, using open source tools, they have no idea where to start off. 31 00:03:01,200 --> 00:03:06,500 They need a security program which they can pick up and go ahead and start using it. 32 00:03:06,660 --> 00:03:14,280 OWASP has many projects which can tie seamlessly into the application security pipeline or application security program. 33 00:03:14,460 --> 00:03:18,660 However, firstly, we don't know whether they exist. 34 00:03:18,700 --> 00:03:22,080 Or when they exist, we don't know how to use them. 35 00:03:22,140 --> 00:03:24,960 So, there is a big problem lying out there. 36 00:03:24,960 --> 00:03:32,180 With this talk, I'm going to talk about how we can set up the AppSec Program using open source projects. 37 00:03:32,180 --> 00:03:43,400 I'm going to share a framework which can help in tying up the projects, especially when we are talking about using them in the DevSecOps pipeline, or application security program or pipeline. 38 00:03:43,400 --> 00:03:48,400 In the end, how we can start contributing to these projects. 39 00:03:48,400 --> 00:03:54,240 Because it's very important to understand about these projects, and how we all can help with these projects. 40 00:03:54,240 --> 00:04:01,020 Another important aspect is that there are students who actually want to be part of application security. 41 00:04:01,020 --> 00:04:05,260 There are so many people who ask these questions, that how can I get into application security? 42 00:04:05,260 --> 00:04:11,740 I'm a fresher, or I've been working on a network security, or I've been working as a developer, I've been working as a tester. 43 00:04:11,740 --> 00:04:13,920 How can I get into application security? 44 00:04:13,980 --> 00:04:23,860 So, with all these projects, we can get a sense of how application security projects are set up, and how we can actually kickstart our career in application security. 45 00:04:25,440 --> 00:04:30,740 So, before I deep dive into the presentation, I want to talk a bit about myself. 46 00:04:30,760 --> 00:04:32,280 I'm Vandana Verma Sehgal. 47 00:04:32,280 --> 00:04:35,720 My day job is with one of the multinational companies in India. 48 00:04:35,800 --> 00:04:43,420 And apart from that, I root for ProOne Work, and I work with OWASP, which is Open Web Application Security Project. 49 00:04:43,680 --> 00:04:46,900 I'm one of the global board of directors for OWASP. 50 00:04:46,900 --> 00:04:50,380 Apart from that, I also work with Diversity Initiatives. 51 00:04:50,380 --> 00:04:53,120 I am the president for InfoSec Girls. 52 00:04:53,120 --> 00:04:56,060 I have few noted at multiple conferences. 53 00:04:56,480 --> 00:04:58,360 Now, coming back to the topic. 54 00:04:58,420 --> 00:05:00,640 So, this is the framework which I was talking about. 55 00:05:00,640 --> 00:05:08,920 This is what I felt that in every AppSec pipeline, these are the things which are required, like requirements gathering, threat modeling, source code review. 56 00:05:08,920 --> 00:05:13,740 All of these things are really, really necessary when we are setting up an AppSec pipeline. 57 00:05:13,960 --> 00:05:20,100 So, students can have their own projects, and they want to build the whole pipeline. 58 00:05:20,100 --> 00:05:29,060 They can start understanding, okay, these are the things which are necessary and which we should be catering to, which we should be addressing to, before even coming out of the college. 59 00:05:29,200 --> 00:05:40,560 And especially for a startup, if they don't have any view that, okay, if I'm going for an application security program, what are the components that I need to have? 60 00:05:40,560 --> 00:05:45,140 So, these are some basic components which I felt that we all should have in an organization. 61 00:05:45,400 --> 00:05:47,840 So, that's what I put in here. 62 00:05:47,840 --> 00:06:05,600 Let me start with a framework, that how we actually can take ahead of this framework and address all the loopholes in application security, especially about legacy applications, desktop applications, mobile, web applications, microservices, which are exploited these days. 63 00:06:05,600 --> 00:06:13,120 Now, cybercriminals can gain entry into an organization system and steal confidential data if we don't secure our systems. 64 00:06:13,380 --> 00:06:16,200 And this is a fact that breaches will happen. 65 00:06:16,200 --> 00:06:17,300 They are inevitable. 66 00:06:17,300 --> 00:06:19,880 And security flaws will exist. 67 00:06:19,880 --> 00:06:22,020 There's nothing which is 100% secure. 68 00:06:22,020 --> 00:06:25,540 However, what we can do is, we can minimize the chances. 69 00:06:25,800 --> 00:06:28,700 This is when the AppSec program comes into picture. 70 00:06:28,720 --> 00:06:34,760 And this is when I thought that, okay, how about let's use the OWASP projects and get started with this framework. 71 00:06:34,800 --> 00:06:47,060 So, one of the first thing that we need to understand is that we need to have an AppSec program, because if the organization doesn't feel that they need to have an AppSec program, the framework will never going to help us. 72 00:06:47,720 --> 00:06:55,600 So, we need to have an inventory that these are the applications that we have, or these are the applications we are going to build. 73 00:06:55,760 --> 00:07:03,460 So, with requirements gathering, first we need to have the requirements gathered, that these are the things that we need in an application. 74 00:07:03,460 --> 00:07:06,580 These are the applications that we have. 75 00:07:06,680 --> 00:07:09,020 Everything needs to be noted down. 76 00:07:09,020 --> 00:07:10,240 But where? 77 00:07:10,620 --> 00:07:13,440 Are we going to have some place where we can list down? 78 00:07:13,440 --> 00:07:15,340 Okay, these are the things that we have. 79 00:07:15,340 --> 00:07:21,260 And on those things, we are going to decide, okay, yes, this is our plan. 80 00:07:21,640 --> 00:07:33,340 So , OWASP Security RAT, Requirements Automation Tool, is an amazing project, which actually can help in automating the security requirements, especially during the development phase. 81 00:07:33,420 --> 00:07:43,240 Now, when we have simplified automated requirement gathering, it streamlines the whole process, because that's where the organization starts off. 82 00:07:43,720 --> 00:07:53,780 Now, apart from that, there's another beautiful project, which is OWASP Security Knowledge Framework, which is a big, exhaustive project in itself. 83 00:07:55,240 --> 00:07:59,580 It's kind of an ocean, wherein you have everything. 84 00:07:59,580 --> 00:08:01,820 You can note down the requirements. 85 00:08:01,820 --> 00:08:07,180 There's a proper medium wherein you have a lot of requirements mentioned. 86 00:08:07,180 --> 00:08:11,060 On top of it, you can mention your own requirement. 87 00:08:11,060 --> 00:08:17,920 And based on those requirements, we can define, we can figure out that what's the severity of an application. 88 00:08:17,920 --> 00:08:21,480 We can map it with application security verification standard. 89 00:08:21,480 --> 00:08:28,000 We can define the maturity of our application, our organization application security program. 90 00:08:28,000 --> 00:08:34,900 It provides a beautiful layout with best practices which developers can use. 91 00:08:34,900 --> 00:08:41,720 So, when we have RAC for automation and Security Knowledge Framework, we can gather the requirements very well. 92 00:08:41,720 --> 00:08:46,600 Because if we don't gather the requirements very well, we would never be able to secure application. 93 00:08:46,600 --> 00:08:51,100 Or we would never be able to build an application which is secure enough. 94 00:08:51,100 --> 00:08:57,620 So, first we need to have our own requirements noted down somewhere with the right medium. 95 00:08:58,600 --> 00:09:00,420 Then, once we have... 96 00:09:00,420 --> 00:09:03,440 Okay, these are the things that we need in an application. 97 00:09:03,440 --> 00:09:05,900 We need to threat model our application. 98 00:09:06,140 --> 00:09:10,640 Likewise, if we already have an application, we are going to build a feature. 99 00:09:10,740 --> 00:09:14,720 That time also we need to have a proper threat modeling in place. 100 00:09:14,720 --> 00:09:16,260 But how to do the threat modeling? 101 00:09:16,260 --> 00:09:18,780 It's like, it's a kind of a jargon. 102 00:09:18,780 --> 00:09:23,000 It's a kind of a technical term which we all have been talking about. 103 00:09:23,000 --> 00:09:26,460 But we don't understand, okay, how to go about it. 104 00:09:26,460 --> 00:09:28,200 Not everyone work on threat modeling. 105 00:09:28,200 --> 00:09:30,380 But it's actually a simple one. 106 00:09:30,380 --> 00:09:33,640 We can now use threat modeling as a code. 107 00:09:33,720 --> 00:09:37,040 We can use the tools like Threat Dragon. 108 00:09:37,120 --> 00:09:43,620 When you put all the details in it, it provides a beautiful graphical overview. 109 00:09:43,620 --> 00:09:46,220 Okay , these are the things that you have. 110 00:09:46,380 --> 00:09:48,620 And this is your application. 111 00:09:48,700 --> 00:09:54,800 So, I'm going to tell you whether it's a high severity application, medium severity application or a critical application. 112 00:09:55,300 --> 00:09:59,920 And if something happens to an application, what will be the impact? 113 00:09:59,920 --> 00:10:07,120 So, Threat Dragon provides a beautiful view of threat modeling, how we can threat model our application. 114 00:10:07,180 --> 00:10:18,160 Similarly, PyTM, which is a Pythonic framework for threat modeling, which is a beautiful and amazing data flow diagram project. 115 00:10:18,160 --> 00:10:24,200 Now, sometimes we don't understand, okay, the pieces are scattered everywhere. 116 00:10:24,200 --> 00:10:30,060 Now, if we have a flow chart, okay, now this is the thing where we are heading left. 117 00:10:30,240 --> 00:10:33,000 If we are right, we are going to go left. 118 00:10:33,460 --> 00:10:36,900 And if there is a problem, we should be stopping on the right side. 119 00:10:36,900 --> 00:10:43,080 So, with an amazing flow diagram, PyTM helps us in the threat modeling. 120 00:10:43,640 --> 00:10:49,580 So, all the details I've mentioned, okay, this is how the diagram looks like, if you can see on the right side. 121 00:10:49,580 --> 00:10:55,860 And it is like sequence by sequence, analyze the application and give you the result. 122 00:10:56,020 --> 00:11:00,140 And where you can find it, you can find it on this particular project's page. 123 00:11:00,140 --> 00:11:09,820 And you can look through it, you can understand there are so many resources which are available for you to guide how you can get started with it. 124 00:11:09,820 --> 00:11:15,480 Because I'm going to talk about many projects in this particular talk and giving you overview on it. 125 00:11:15,480 --> 00:11:17,340 Okay, this project does this. 126 00:11:17,340 --> 00:11:22,500 Because while I was learning about OWASP projects, few projects I knew. 127 00:11:22,500 --> 00:11:26,940 But there were few projects which I wanted to understand when I was building up this framework. 128 00:11:26,940 --> 00:11:31,400 So, I realized I had a different understanding of these projects. 129 00:11:31,400 --> 00:11:34,760 I thought, okay, this project was this. 130 00:11:34,760 --> 00:11:43,360 But when I actually researched through it, over the years, the projects have actually enhanced a lot. 131 00:11:43,360 --> 00:11:46,780 So, the project working, I'm going to talk about. 132 00:11:47,640 --> 00:11:52,760 So, once we have done the requirements gathering, we have done the threat modeling. 133 00:11:52,760 --> 00:11:56,540 Now we know, okay, this is the thing that we have in an organization. 134 00:11:56,600 --> 00:11:59,960 These are the requirements we are building up in an application. 135 00:11:59,960 --> 00:12:04,320 Or this is a new application which we are completely building from scratch. 136 00:12:04,600 --> 00:12:08,300 So, once we have that, we are going to work on the code. 137 00:12:08,300 --> 00:12:14,460 Now, when we are going to work on the code, we need to have the code which is securely developed. 138 00:12:14,460 --> 00:12:28,480 Especially, we have talked about so many research projects wherein if we fix a bug in production, which is a much higher cost than the bug which can be fixed in the development phase. 139 00:12:28,480 --> 00:12:30,160 Or even earlier than that. 140 00:12:30,160 --> 00:12:33,140 Like in the requirements gathering, we start talking about security. 141 00:12:33,140 --> 00:12:34,860 Or even threat modeling. 142 00:12:35,060 --> 00:12:43,080 We talk about, okay, these are the things that we should be fixing now, which can help us in the later stages of the application security project. 143 00:12:43,660 --> 00:12:51,140 So, code review checklist is like an amazing checklist which provides, okay, these are the things that should be fixed in a code. 144 00:12:51,220 --> 00:12:53,620 These are the things that can be guided in. 145 00:12:53,820 --> 00:12:57,940 We can actually build our own checklist on top of it. 146 00:12:57,940 --> 00:12:59,260 Like for source code review. 147 00:12:59,260 --> 00:13:04,760 I have built my own checklist on top of the ones that have been provided by the code review checklist. 148 00:13:04,780 --> 00:13:08,820 Similarly, there is another project which is code first project. 149 00:13:08,820 --> 00:13:16,660 Which is a project which helps in finding the code which might be left behind. 150 00:13:16,660 --> 00:13:19,880 Or which we might have left at some point. 151 00:13:19,880 --> 00:13:26,340 So, a continuous challenge with any penetration testing or even in code review. 152 00:13:26,340 --> 00:13:30,040 That we don't know whether we have covered everything or not. 153 00:13:30,040 --> 00:13:32,500 Whether we have covered the whole application or not. 154 00:13:32,500 --> 00:13:36,600 So, it's purely a black box perspective. 155 00:13:36,600 --> 00:13:46,640 Which actually makes it almost impossible to accurately identify how much of the code or an application attack surface that has been tested. 156 00:13:46,640 --> 00:13:55,820 So, code first is actually a glass box tool that provides the insight into the real-time code coverage of penetration testing. 157 00:13:55,820 --> 00:13:58,440 All the activities that are being done. 158 00:13:58,440 --> 00:14:03,600 So, it automatically detects the coverage information with the test being conducted. 159 00:14:03,660 --> 00:14:10,740 And will even make it possible to understand the overlap and the boundaries of different tools coverage. 160 00:14:10,980 --> 00:14:15,600 So, code first presents the coverage information in a visual form. 161 00:14:15,600 --> 00:14:17,120 If you can see on the right. 162 00:14:17,160 --> 00:14:19,300 So, this is how it provides. 163 00:14:19,300 --> 00:14:21,900 Wherein you have a beautiful view. 164 00:14:21,900 --> 00:14:24,440 Okay, these are the things that have been covered 60%. 165 00:14:24,440 --> 00:14:27,260 These are the things that have been covered 90%. 166 00:14:27,260 --> 00:14:33,980 So, the real coverage or real-time coverage feedback makes it easy to adjust the testing activity. 167 00:14:33,980 --> 00:14:36,680 Especially based on the observed coverage. 168 00:14:37,240 --> 00:14:41,640 In addition to those testing activities which are relying on multiple techniques. 169 00:14:41,920 --> 00:14:48,880 It's easy to split up the recorded activity to independently and alternatively understand the overlap. 170 00:14:48,880 --> 00:14:50,420 Between multiple tools. 171 00:14:50,420 --> 00:14:54,220 Because we have so many tools from which we test an application. 172 00:14:54,220 --> 00:14:58,040 So, CodePulse really helps us with that. 173 00:14:58,040 --> 00:15:02,340 Now, we have understood that this is what we have done with the code review. 174 00:15:02,340 --> 00:15:10,780 But how about a specially designed code review checklist or practice guide for a certain code. 175 00:15:10,780 --> 00:15:11,900 Like GoCode. 176 00:15:11,900 --> 00:15:15,220 GoCode, I started learning a couple of years back. 177 00:15:15,220 --> 00:15:19,700 But before that, it was like a completely new arena for me. 178 00:15:19,700 --> 00:15:23,460 And then came up OWASP Go Secure coding project. 179 00:15:23,460 --> 00:15:26,620 Which helped me in understanding, okay, this is a Go language. 180 00:15:26,620 --> 00:15:29,420 And this is how we can securely code it. 181 00:15:29,440 --> 00:15:36,420 So, Go Secure Code is another incubator project which can help us in understanding the basics. 182 00:15:36,960 --> 00:15:39,860 That how to secure GoCode. 183 00:15:40,320 --> 00:15:44,780 Another beautiful checklist is the cheat sheet series. 184 00:15:44,780 --> 00:15:50,140 This cheat sheet series helped me a lot, I would say. 185 00:15:50,140 --> 00:15:56,080 Because this provides an amazing overview that this is a vulnerability. 186 00:15:56,080 --> 00:16:01,000 This is how an attacker can exploit it if we don't fix it. 187 00:16:01,000 --> 00:16:03,800 And then remediation procedures. 188 00:16:03,800 --> 00:16:06,160 It's a beautiful checklist. 189 00:16:06,560 --> 00:16:12,700 And it has actually catered and helped me in multiple projects in my multiple organizations. 190 00:16:12,700 --> 00:16:16,120 So, if you look through it, it's a beautiful document. 191 00:16:16,120 --> 00:16:18,680 And there's a beautiful documentation around it. 192 00:16:18,680 --> 00:16:21,940 For so many vulnerabilities, for so many controls. 193 00:16:22,400 --> 00:16:24,900 It is an exhaustive list. 194 00:16:24,900 --> 00:16:32,940 Starting from input validation, to cross-site scripting, to xxe, to indirect object reference, to any other vulnerability you talk about. 195 00:16:33,100 --> 00:16:34,960 It has the details. 196 00:16:35,060 --> 00:16:37,780 So, you should actually take a look at this cheat sheet series. 197 00:16:37,780 --> 00:16:43,760 And every time I look at it, I actually feel that I'm more connected to it. 198 00:16:43,760 --> 00:16:49,600 I really fell in love with this cheat sheet series, the new one that has been developed by the team. 199 00:16:49,600 --> 00:16:54,340 Or the remodeled website which is there for the cheat sheet series. 200 00:16:54,640 --> 00:17:03,500 Another important aspect is, when we have worked on the code review, and we tend to miss software composition analysis. 201 00:17:03,500 --> 00:17:07,780 Which we have seen that there are breaches which have happened in the past. 202 00:17:07,780 --> 00:17:08,960 Like Equifax. 203 00:17:09,120 --> 00:17:13,320 Those happened because of using the components with known vulnerabilities. 204 00:17:13,720 --> 00:17:15,780 Or there were projects which were in use. 205 00:17:15,780 --> 00:17:22,880 There were open source code which were in use, but we missed to update the code. 206 00:17:22,880 --> 00:17:24,980 There were so many reasons. 207 00:17:25,300 --> 00:17:30,560 So, when we know these things are there, why don't we fix it? 208 00:17:30,560 --> 00:17:31,820 But how to fix it? 209 00:17:31,820 --> 00:17:32,940 It's a big challenge. 210 00:17:32,940 --> 00:17:43,340 I was actually going through one of the research paper wherein white source has quoted that 96.5% code on the internet is all open source. 211 00:17:43,440 --> 00:17:46,160 That's a huge amount of code. 212 00:17:46,200 --> 00:17:52,060 When almost all the code on the internet is open source, what can go wrong? 213 00:17:52,260 --> 00:17:58,180 Which means, can we say that everything which is lying over there, which we are using is all secure? 214 00:17:58,180 --> 00:17:58,840 No. 215 00:17:58,840 --> 00:18:01,860 If that's the case, then breaches wouldn't have happened. 216 00:18:01,860 --> 00:18:03,680 Why the breaches are happening? 217 00:18:03,960 --> 00:18:11,840 So, to reduce that, we have started understanding that we should have software composition analysis wherein we are scanning our code base. 218 00:18:11,880 --> 00:18:17,160 But is it too easy to buy a software composition analysis tool? 219 00:18:17,640 --> 00:18:19,660 We just go ahead and buy it? 220 00:18:19,720 --> 00:18:26,100 I am not against the tools, but I am in no support of buying a tool in the first place. 221 00:18:26,300 --> 00:18:30,180 You are just saying that you want this and you are going ahead with the tool. 222 00:18:30,180 --> 00:18:32,480 So, what else can we do? 223 00:18:32,480 --> 00:18:34,480 Is there any project by OWASP? 224 00:18:34,480 --> 00:18:35,260 Yes. 225 00:18:35,260 --> 00:18:41,480 So, OWASP has dependency check, which is called DC, people call it as. 226 00:18:41,480 --> 00:18:50,560 So, dependency check, this is an open source component, which is now an integral part of many organizations. 227 00:18:50,620 --> 00:18:55,520 And it helps in checking or scanning open source components. 228 00:18:55,520 --> 00:18:57,280 So, why it helps? 229 00:18:57,280 --> 00:19:03,720 Because now, as I mentioned that open source components have become an integral part of software development. 230 00:19:03,720 --> 00:19:14,180 We need to make sure throughout the development process, the software products, which we are actually creating and even maintaining, don't contain the vulnerable components. 231 00:19:14,240 --> 00:19:16,460 Or the breaches will keep happening. 232 00:19:16,460 --> 00:19:27,560 If we are using any third party library, we have to make sure that we are making sure that there is a place wherein we are updating them. 233 00:19:27,560 --> 00:19:31,500 We are keeping a record, okay, these are the libraries which exist. 234 00:19:31,700 --> 00:19:34,100 So, how should we do that? 235 00:19:34,140 --> 00:19:36,840 Are we going to just go ahead and buy a tool as I said? 236 00:19:36,840 --> 00:19:39,880 No, I am not going to do that. 237 00:19:39,880 --> 00:19:53,940 The increasingly widespread use of open source components have actually taken us to a way wherein if we don't know what we have in our code, we will never be able to secure our organization from any of the breaches. 238 00:19:54,180 --> 00:20:05,880 So, we need to understand that throughout the development process, the software products that we are developing or we are creating, we need to maintain them. 239 00:20:05,880 --> 00:20:10,660 We cannot just think that, okay, we have developed a product and we are good. 240 00:20:10,720 --> 00:20:13,180 We need to actually keep updating it. 241 00:20:13,180 --> 00:20:16,460 But how to keep a track of all the third party components? 242 00:20:16,460 --> 00:20:36,300 OWASP Dependency Checker actually helps or resolves these concerns for developers which identifies project dependencies and checks if there is any in the code or if there is a publicly disclosed vulnerability in the code as part of open source component. 243 00:20:36,300 --> 00:20:43,300 Now, how good it is or how bad it is or how heavy is this? 244 00:20:43,300 --> 00:20:47,380 Because all the tools that I have been working on, they are so heavy. 245 00:20:47,760 --> 00:20:55,680 So, to put it this way, OWASP Dependency Check is the lightweight and very easy to download, install and run component or a tool. 246 00:20:55,720 --> 00:21:01,560 So, when I downloaded it for the first time, it took me some time to download the NVD database. 247 00:21:01,760 --> 00:21:03,580 However, after that, it was a Delta scan. 248 00:21:03,580 --> 00:21:05,540 So, it was like a very quick scan. 249 00:21:05,540 --> 00:21:09,200 So, the scanning process is seamless. 250 00:21:09,580 --> 00:21:16,180 When we are scanning the code, it finds out, okay, these are the third party components we have in the tool. 251 00:21:16,380 --> 00:21:19,080 And these are the products. 252 00:21:19,080 --> 00:21:20,460 This is the version. 253 00:21:20,460 --> 00:21:25,740 And we have to fix this particular version if there is a vulnerability that exists. 254 00:21:25,820 --> 00:21:35,520 So, there are plugins which are available for Gradle, Maven and many other projects which allow us to integrate them as part of our whole lifecycle. 255 00:21:35,520 --> 00:21:40,770 We can integrate with Jenkins, which can allow us to integrate with the CI-CD pipeline. 256 00:21:41,400 --> 00:21:58,920 So, apart from that, we also have OWASP Dependency Check, which is an intelligent supply chain management or component analysis project or a platform that allows organizations to identify and reduce risk from the third party early in the lifecycle. 257 00:21:58,920 --> 00:22:10,300 And this can also help us in tracking the application, tracking the libraries, tracking the frameworks that we are using, operating systems and hardware components. 258 00:22:10,300 --> 00:22:11,860 It's like a huge list. 259 00:22:11,860 --> 00:22:14,160 Apart from that, what else it helps us? 260 00:22:14,160 --> 00:22:25,180 It helps us in identifying multiple risk areas like component with known vulnerabilities, out-of-date components, modified components, license risks. 261 00:22:25,780 --> 00:22:28,380 Then there are many other things which are coming soon. 262 00:22:28,380 --> 00:22:34,760 So, it includes a comprehensive auditing workflow for triggering results. 263 00:22:34,760 --> 00:22:41,160 Because once we have scanned it, if we don't have a proper result, obviously we are going to suffer it. 264 00:22:41,160 --> 00:22:44,380 So, once we figured that out, we need to have the results. 265 00:22:44,520 --> 00:22:50,040 And not just that, it is very simple to configure as well. 266 00:22:50,040 --> 00:22:53,780 Because configuring a tool is like a nightmare sometimes. 267 00:22:53,780 --> 00:23:03,280 I've been in the industry for quite some time now and I've worked on all the tools starting from the basic tool to the advanced tool that we have. 268 00:23:03,280 --> 00:23:07,760 So, I know sometimes it's like pain to configure a tool. 269 00:23:07,760 --> 00:23:10,560 So, this is like a pretty easy to configure project. 270 00:23:10,620 --> 00:23:14,000 And we can go ahead and get started with the bigger projects. 271 00:23:14,300 --> 00:23:17,420 Now, we have gathered the requirements. 272 00:23:17,620 --> 00:23:20,020 We've done the threat modeling. 273 00:23:20,020 --> 00:23:22,640 We've done the source code review. 274 00:23:22,640 --> 00:23:23,680 What else we have done? 275 00:23:23,680 --> 00:23:26,120 We've done the software composition analysis. 276 00:23:26,300 --> 00:23:28,080 So, what else is pending? 277 00:23:28,460 --> 00:23:29,840 Vulnerability testing. 278 00:23:29,840 --> 00:23:35,300 When I started in the industry, we were doing very less of a code review. 279 00:23:35,580 --> 00:23:37,980 Leave the software composition analysis. 280 00:23:38,020 --> 00:23:40,860 We were just doing the vulnerability assessment and we are good. 281 00:23:40,880 --> 00:23:45,220 And I have been an evil person in the project team. 282 00:23:45,220 --> 00:23:49,600 Where if there was a critical vulnerability, I have stopped the releases. 283 00:23:49,600 --> 00:23:51,260 But then over the year, we all grow. 284 00:23:51,260 --> 00:23:52,220 We in the industry grow. 285 00:23:52,220 --> 00:23:56,440 We understand, okay, stopping a release is never going to answer us. 286 00:23:56,560 --> 00:23:59,640 So, we need to go through all the life cycle. 287 00:23:59,640 --> 00:24:01,300 How about we start early? 288 00:24:01,300 --> 00:24:02,300 We shift left. 289 00:24:02,300 --> 00:24:03,440 And that's where we are. 290 00:24:03,440 --> 00:24:05,100 We are all shifting left. 291 00:24:05,480 --> 00:24:07,200 We are talking about it. 292 00:24:07,500 --> 00:24:13,300 So, now in the vulnerability testing, what are the things we cater to? 293 00:24:13,300 --> 00:24:16,400 Like, what exactly we can use? 294 00:24:16,400 --> 00:24:19,300 Or how exactly we can perform a vulnerability testing? 295 00:24:19,300 --> 00:24:22,640 We've been doing, okay, most of the aspects we must be knowing. 296 00:24:22,640 --> 00:24:23,500 I'm sure. 297 00:24:23,500 --> 00:24:28,480 But then how about using the open source project for that? 298 00:24:28,580 --> 00:24:31,320 So, let me go ahead and get to it. 299 00:24:31,320 --> 00:24:34,520 So, this one, I'm sure you must be aware about it. 300 00:24:34,520 --> 00:24:37,520 Web Application Security Testing Guide. 301 00:24:37,820 --> 00:24:43,600 Which is an exhaustive guide on how to start an application security testing. 302 00:24:43,600 --> 00:24:46,300 Robots.txt file. 303 00:24:46,320 --> 00:24:47,820 What is crawling? 304 00:24:47,820 --> 00:24:49,260 What is spridering? 305 00:24:49,260 --> 00:24:51,200 What is STLC? 306 00:24:51,220 --> 00:24:52,860 Software Development Life Cycle. 307 00:24:52,860 --> 00:24:55,220 Everything in detail. 308 00:24:55,320 --> 00:24:58,640 If there is a flaw, information gathering. 309 00:24:58,920 --> 00:25:01,420 Everything summarizing it. 310 00:25:01,420 --> 00:25:03,660 Like, okay, this is what it is. 311 00:25:03,820 --> 00:25:10,300 Then, if this has a problem, what will be the vulnerability? 312 00:25:10,440 --> 00:25:14,280 Once the vulnerability is there, how to remediate it? 313 00:25:14,280 --> 00:25:18,320 I've created a presentation on how to implement a web security testing guide. 314 00:25:18,320 --> 00:25:20,360 You can actually look through it. 315 00:25:20,360 --> 00:25:26,040 So, which provides a good detail about how to use the web security testing guide. 316 00:25:26,040 --> 00:25:27,540 And it will help you. 317 00:25:27,540 --> 00:25:28,360 Trust me. 318 00:25:28,360 --> 00:25:30,680 It's an amazing guide. 319 00:25:30,700 --> 00:25:35,180 So, when I was introduced to OWASP, this was the first thing I was introduced to. 320 00:25:35,180 --> 00:25:37,840 There's a web security testing guide which exists. 321 00:25:37,860 --> 00:25:39,920 And I should start using it. 322 00:25:39,920 --> 00:25:46,240 And that's where my journey in detail in application security testing started off. 323 00:25:46,240 --> 00:25:51,620 Now, when application security testing guide is there, we're talking about applications. 324 00:25:51,740 --> 00:25:55,400 But in the beginning, I mentioned that we're all talking about modernization. 325 00:25:55,400 --> 00:25:58,520 We're all talking about using APIs. 326 00:25:58,520 --> 00:26:04,780 So, when all of these things are there, how to make sure that we are using them correctly? 327 00:26:05,060 --> 00:26:07,780 And there's no flaw in them. 328 00:26:07,780 --> 00:26:13,520 So, OWASP API Security Top 10 answers just that. 329 00:26:13,520 --> 00:26:26,060 Wherein, it is a good list of the top 10 breaches or the top breaches that can happen from all the vulnerabilities which are listed in the project. 330 00:26:26,360 --> 00:26:31,460 And it also helps at the same time that how to fix that bug. 331 00:26:31,460 --> 00:26:34,620 How this bug can be avoided. 332 00:26:34,620 --> 00:26:39,580 All of these things are part of OWASP API Security Top 10 Guide. 333 00:26:39,580 --> 00:26:44,100 And not just that, the project leaders keep on enhancing it. 334 00:26:44,100 --> 00:26:48,700 Wherein, API Security Testing Guide, they start working on it. 335 00:26:48,700 --> 00:26:52,420 They are planning to merge it with the Application Security Testing Guide. 336 00:26:52,880 --> 00:26:55,960 It's more of an add-on to it. 337 00:26:56,040 --> 00:26:58,200 So, API Security Testing would be there. 338 00:26:58,200 --> 00:27:02,480 But then, it will be an add-on to Web Application Security. 339 00:27:02,480 --> 00:27:04,980 Applications are using APIs. 340 00:27:04,980 --> 00:27:07,580 But how to secure those APIs? 341 00:27:07,580 --> 00:27:10,900 How to find the bugs at the right time? 342 00:27:10,900 --> 00:27:14,440 Especially with the rise of APIs that we have seen. 343 00:27:14,440 --> 00:27:16,060 There's a huge amount of APIs. 344 00:27:16,060 --> 00:27:19,380 Even for a small function, we start using APIs. 345 00:27:19,380 --> 00:27:22,440 A small web app call, we start using it. 346 00:27:22,440 --> 00:27:26,820 APIs, when they expose application logic. 347 00:27:26,820 --> 00:27:30,760 And they contain so much sensitive data. 348 00:27:31,320 --> 00:27:32,840 Like PIR data. 349 00:27:33,560 --> 00:27:37,720 And there's so much other information when that's there. 350 00:27:37,720 --> 00:27:40,360 So, it becomes evitable that we secure them. 351 00:27:40,360 --> 00:27:50,420 So, this crucial project helps in understanding or making us understand what role API plays in an application architecture. 352 00:27:50,420 --> 00:27:56,280 And how we can take help from the API Security Project to secure them. 353 00:27:56,280 --> 00:28:06,640 At the same time, how emergence of APIs, especially specific issues related to them, need to be considered into the radar. 354 00:28:06,640 --> 00:28:09,220 We cannot just avoid them. 355 00:28:10,320 --> 00:28:17,360 Now, when we have something for APIs, when we have something for applications, do we not need it for mobile? 356 00:28:17,360 --> 00:28:22,000 Because we all are working day in and day out on the mobile devices. 357 00:28:22,000 --> 00:28:24,900 So, we need something for mobile devices as well. 358 00:28:24,900 --> 00:28:32,920 So, there has to be something like a testing guide which should be there for mobile or mobile application security testing. 359 00:28:32,920 --> 00:28:37,220 Project leaders and everyone call it as Mobile Security Testing Guide, MSTG. 360 00:28:37,220 --> 00:28:45,440 Which is an exhaustive list of testing procedures which contains Android, iOS, and many other things. 361 00:28:45,440 --> 00:28:51,120 So, it's like a complete detailed project on mobile security testing. 362 00:28:51,120 --> 00:29:02,520 So, I would say, I would recommend you to go back and check how it can help you in mobile security development of an application. 363 00:29:02,540 --> 00:29:07,880 So, if you want to take a view, this helps just with that. 364 00:29:07,880 --> 00:29:21,720 Another important aspect is that it also has a beautiful ASVS which is Application Security Verification Standard which has step-by-step information and an exhaustive checklist. 365 00:29:21,720 --> 00:29:24,020 Because now you have a big testing guide. 366 00:29:24,340 --> 00:29:26,980 And from that testing guide, you tend to make a checklist. 367 00:29:26,980 --> 00:29:27,800 I did it. 368 00:29:27,800 --> 00:29:32,940 Trust me, I had no idea there is something called ASVS that exists way back. 369 00:29:33,320 --> 00:29:44,260 But now I would say that it's like a beautiful moon for me where it is helping me in my own projects now also. 370 00:29:44,480 --> 00:29:46,740 And I recommend it to the developers. 371 00:29:46,740 --> 00:29:53,240 I recommend it to the functional testers who are actually working on all the groundwork. 372 00:29:53,240 --> 00:29:56,440 So, this really helps in mobile security. 373 00:29:56,940 --> 00:29:59,880 Another thing is how to automate everything. 374 00:29:59,880 --> 00:30:01,780 Now we are doing web application testing. 375 00:30:01,780 --> 00:30:05,200 We are doing the mobile security testing. 376 00:30:05,200 --> 00:30:08,320 But is there any tool that can help us in doing that? 377 00:30:08,320 --> 00:30:10,060 That is an open source tool. 378 00:30:10,120 --> 00:30:14,580 So, OWASP ZAP, which is Z-Attack Proxy, helps just with that. 379 00:30:14,580 --> 00:30:22,940 There are so many APIs which are available which we can integrate with the QA tools or functional testing tools like Selenium. 380 00:30:22,940 --> 00:30:25,100 Many other tools that can be integrated. 381 00:30:25,280 --> 00:30:32,140 And if we specifically want to call a specific API from this tool, we can just do that. 382 00:30:32,140 --> 00:30:34,160 So, ZAP really helps. 383 00:30:34,160 --> 00:30:36,600 And especially how it came into existence. 384 00:30:36,600 --> 00:30:42,520 The project leaders, they were developers. 385 00:30:42,520 --> 00:30:43,940 Yes, you heard it right. 386 00:30:43,940 --> 00:30:45,300 They were not the security testers. 387 00:30:45,300 --> 00:30:46,780 They were developers. 388 00:30:47,120 --> 00:30:51,600 So, they were facing a lot of issues with the application security testing. 389 00:30:51,600 --> 00:30:53,560 And sometimes it becomes crazy. 390 00:30:53,560 --> 00:31:01,060 So, they developed a project, ZAP, and now it's being used widely all over the world. 391 00:31:01,060 --> 00:31:04,980 And it has multiple test cases. 392 00:31:04,980 --> 00:31:09,020 You can create your own test cases and upload it on it. 393 00:31:09,040 --> 00:31:13,340 If I talk about myself, I also have created multiple test cases. 394 00:31:13,340 --> 00:31:15,040 And I have uploaded on ZAP. 395 00:31:15,040 --> 00:31:17,020 And I keep testing them. 396 00:31:17,100 --> 00:31:21,620 I make sure that I use it exhaustively for my pen test assignments. 397 00:31:21,880 --> 00:31:25,920 Apart from that, there's another project which is AMAS project. 398 00:31:25,920 --> 00:31:27,620 Now, what is this AMAS project? 399 00:31:27,620 --> 00:31:29,940 You might not have ever heard it. 400 00:31:29,940 --> 00:31:34,200 So, when I heard about it, I felt, oh, there's something that exists. 401 00:31:34,200 --> 00:31:35,040 Wow. 402 00:31:35,080 --> 00:31:40,180 So, OWASP AMAS project performs the network mapping of attack surface. 403 00:31:40,180 --> 00:31:43,420 And it can also check for the external asset discovery. 404 00:31:43,420 --> 00:31:48,780 So, if there are any assets which are outside the organization, we can actually figure them out. 405 00:31:48,780 --> 00:31:54,280 Using this open source information gathering and active reconnaissance technique, which it has. 406 00:31:54,280 --> 00:32:00,920 So, it can actually use multiple search engines. 407 00:32:00,920 --> 00:32:04,320 It can use the SIM tools. 408 00:32:04,320 --> 00:32:08,460 It can leverage APIs from multiple tools. 409 00:32:08,460 --> 00:32:12,260 It can also leverage and figure out web services. 410 00:32:12,260 --> 00:32:16,240 So, it's an amazing project which provides the reconnaissance technique. 411 00:32:16,240 --> 00:32:22,380 And once we have our application, we want to know what are the components which are open source or which are on the internet. 412 00:32:22,380 --> 00:32:25,540 So , AMAS project is the project to go for it. 413 00:32:25,540 --> 00:32:29,360 And I would strongly recommend you just take a look at it. 414 00:32:29,460 --> 00:32:32,700 So, you should actually take a look at this project. 415 00:32:32,700 --> 00:32:37,120 Now, once we have done that, we have got the requirements gathered. 416 00:32:37,120 --> 00:32:40,400 We have got the requirements gathered. 417 00:32:40,400 --> 00:32:42,500 Then we have done the threat modeling. 418 00:32:42,500 --> 00:32:44,460 We have done the source code review. 419 00:32:44,460 --> 00:32:47,040 We have done the software composition analysis. 420 00:32:47,040 --> 00:32:48,180 What else we have done? 421 00:32:48,180 --> 00:32:50,280 We have done the vulnerability testing. 422 00:32:50,280 --> 00:32:54,440 Now, once that's done, is there any place we can document it? 423 00:32:54,440 --> 00:33:02,020 If, as a startup or a person who is new to the industry and I don't have a paid commercial tool, so what should I do? 424 00:33:02,060 --> 00:33:05,460 Defect Dojo helps just with that. 425 00:33:05,780 --> 00:33:13,640 It's an amazingly wonderful tool which actually documents the findings. 426 00:33:13,640 --> 00:33:16,400 It can be integrated with commercial tools as well. 427 00:33:16,400 --> 00:33:20,940 So, when it documents the findings, it provides the severity levels. 428 00:33:20,960 --> 00:33:22,520 High, medium, low. 429 00:33:22,520 --> 00:33:24,040 And it keeps on popping it. 430 00:33:24,040 --> 00:33:30,000 If you can see on the right-hand side, there is a beautiful graphical view that it provides. 431 00:33:30,000 --> 00:33:33,600 Especially if you have to send a report to the management. 432 00:33:33,600 --> 00:33:36,880 Because leadership always looks for graphs, reports. 433 00:33:36,880 --> 00:33:40,180 They don't want to go like, okay, these are the 10 vulnerabilities that are there. 434 00:33:40,180 --> 00:33:42,060 These are these things which are there. 435 00:33:42,060 --> 00:33:44,040 So, they look for numbers. 436 00:33:44,040 --> 00:33:49,420 They look for understanding, okay, these are the high-level items that we need to address. 437 00:33:49,420 --> 00:34:00,760 So, Defect Dojo is a tool that actually not only stores the findings, but also helps in streamlining our entire application security program. 438 00:34:00,760 --> 00:34:04,440 It simplifies vulnerability management by offering templates. 439 00:34:04,440 --> 00:34:06,300 So, we can have our own templates. 440 00:34:06,300 --> 00:34:07,800 We can generate the report. 441 00:34:07,800 --> 00:34:09,980 We can have metrics. 442 00:34:09,980 --> 00:34:17,660 We can check if there are duplicate findings which were there in the past report and now it's coming up again. 443 00:34:17,660 --> 00:34:19,540 There's a baseline that we can set. 444 00:34:19,540 --> 00:34:21,460 We can fine-tune the project. 445 00:34:21,460 --> 00:34:30,000 So, the top goal for this project is to reduce the amount of security professionals which they take in logging vulnerabilities. 446 00:34:30,240 --> 00:34:32,400 So, Defect Dojo addresses that. 447 00:34:32,400 --> 00:34:36,900 Because I have worked with the top-notch pen testers. 448 00:34:37,420 --> 00:34:42,480 And especially the people who worked for me, they were facing a lot of challenges in reporting it. 449 00:34:42,780 --> 00:34:45,120 Like, reporting it in the tool. 450 00:34:45,120 --> 00:34:46,060 It's a big challenge. 451 00:34:46,060 --> 00:34:47,760 Like, you have to copy-paste, this, that. 452 00:34:47,760 --> 00:34:52,720 It's more of a job wherein sometimes you feel, oh, this is not what I want to do. 453 00:34:52,720 --> 00:34:54,600 But this is an important task. 454 00:34:54,600 --> 00:34:59,080 If you don't log it, there's no point doing all of that. 455 00:34:59,080 --> 00:35:06,040 So, Defect Dojo helps in template system, which is like a template system for vulnerability. 456 00:35:06,040 --> 00:35:09,310 It can provide self-service baseline tools. 457 00:35:09,940 --> 00:35:14,220 It can also import common vulnerability scanners. 458 00:35:14,300 --> 00:35:19,460 So, if there is a scanner which is like Collis, Nessus, it can actually fetch the data from there. 459 00:35:19,460 --> 00:35:21,060 Fetch the reports from there. 460 00:35:21,300 --> 00:35:25,520 And then generate the report based on the one that we require. 461 00:35:25,520 --> 00:35:28,120 It can provide the beautiful metrics. 462 00:35:28,660 --> 00:35:38,600 Which is like, you can see that it provides a dashboard with a beautiful summary health check of the overall product or application security program. 463 00:35:39,320 --> 00:35:47,100 And, once we have that, because it's important to fix the bugs, we need to make sure that we have some defensive controls. 464 00:35:47,200 --> 00:35:49,540 Now, what are these defensive controls? 465 00:35:49,660 --> 00:35:51,140 Why do we need it? 466 00:35:51,140 --> 00:35:57,540 Because sometimes, when we have all of it, we need open source defenses as well. 467 00:35:57,540 --> 00:36:04,400 Think about, there's something which is placed in front of my application and it's helping me. 468 00:36:04,820 --> 00:36:09,180 So, these defensive controls help just with that. 469 00:36:09,220 --> 00:36:13,120 So, there are some of the defensive projects which I have mentioned. 470 00:36:13,120 --> 00:36:20,060 There are a few projects which are under pipeline, which you can just go to OWASP.org and you can get to know about them. 471 00:36:20,060 --> 00:36:28,220 So, CSRF Guard is one of the projects which helps us in avoiding CSRF vulnerability, cross-site request forgery, because that had been a pain. 472 00:36:28,220 --> 00:36:34,820 Even though that's not part of OWASP anymore, but then it's still a problem with many, many applications. 473 00:36:35,040 --> 00:36:38,620 So, CSRF Guard actually helps with that. 474 00:36:38,620 --> 00:36:51,640 And then another project is OWASP ModSecurity Core Ruleset, which is a set of generic attack detection rules for use with the ModSecurity. 475 00:36:51,640 --> 00:36:56,120 And it acts as a web application firewall. 476 00:36:56,120 --> 00:37:09,360 So, Core Ruleset's main goal is to protect the web application from a wide range of attacks, including the OWASP 10, with the minimum false alerts. 477 00:37:09,360 --> 00:37:15,300 Because if there's a web application firewall, it sometimes actually generates a lot of false alarms. 478 00:37:15,300 --> 00:37:20,300 So, it protects us from insecure web application design. 479 00:37:20,300 --> 00:37:33,360 So, ModSecurity rulesets, I would say, can actually provide a layer of protection for web application, such as WordPress, PHP, VB, or any type of web application. 480 00:37:33,360 --> 00:37:44,680 It can actually potentially protect against vulnerability or vulnerable applications, which are outdated or which are using the outdated components. 481 00:37:45,240 --> 00:37:49,600 It can also protect us against the generalized malicious traffic. 482 00:37:49,600 --> 00:37:54,860 We've seen that DDoS or DDoS is like a big problem for any organization. 483 00:37:54,860 --> 00:37:56,860 So, it helps us with that. 484 00:37:56,940 --> 00:38:04,520 And it can identify that this is a malicious traffic by using the ModSecurity rulesets. 485 00:38:05,840 --> 00:38:10,380 Another important project, which I never want to miss, is Proactive Control. 486 00:38:10,380 --> 00:38:21,720 Now, what this Proactive Control is that once we are developing an application or once we have this application developed, we want to make sure that we are proactively monitoring it. 487 00:38:21,720 --> 00:38:34,080 So, Proactive Control helps with that, wherein it provides a list of controls that developers, testers, security researchers need to know. 488 00:38:34,080 --> 00:38:41,000 These are the pointers like encode data, verify for security early and often. 489 00:38:41,000 --> 00:38:43,280 All of this, we should know. 490 00:38:43,320 --> 00:38:46,060 And what are the frameworks and libraries we should be using. 491 00:38:46,060 --> 00:38:49,740 If we are using third-party libraries, when to secure it. 492 00:38:49,740 --> 00:38:54,160 So, all of that, Proactive Control is emphasizing on that. 493 00:38:54,160 --> 00:38:58,940 And it's the place to go for any of the developers, I would say. 494 00:39:00,260 --> 00:39:07,560 Now, once we know about Proactive Control, what else we should be looking at? 495 00:39:07,700 --> 00:39:16,220 Now, we have the Proactive Controls, how about we train our developers, testers, and even the people who are part of security. 496 00:39:16,220 --> 00:39:20,840 It's very, very important to secure our applications. 497 00:39:21,060 --> 00:39:27,240 Because if we don't train our people, we would be leaving so much behind. 498 00:39:27,240 --> 00:39:30,540 So, what are the things that can help us? 499 00:39:30,660 --> 00:39:33,620 Is there any place where I can learn this? 500 00:39:33,920 --> 00:39:38,380 So, OWASP WebGuard is one of the oldest projects, I would say. 501 00:39:38,380 --> 00:39:39,880 One of the oldest projects. 502 00:39:40,340 --> 00:39:46,340 That used to come in a CD and I have copied on my system and then started working on this particular project. 503 00:39:46,340 --> 00:39:48,420 Which has matured over the years. 504 00:39:48,420 --> 00:39:58,580 So, OWASP WebGuard actually is a deliberately vulnerable web application where there are so many challenges which we can solve and we can fix the bugs. 505 00:39:58,580 --> 00:40:02,620 So, it gives you a view that, okay, this vulnerability could be looking like this. 506 00:40:02,660 --> 00:40:04,480 So, it helps with that. 507 00:40:04,600 --> 00:40:10,560 Another project is Security Shepherd, which I usually use in my trainings, which I give. 508 00:40:10,560 --> 00:40:17,280 So, this is like an exercise which you can see on the screen that, yes, it's a lesson and there's a scoreboard. 509 00:40:17,280 --> 00:40:22,100 Once you solve all of these things, it becomes from cross to check. 510 00:40:22,540 --> 00:40:27,580 And it provides an exhaustive list of all the test cases. 511 00:40:27,580 --> 00:40:30,860 There's a SQL injection that can be done multiple ways. 512 00:40:30,860 --> 00:40:31,500 It provides that. 513 00:40:31,500 --> 00:40:33,080 There's a blind SQL injection. 514 00:40:33,080 --> 00:40:34,360 How does that happen? 515 00:40:34,360 --> 00:40:35,680 So, it provides with that. 516 00:40:35,680 --> 00:40:42,740 So, it builds a story around an application and helps us in understanding the bugs. 517 00:40:43,060 --> 00:40:50,100 Another project is DevSlock, which is more of a working project rather than a training project. 518 00:40:50,200 --> 00:41:02,540 But this is still, I would say, it's a part of a learning, which provides a view of application security, DevSecOps, or DevOps with security in a working way. 519 00:41:03,780 --> 00:41:07,880 This particular project can be used in the whole DevSecOps lifecycle. 520 00:41:08,300 --> 00:41:14,200 And how this particular project can be used could be in the source code review. 521 00:41:14,200 --> 00:41:19,060 So, the team actually works real-time on that, do the live demos. 522 00:41:19,060 --> 00:41:20,760 There are failures that do happen. 523 00:41:20,760 --> 00:41:28,140 Even I was part of one of the sessions wherein I gave a session on dependency check and we were troubleshooting live. 524 00:41:28,140 --> 00:41:31,640 Okay, we downloaded dependency check. 525 00:41:31,640 --> 00:41:32,700 What next? 526 00:41:32,700 --> 00:41:35,280 How are we going to work with NVD database? 527 00:41:35,280 --> 00:41:36,760 How are we going to run the scan? 528 00:41:36,760 --> 00:41:38,460 Where are we going to put the jar files? 529 00:41:38,460 --> 00:41:40,340 Where are we going to pick the code? 530 00:41:40,340 --> 00:41:43,480 So, everything we did live on the session. 531 00:41:43,480 --> 00:41:48,880 It's not like we are actually recording a video and then cutting it. 532 00:41:48,880 --> 00:41:51,900 Whatever is the best shot, that should be there. 533 00:41:51,900 --> 00:41:52,780 No. 534 00:41:53,000 --> 00:41:55,020 They do it live. 535 00:41:55,200 --> 00:41:56,180 Failures do happen. 536 00:41:56,180 --> 00:41:59,120 They keep on implementing those new things. 537 00:41:59,120 --> 00:42:00,440 They keep on working on it. 538 00:42:00,440 --> 00:42:04,120 And all the sessions, you can see it on the OWASP project. 539 00:42:04,120 --> 00:42:11,660 Similarly, they have PXE, which is an Intentionally Vulnerable API project. 540 00:42:11,660 --> 00:42:14,580 Which is an amazing project you should take a look at. 541 00:42:15,120 --> 00:42:25,060 So, now, once we've talked about it, how can I leave Jushop, which is like the most modern web application with all the relevant bugs. 542 00:42:25,060 --> 00:42:27,320 And even I have used it for CTFs. 543 00:42:27,320 --> 00:42:30,020 You can use it for CTFs within the team as well. 544 00:42:30,020 --> 00:42:37,300 So, I wanted to showcase some of the test cases to one of the development team and even my team. 545 00:42:37,300 --> 00:42:43,800 So, we used it as a project, as a CTF platform for the testing. 546 00:42:43,800 --> 00:42:53,260 And it has actually helped us a lot in finding and making the teams understand these are the bugs that exist in an application. 547 00:42:55,360 --> 00:42:59,000 So, this really helps with that. 548 00:42:59,760 --> 00:43:10,000 Another thing is that when you go to Jushop, it gives you a kind of feeling like a real application. 549 00:43:10,000 --> 00:43:12,140 And then you start exploiting it. 550 00:43:12,140 --> 00:43:16,440 So, I really like the project and even the project leaders are super cool. 551 00:43:16,440 --> 00:43:18,760 They keep on adding new stuff in it. 552 00:43:18,760 --> 00:43:30,040 If you reach out to them, if you want to help them, help them in modifying some challenges or adding some new challenges, they are always open for it. 553 00:43:30,040 --> 00:43:32,220 So, make sure that you reach out to them. 554 00:43:32,740 --> 00:43:39,080 Once we know about these projects, how about we go to the awareness item. 555 00:43:39,080 --> 00:43:40,760 Now, we have talked about testing. 556 00:43:40,760 --> 00:43:42,920 How can we miss top 10 projects? 557 00:43:42,920 --> 00:43:50,100 I am sure everybody knows that there is a flagship project, top 10. 558 00:43:50,100 --> 00:43:56,500 And any organization which wants to secure application security, they go through top 10. 559 00:43:56,500 --> 00:44:05,220 And they use top 10 as like a project which cannot be forgotten, which cannot be left behind. 560 00:44:05,220 --> 00:44:07,200 It acts as a framework. 561 00:44:07,200 --> 00:44:13,520 We have to make sure that top 10 bugs don't exist in an application or in our application. 562 00:44:13,520 --> 00:44:18,240 You must be thinking that I have covered so many things around application security, mobile security. 563 00:44:18,240 --> 00:44:20,600 And did I leave OWASP top 10? 564 00:44:20,600 --> 00:44:21,480 No. 565 00:44:21,480 --> 00:44:29,840 So, I have left it for the awareness session that we all should be aware that OWASP top 10 exists. 566 00:44:29,840 --> 00:44:36,760 And every 3 to 4 years, there are new sets of top 10 cases which come. 567 00:44:36,760 --> 00:44:39,540 And those are not done by OWASP. 568 00:44:39,540 --> 00:44:41,000 It's done by community. 569 00:44:41,000 --> 00:44:42,600 It's done by the organization. 570 00:44:42,600 --> 00:44:44,480 The data comes from the organization. 571 00:44:44,560 --> 00:44:45,980 And then people work on it. 572 00:44:45,980 --> 00:44:47,160 Community work on it. 573 00:44:47,160 --> 00:44:48,640 Community share the feedback. 574 00:44:48,640 --> 00:44:52,520 Okay, these are the test cases that are there. 575 00:44:52,520 --> 00:44:54,960 Or these are the top 10 vulnerability. 576 00:44:55,140 --> 00:44:58,640 And every 3 years, you would see this shuffling happening. 577 00:44:58,980 --> 00:45:05,740 And past few years, I would say, SQL injection has been on top. 578 00:45:05,740 --> 00:45:10,500 Which I would say that we all have to work together and make sure that that actually goes down. 579 00:45:10,500 --> 00:45:19,040 There are few vulnerabilities which have taken a place like using components with open source or vulnerable components. 580 00:45:19,340 --> 00:45:23,540 Using components with known vulnerabilities, which is A9. 581 00:45:23,540 --> 00:45:31,080 Then XXC, that has become a part of it, which is A4, which is on the top 4 list. 582 00:45:31,080 --> 00:45:34,040 So, it addresses all of that. 583 00:45:34,040 --> 00:45:40,260 Then, there's another amazing project, which is ASVS, Application Security Verification Standard. 584 00:45:40,260 --> 00:45:42,280 Which I've talked about in the beginning. 585 00:45:42,280 --> 00:45:44,420 So, what it is. 586 00:45:44,420 --> 00:45:57,040 So, the primary aim of OWASP Application Security Verification Standard is to provide an application security platform, a standard for web apps and web services of all types. 587 00:45:57,560 --> 00:46:00,980 And my experience is like, I'm a big fan of checklists. 588 00:46:00,980 --> 00:46:09,120 And during my penetration testing time when I was starting off, from web testing guide, I created my own checklist. 589 00:46:09,120 --> 00:46:13,460 And then later, I got to know that there is something called ASVS that exists. 590 00:46:13,460 --> 00:46:15,200 It was a bummer for me. 591 00:46:15,200 --> 00:46:19,840 So, I thought, why don't I introduce it to you. 592 00:46:20,100 --> 00:46:27,000 OWASP Application Verification Standard has security controls, which has like 4 levels. 593 00:46:27,000 --> 00:46:30,120 Starting with the cursory, which is level 0. 594 00:46:30,120 --> 00:46:34,300 It goes to level 1, which is opportunistic. 595 00:46:34,400 --> 00:46:36,680 Then it's standard level 2. 596 00:46:36,680 --> 00:46:38,880 Then it becomes the advanced level 3. 597 00:46:38,880 --> 00:46:48,040 And how it happens is like, ASVS level 1, which is for low assurance, for applications which are penetration testable. 598 00:46:48,040 --> 00:46:51,220 And then those are low severity applications. 599 00:46:51,300 --> 00:47:01,080 Then level 2 is like the application that contains sensitive data, which requires protection in some form and is the recommended level for most of the applications. 600 00:47:01,300 --> 00:47:08,080 Now, when it comes to level 3 ASVS, it is like the most critical applications. 601 00:47:08,300 --> 00:47:16,240 And applications that perform high value transactions, like banking, I would always recommend level 3 for them. 602 00:47:16,240 --> 00:47:31,340 So, the standard provides the requirements and it gives you the good checklist in the form of a word, CSV file, and a PDF, which we can take it and go back and map it to our own organization. 603 00:47:31,340 --> 00:47:42,140 We can use it in the requirements gathering, requirements mapping, even SKF, security knowledge frameworks, leverage is the same. 604 00:47:43,360 --> 00:47:49,420 Now, when we have mobile testing guide, why don't we have mobile top 10? 605 00:47:49,420 --> 00:47:57,370 So, we do have mobile top 10, which is like the top 10 flaws in the mobile or mobile arena. 606 00:47:57,960 --> 00:48:01,640 And mobile top 10 guide helps just with that. 607 00:48:01,640 --> 00:48:18,780 Similarly, like OAS ASVS, we have mobile ASVS, mobile application security verification standard, which is coming up or which is there, but then it's getting matured, which provides the completeness for mobile application security testing. 608 00:48:19,200 --> 00:48:26,480 Not to miss the privacy risks, because for any organization, privacy is like a big concern. 609 00:48:26,480 --> 00:48:33,760 So, another list is top 10 privacy risks, which is part of application security. 610 00:48:33,760 --> 00:48:41,200 And this project aims to offer tangible tips on how to embed privacy in the design of web application. 611 00:48:41,200 --> 00:48:49,340 It helps developer, security tester, and everyone understand the consequences of these privacy risks. 612 00:48:49,340 --> 00:48:56,100 So, these top 10 risks include web application vulnerabilities, operator side data leakage. 613 00:48:56,100 --> 00:48:58,520 Insufficient data breach response. 614 00:48:58,520 --> 00:49:00,640 All of the privacy concerns that could be there. 615 00:49:00,640 --> 00:49:05,760 Insufficient deletion or insufficient deletion of personal data. 616 00:49:05,900 --> 00:49:07,860 Non-transparent policies. 617 00:49:07,920 --> 00:49:11,960 The data which is stored in an encrypted format, which is not required. 618 00:49:12,000 --> 00:49:17,420 Or the data which is required to be encrypted, that's not being stored in the encrypted format. 619 00:49:17,420 --> 00:49:20,380 So, sharing of data with a third party. 620 00:49:20,420 --> 00:49:21,920 This addresses that. 621 00:49:21,920 --> 00:49:27,420 Because there have been breaches which have happened because of sharing the data with the third parties. 622 00:49:27,800 --> 00:49:31,920 Then, missing or insufficient session expiration. 623 00:49:32,220 --> 00:49:34,400 Insufficient data transfer. 624 00:49:34,560 --> 00:49:36,480 So, all of that, it talks about it. 625 00:49:36,480 --> 00:49:42,920 Now, when we have talked about all of this, how about avoiding all those automated bots? 626 00:49:42,920 --> 00:49:52,320 Automated technologies which run on our application and make us part of the breaches. 627 00:49:52,640 --> 00:50:03,720 So, automated threat management or automated threats to web application project helps us in understanding what are the automated threats which can be there for an application. 628 00:50:03,720 --> 00:50:08,200 And it helps us in fixing all the automation bugs. 629 00:50:08,200 --> 00:50:11,140 So, now what we have learned? 630 00:50:11,240 --> 00:50:15,020 We have gathered the requirements. 631 00:50:15,120 --> 00:50:17,500 We have done the threat modeling. 632 00:50:17,500 --> 00:50:19,160 We have done the source code analysis. 633 00:50:19,160 --> 00:50:21,960 We have done the software composition analysis. 634 00:50:21,960 --> 00:50:25,660 We have also done the vulnerability testing. 635 00:50:25,660 --> 00:50:28,800 Now, once we have done all that, we have done the technical training. 636 00:50:28,800 --> 00:50:30,960 We have some defensive controls. 637 00:50:30,960 --> 00:50:39,900 We have vulnerable applications wherein we can just pick it up and start bombarding it rather than doing it on the actual live web application. 638 00:50:40,280 --> 00:50:45,320 So, once we have added that, how about having a knowledge base of things which can help us? 639 00:50:45,320 --> 00:50:51,900 So, application security and verification standard, I don't know why, but it's so close to my heart that it fits all the places. 640 00:50:51,980 --> 00:50:54,980 Similarly, security knowledge frameworks. 641 00:50:54,980 --> 00:51:02,360 If, as a developer, I want to go back and understand, okay, I'm working on a Go code, I'm working on a PHP, or I'm working on R. 642 00:51:02,960 --> 00:51:08,960 Is there any place where I can just go and check if I use it in a certain way? 643 00:51:08,960 --> 00:51:11,460 What could be the vulnerability on this application? 644 00:51:11,940 --> 00:51:20,480 So, security knowledge frameworks is like a standard for multiple vulnerable code snippets and how to fix them. 645 00:51:20,480 --> 00:51:25,580 It helps in requirement gathering, it helps in threat modeling, and many other things. 646 00:51:25,700 --> 00:51:31,360 And ASVS, or application security verification, complements that beautifully. 647 00:51:31,880 --> 00:51:35,920 Then, another important project is Snake and Ladders. 648 00:51:35,920 --> 00:51:40,820 Now, what is Snake and Ladders and why are we talking about an application security program? 649 00:51:40,820 --> 00:51:44,820 So, Snake and Ladders is an educational application security awareness game. 650 00:51:44,820 --> 00:51:48,960 So, this is a board game for understanding the behaviors. 651 00:51:49,180 --> 00:51:51,900 Virtuous behavior is ladder. 652 00:51:52,280 --> 00:51:57,880 Then, security coding practices are OWASP proactive controls. 653 00:51:58,120 --> 00:52:02,880 And devices, or snakes, are application security risk. 654 00:52:02,880 --> 00:52:05,200 So, why are we picturizing it? 655 00:52:05,200 --> 00:52:12,400 So, this is a board game which generally is being played in Asia, wherein if a snake bites, you will come down. 656 00:52:12,400 --> 00:52:19,960 Similarly, if you have an application security risk, your application might be part of a breach or your application might be at risk. 657 00:52:19,960 --> 00:52:21,880 So, let's talk about just that. 658 00:52:22,200 --> 00:52:27,400 Another educational program or a project is Cornucopia. 659 00:52:27,400 --> 00:52:39,080 Because there are some times wherein if we want to make developers, program managers, security testers, understand why we need Agile in a security platform. 660 00:52:39,080 --> 00:52:43,600 Why we need Agile or DevOps in an application security program. 661 00:52:43,700 --> 00:52:46,380 Cornucopia helps with a card game. 662 00:52:46,380 --> 00:52:52,300 Like, we all are working remotely and we might need something to play for. 663 00:52:52,300 --> 00:52:55,600 So, this project helps with that. 664 00:52:55,600 --> 00:53:01,580 Which is a project, which is a fun game, wherein we can play online. 665 00:53:01,580 --> 00:53:04,540 And I have ordered my card, which I have yet to receive. 666 00:53:04,540 --> 00:53:09,400 And it's a beautiful bundle of cards, which I am going to play with my developers and make them understand. 667 00:53:09,400 --> 00:53:14,620 Okay, these are the challenges that we can address by using these things. 668 00:53:15,880 --> 00:53:18,760 So, I have been talking about all of it. 669 00:53:18,760 --> 00:53:21,620 But is there one place where I can see all the projects? 670 00:53:21,620 --> 00:53:27,860 So, this is the slide that I wanted to showcase. 671 00:53:27,860 --> 00:53:31,420 This is the framework, which contains every... 672 00:53:31,420 --> 00:53:37,680 So, this is the project, which contains every project that I've just told you. 673 00:53:37,680 --> 00:53:43,760 Starting with requirements gathering, till the training and awareness, and how it can help. 674 00:53:43,940 --> 00:53:46,840 And all of these slides will be available to you. 675 00:53:46,840 --> 00:53:49,860 And you can leverage it at any point of time. 676 00:53:51,220 --> 00:53:56,080 But, there comes a point when, how can you contribute to these projects? 677 00:53:56,080 --> 00:53:58,420 Because these are all open source, community driven. 678 00:53:58,420 --> 00:54:00,780 So, you can contribute to the code. 679 00:54:00,780 --> 00:54:06,880 If you feel that there is something, which you can add it to any of the projects, please do. 680 00:54:06,900 --> 00:54:13,040 But if you want to help in writing test cases, helping curate the content, please do help. 681 00:54:13,920 --> 00:54:17,500 Sometimes, not enough time, wherein we can write the documentation. 682 00:54:17,500 --> 00:54:21,920 If you want to help with the documentation, please do help. 683 00:54:21,920 --> 00:54:23,800 The project leaders, you can help. 684 00:54:23,900 --> 00:54:31,060 And also, if nothing can be possible, how about promoting a project, which is close to your heart? 685 00:54:31,060 --> 00:54:35,500 Like, there are so many projects, which are close to my heart, and I keep talking about them. 686 00:54:35,640 --> 00:54:37,760 So, you can actually talk about them. 687 00:54:37,840 --> 00:54:40,240 You can suggest some features. 688 00:54:40,300 --> 00:54:41,820 You can report the bugs. 689 00:54:41,960 --> 00:54:44,260 And actually, project leaders work on them. 690 00:54:44,260 --> 00:54:46,160 You can just make a pull request. 691 00:54:46,160 --> 00:54:47,420 Make suggestions. 692 00:54:47,580 --> 00:54:48,920 And they do work on it. 693 00:54:49,560 --> 00:54:51,800 Then, how do we move forward? 694 00:54:51,800 --> 00:54:55,000 Is there anything else that I can do with OWASP or OWASP projects? 695 00:54:55,000 --> 00:54:57,700 If I want to be part of the bigger community. 696 00:54:57,860 --> 00:55:06,320 So, OWASP.org is the place where you can go and look for the projects nearby, chapters nearby. 697 00:55:06,400 --> 00:55:07,660 And projects are there. 698 00:55:07,660 --> 00:55:08,720 All the projects. 699 00:55:08,720 --> 00:55:10,160 Even detailed information. 700 00:55:10,160 --> 00:55:11,860 I've just touched upon it. 701 00:55:11,900 --> 00:55:14,220 You can actually get the detailed view of it. 702 00:55:14,220 --> 00:55:16,520 So, OWASP.org is the place to go. 703 00:55:16,520 --> 00:55:20,520 Then, you can also join the nearest chapter. 704 00:55:20,880 --> 00:55:22,780 Like in Bangalore, I'm in India. 705 00:55:22,780 --> 00:55:23,920 Bangalore has a chapter. 706 00:55:23,920 --> 00:55:24,940 Delhi has a chapter. 707 00:55:24,940 --> 00:55:26,020 Pune has a chapter. 708 00:55:26,020 --> 00:55:27,380 Orissa has a chapter. 709 00:55:27,380 --> 00:55:30,860 So, I'm sure if you are in any part of the world, OWASP has a chapter. 710 00:55:31,040 --> 00:55:36,620 And if there is no chapter right now, if you want to start a community, do go for it. 711 00:55:36,620 --> 00:55:40,620 You can raise a request on the OWASP.org page. 712 00:55:40,620 --> 00:55:47,980 The team will work on it and provide you with the right information, sources, and help you in getting the chapter created in your area. 713 00:55:47,980 --> 00:55:52,100 Even if you are a student and you want to create a chapter in your college. 714 00:55:52,100 --> 00:55:54,460 So, there are student chapters which are there. 715 00:55:54,460 --> 00:56:00,320 So, you can be a student leader and help in your college in getting started. 716 00:56:00,960 --> 00:56:07,760 So, if you feel that you are not part of the community, you can be part of the community. 717 00:56:07,760 --> 00:56:11,060 You just have to step up and ask for help. 718 00:56:11,100 --> 00:56:14,140 And everyone will be there to help you. 719 00:56:14,140 --> 00:56:21,400 And the one thing that I've actually received from the security community is that the peeps are so helpful. 720 00:56:21,640 --> 00:56:22,860 So warm. 721 00:56:22,860 --> 00:56:24,540 And I've learned a lot. 722 00:56:24,540 --> 00:56:27,260 And that's when I'm able to contribute. 723 00:56:28,280 --> 00:56:31,860 What you can do is, you can reach me if you have any feedback. 724 00:56:31,860 --> 00:56:34,220 If you have any questions around this talk. 725 00:56:34,220 --> 00:56:40,640 Or if you want to discuss about something, you can reach me here. 726 00:56:41,380 --> 00:56:44,380 So, we are going to take question answers now. 727 00:56:45,740 --> 00:56:47,360 Thank you so much. 728 00:56:47,360 --> 00:56:50,860 And please feel free to reach me anytime. 729 00:56:50,860 --> 00:56:53,580 This is Namaste, which is a form of a greeting. 730 00:56:53,580 --> 00:56:55,580 And thank you or a goodbye.