start	end	text
14430	16230	Welcome back to AppSec Village.
16230	18170	We've made it to the end of the third day.
18170	23630	The next talk will be the final talk for AppSec Village for DEF CON 2020.
23830	26030	Now before we go into our final discussion,
26030	32990	I'd like to take a minute and thank the organizers for putting on AppSec Village 2020.
32990	36070	This is our second year. It's been a phenomenal year.
36070	40390	The team has done a great job with very unique circumstances
40390	42870	as we look around the world right now.
42870	46490	So if you have a minute, jump out to AppSec Village, hit them up on Twitter,
46490	47710	and just say thanks.
47710	52550	Because they put in a lot of work trying to get this done in a short amount of time
52550	55490	under really, really weird circumstances.
55490	58770	So thanks organizers. Thanks all the volunteers.
58850	60690	Thank you to all of our speakers.
60770	65070	It's been a fun run, and I cannot wait to do this again next year.
65070	69650	With that, let's talk about our final speaker for this year's DEF CON.
69650	74910	The final topic is going to be Running an AppSec Program with Open Source Projects
74910	77950	by Vandana Verma Sehgal.
77950	82770	Vandana is a seasoned security professional with experience ranging from application security
82770	86590	to infrastructure, and now dealing with DevSecOps.
86590	91670	She has been a keynote speaker, a speaker, and a trainer at various public events,
91670	95610	ranging from global OWASP AppSec events, to Black Hat,
95610	98690	to regional events like B-Sides events in India.
98690	101890	She is part of the OWASP Global Board of Directors.
101890	105470	She also works in various communities towards diversity initiatives,
105470	108850	including InfoSec Girls, WOSEC, and NULL.
109310	113930	Vandana has been the recipient of several prestigious awards,
113930	118690	and has also been listed as one of the top women leaders in the field of technology
118690	123350	and cybersecurity in India by InstaSafe.
123350	129990	Please welcome to the AppSec Village stage, one more time, for Vandana.
133280	136040	Hi everyone, thanks for joining the session today.
136040	141160	Today we are going to talk about how to run an AppSec Program with Open Source Projects or OWASP Projects.
141260	147360	We can also say that how to build an AppSec Program in an organization.
147500	150780	We are all heading toward modernization of applications.
150780	157160	We are all trying to use microservices, application programming interface, or APIs.
157160	160700	However, we still see that the breaches are happening.
160700	167840	And the breaches are happening because of SQL injection, sensitive data exposure, or security misconfiguration.
167960	172010	There's a big gap which our industry is grappling.
172460	175840	Organizations who want to set up an AppSec Program,
175840	179280	especially from scratch, using open source tools,
179280	181200	they have no idea where to start off.
181200	186500	They need a security program which they can pick up and go ahead and start using it.
186660	194280	OWASP has many projects which can tie seamlessly into the application security pipeline or application security program.
194460	198660	However, firstly, we don't know whether they exist.
198700	202080	Or when they exist, we don't know how to use them.
202140	204960	So, there is a big problem lying out there.
204960	212180	With this talk, I'm going to talk about how we can set up the AppSec Program using open source projects.
212180	216220	I'm going to share a framework which can help in tying up the projects,
216220	220440	especially when we are talking about using them in the DevSecOps pipeline,
220440	223400	or application security program or pipeline.
223400	228400	In the end, how we can start contributing to these projects.
228400	231220	Because it's very important to understand about these projects,
231220	234240	and how we all can help with these projects.
234240	241020	Another important aspect is that there are students who actually want to be part of application security.
241020	243140	There are so many people who ask these questions,
243140	245260	that how can I get into application security?
245260	248760	I'm a fresher, or I've been working on a network security,
248760	251740	or I've been working as a developer, I've been working as a tester.
251740	253920	How can I get into application security?
253980	259160	So, with all these projects, we can get a sense of how application security projects are set up,
259160	263860	and how we can actually kickstart our career in application security.
265440	270740	So, before I deep dive into the presentation, I want to talk a bit about myself.
270760	272280	I'm Vandana Verma Sehgal.
272280	275720	My day job is with one of the multinational companies in India.
275800	278780	And apart from that, I root for ProOne Work,
278780	283420	and I work with OWASP, which is Open Web Application Security Project.
283680	286900	I'm one of the global board of directors for OWASP.
286900	290380	Apart from that, I also work with Diversity Initiatives.
290380	293120	I am the president for InfoSec Girls.
293120	296060	I have few noted at multiple conferences.
296480	298360	Now, coming back to the topic.
298420	300640	So, this is the framework which I was talking about.
300640	305520	This is what I felt that in every AppSec pipeline, these are the things which are required,
305520	308920	like requirements gathering, threat modeling, source code review.
308920	313740	All of these things are really, really necessary when we are setting up an AppSec pipeline.
313960	320100	So, students can have their own projects, and they want to build the whole pipeline.
320100	325300	They can start understanding, okay, these are the things which are necessary and which we should be catering to,
325300	329060	which we should be addressing to, before even coming out of the college.
329200	333380	And especially for a startup, if they don't have any view that,
333380	340560	okay, if I'm going for an application security program, what are the components that I need to have?
340560	345140	So, these are some basic components which I felt that we all should have in an organization.
345400	347840	So, that's what I put in here.
347840	354460	Let me start with a framework, that how we actually can take ahead of this framework
354460	359000	and address all the loopholes in application security, especially about legacy applications,
359000	365600	desktop applications, mobile, web applications, microservices, which are exploited these days.
365600	373120	Now, cybercriminals can gain entry into an organization system and steal confidential data if we don't secure our systems.
373380	377300	And this is a fact that breaches will happen. They are inevitable.
377300	382020	And security flaws will exist. There's nothing which is 100% secure.
382020	385540	However, what we can do is, we can minimize the chances.
385800	388700	This is when the AppSec program comes into picture.
388720	394760	And this is when I thought that, okay, how about let's use the OWASP projects and get started with this framework.
394800	400640	So, one of the first thing that we need to understand is that we need to have an AppSec program,
400640	404640	because if the organization doesn't feel that they need to have an AppSec program,
404640	407060	the framework will never going to help us.
407720	413100	So, we need to have an inventory that these are the applications that we have,
413100	415600	or these are the applications we are going to build.
415760	420540	So, with requirements gathering, first we need to have the requirements gathered,
420540	423460	that these are the things that we need in an application.
423460	426580	These are the applications that we have.
426680	429020	Everything needs to be noted down.
429020	433440	But where? Are we going to have some place where we can list down?
433440	435340	Okay, these are the things that we have.
435340	441260	And on those things, we are going to decide, okay, yes, this is our plan.
441640	447000	So, OWASP Security RAT, Requirements Automation Tool, is an amazing project,
447000	450960	which actually can help in automating the security requirements,
450960	453340	especially during the development phase.
453420	457440	Now, when we have simplified automated requirement gathering,
457440	463240	it streamlines the whole process, because that's where the organization starts off.
463720	467400	Now, apart from that, there's another beautiful project,
467400	469200	which is OWASP Security Knowledge Framework,
469200	473780	which is a big, exhaustive project in itself.
475240	479580	It's kind of an ocean, wherein you have everything.
479580	481820	You can note down the requirements.
481820	487180	There's a proper medium wherein you have a lot of requirements mentioned.
487180	491060	On top of it, you can mention your own requirement.
491060	494040	And based on those requirements, we can define,
494040	497920	we can figure out that what's the severity of an application.
497920	501480	We can map it with application security verification standard.
501480	505300	We can define the maturity of our application,
505300	508000	our organization application security program.
508000	514900	It provides a beautiful layout with best practices which developers can use.
514900	519460	So, when we have RAC for automation and Security Knowledge Framework,
519460	521720	we can gather the requirements very well.
521720	524080	Because if we don't gather the requirements very well,
524080	526600	we would never be able to secure application.
526600	531100	Or we would never be able to build an application which is secure enough.
531100	537620	So, first we need to have our own requirements noted down somewhere with the right medium.
538600	540420	Then, once we have...
540420	543440	Okay, these are the things that we need in an application.
543440	545900	We need to threat model our application.
546140	550640	Likewise, if we already have an application, we are going to build a feature.
550740	554720	That time also we need to have a proper threat modeling in place.
554720	556260	But how to do the threat modeling?
556260	558780	It's like, it's a kind of a jargon.
558780	563000	It's a kind of a technical term which we all have been talking about.
563000	566460	But we don't understand, okay, how to go about it.
566460	568200	Not everyone work on threat modeling.
568200	570380	But it's actually a simple one.
570380	573640	We can now use threat modeling as a code.
573720	577040	We can use the tools like Threat Dragon.
577120	583620	When you put all the details in it, it provides a beautiful graphical overview.
583620	586220	Okay, these are the things that you have.
586380	588620	And this is your application.
588700	594800	So, I'm going to tell you whether it's a high severity application, medium severity application or a critical application.
595300	599920	And if something happens to an application, what will be the impact?
599920	607120	So, Threat Dragon provides a beautiful view of threat modeling, how we can threat model our application.
607180	618160	Similarly, PyTM, which is a Pythonic framework for threat modeling, which is a beautiful and amazing data flow diagram project.
618160	624200	Now, sometimes we don't understand, okay, the pieces are scattered everywhere.
624200	630060	Now, if we have a flow chart, okay, now this is the thing where we are heading left.
630240	633000	If we are right, we are going to go left.
633460	636900	And if there is a problem, we should be stopping on the right side.
636900	643080	So, with an amazing flow diagram, PyTM helps us in the threat modeling.
643640	649580	So, all the details I've mentioned, okay, this is how the diagram looks like, if you can see on the right side.
649580	655860	And it is like sequence by sequence, analyze the application and give you the result.
656020	660140	And where you can find it, you can find it on this particular project's page.
660140	669820	And you can look through it, you can understand there are so many resources which are available for you to guide how you can get started with it.
669820	675480	Because I'm going to talk about many projects in this particular talk and giving you overview on it.
675480	677340	Okay, this project does this.
677340	682500	Because while I was learning about OWASP projects, few projects I knew.
682500	686940	But there were few projects which I wanted to understand when I was building up this framework.
686940	691400	So, I realized I had a different understanding of these projects.
691400	694760	I thought, okay, this project was this.
694760	703360	But when I actually researched through it, over the years, the projects have actually enhanced a lot.
703360	706780	So, the project working, I'm going to talk about.
707640	712760	So, once we have done the requirements gathering, we have done the threat modeling.
712760	716540	Now we know, okay, this is the thing that we have in an organization.
716600	719960	These are the requirements we are building up in an application.
719960	724320	Or this is a new application which we are completely building from scratch.
724600	728300	So, once we have that, we are going to work on the code.
728300	734460	Now, when we are going to work on the code, we need to have the code which is securely developed.
734460	743080	Especially, we have talked about so many research projects wherein if we fix a bug in production,
743080	748480	which is a much higher cost than the bug which can be fixed in the development phase.
748480	750160	Or even earlier than that.
750160	753140	Like in the requirements gathering, we start talking about security.
753140	754860	Or even threat modeling.
755060	758960	We talk about, okay, these are the things that we should be fixing now,
758960	763080	which can help us in the later stages of the application security project.
763660	768500	So, code review checklist is like an amazing checklist which provides, okay,
768500	771140	these are the things that should be fixed in a code.
771220	773620	These are the things that can be guided in.
773820	777940	We can actually build our own checklist on top of it.
777940	779260	Like for source code review.
779260	784760	I have built my own checklist on top of the ones that have been provided by the code review checklist.
784780	788820	Similarly, there is another project which is code first project.
788820	796660	Which is a project which helps in finding the code which might be left behind.
796660	799880	Or which we might have left at some point.
799880	806340	So, a continuous challenge with any penetration testing or even in code review.
806340	810040	That we don't know whether we have covered everything or not.
810040	812500	Whether we have covered the whole application or not.
812500	816600	So, it's purely a black box perspective.
816600	826640	Which actually makes it almost impossible to accurately identify how much of the code or an application attack surface that has been tested.
826640	835820	So, code first is actually a glass box tool that provides the insight into the real-time code coverage of penetration testing.
835820	838440	All the activities that are being done.
838440	843600	So, it automatically detects the coverage information with the test being conducted.
843660	850740	And will even make it possible to understand the overlap and the boundaries of different tools coverage.
850980	855600	So, code first presents the coverage information in a visual form.
855600	857120	If you can see on the right.
857160	859300	So, this is how it provides.
859300	861900	Wherein you have a beautiful view.
861900	864440	Okay, these are the things that have been covered 60%.
864440	867260	These are the things that have been covered 90%.
867260	873980	So, the real coverage or real-time coverage feedback makes it easy to adjust the testing activity.
873980	876680	Especially based on the observed coverage.
877240	881640	In addition to those testing activities which are relying on multiple techniques.
881920	888880	It's easy to split up the recorded activity to independently and alternatively understand the overlap.
888880	890420	Between multiple tools.
890420	894220	Because we have so many tools from which we test an application.
894220	898040	So, CodePulse really helps us with that.
898040	902340	Now, we have understood that this is what we have done with the code review.
902340	910780	But how about a specially designed code review checklist or practice guide for a certain code.
910780	911900	Like GoCode.
911900	915220	GoCode, I started learning a couple of years back.
915220	919700	But before that, it was like a completely new arena for me.
919700	923460	And then came up OWASP Go Secure coding project.
923460	926620	Which helped me in understanding, okay, this is a Go language.
926620	929420	And this is how we can securely code it.
929440	936420	So, Go Secure Code is another incubator project which can help us in understanding the basics.
936960	939860	That how to secure GoCode.
940320	944780	Another beautiful checklist is the cheat sheet series.
944780	950140	This cheat sheet series helped me a lot, I would say.
950140	956080	Because this provides an amazing overview that this is a vulnerability.
956080	961000	This is how an attacker can exploit it if we don't fix it.
961000	963800	And then remediation procedures.
963800	966160	It's a beautiful checklist.
966560	972700	And it has actually catered and helped me in multiple projects in my multiple organizations.
972700	976120	So, if you look through it, it's a beautiful document.
976120	978680	And there's a beautiful documentation around it.
978680	981940	For so many vulnerabilities, for so many controls.
982400	984900	It is an exhaustive list.
984900	992940	Starting from input validation, to cross-site scripting, to xxe, to indirect object reference, to any other vulnerability you talk about.
993100	994960	It has the details.
995060	997780	So, you should actually take a look at this cheat sheet series.
997780	1003760	And every time I look at it, I actually feel that I'm more connected to it.
1003760	1009600	I really fell in love with this cheat sheet series, the new one that has been developed by the team.
1009600	1014340	Or the remodeled website which is there for the cheat sheet series.
1014640	1023500	Another important aspect is, when we have worked on the code review, and we tend to miss software composition analysis.
1023500	1027780	Which we have seen that there are breaches which have happened in the past.
1027780	1028960	Like Equifax.
1029120	1033320	Those happened because of using the components with known vulnerabilities.
1033720	1035780	Or there were projects which were in use.
1035780	1042880	There were open source code which were in use, but we missed to update the code.
1042880	1044980	There were so many reasons.
1045300	1050560	So, when we know these things are there, why don't we fix it?
1050560	1051820	But how to fix it?
1051820	1052940	It's a big challenge.
1052940	1063340	I was actually going through one of the research paper wherein white source has quoted that 96.5% code on the internet is all open source.
1063440	1066160	That's a huge amount of code.
1066200	1072060	When almost all the code on the internet is open source, what can go wrong?
1072260	1078180	Which means, can we say that everything which is lying over there, which we are using is all secure?
1078180	1078840	No.
1078840	1081860	If that's the case, then breaches wouldn't have happened.
1081860	1083680	Why the breaches are happening?
1083960	1091840	So, to reduce that, we have started understanding that we should have software composition analysis wherein we are scanning our code base.
1091880	1097160	But is it too easy to buy a software composition analysis tool?
1097640	1099660	We just go ahead and buy it?
1099720	1106100	I am not against the tools, but I am in no support of buying a tool in the first place.
1106300	1110180	You are just saying that you want this and you are going ahead with the tool.
1110180	1112480	So, what else can we do?
1112480	1114480	Is there any project by OWASP?
1114480	1115260	Yes.
1115260	1121480	So, OWASP has dependency check, which is called DC, people call it as.
1121480	1130560	So, dependency check, this is an open source component, which is now an integral part of many organizations.
1130620	1135520	And it helps in checking or scanning open source components.
1135520	1137280	So, why it helps?
1137280	1143720	Because now, as I mentioned that open source components have become an integral part of software development.
1143720	1154180	We need to make sure throughout the development process, the software products, which we are actually creating and even maintaining, don't contain the vulnerable components.
1154240	1156460	Or the breaches will keep happening.
1156460	1167560	If we are using any third party library, we have to make sure that we are making sure that there is a place wherein we are updating them.
1167560	1171500	We are keeping a record, okay, these are the libraries which exist.
1171700	1174100	So, how should we do that?
1174140	1176840	Are we going to just go ahead and buy a tool as I said?
1176840	1179880	No, I am not going to do that.
1179880	1193940	The increasingly widespread use of open source components have actually taken us to a way wherein if we don't know what we have in our code, we will never be able to secure our organization from any of the breaches.
1194180	1205880	So, we need to understand that throughout the development process, the software products that we are developing or we are creating, we need to maintain them.
1205880	1210660	We cannot just think that, okay, we have developed a product and we are good.
1210720	1213180	We need to actually keep updating it.
1213180	1216460	But how to keep a track of all the third party components?
1216460	1236300	OWASP Dependency Checker actually helps or resolves these concerns for developers which identifies project dependencies and checks if there is any in the code or if there is a publicly disclosed vulnerability in the code as part of open source component.
1236300	1243300	Now, how good it is or how bad it is or how heavy is this?
1243300	1247380	Because all the tools that I have been working on, they are so heavy.
1247760	1255680	So, to put it this way, OWASP Dependency Check is the lightweight and very easy to download, install and run component or a tool.
1255720	1261560	So, when I downloaded it for the first time, it took me some time to download the NVD database.
1261760	1263580	However, after that, it was a Delta scan.
1263580	1265540	So, it was like a very quick scan.
1265540	1269200	So, the scanning process is seamless.
1269580	1276180	When we are scanning the code, it finds out, okay, these are the third party components we have in the tool.
1276380	1280460	And these are the products. This is the version.
1280460	1285740	And we have to fix this particular version if there is a vulnerability that exists.
1285820	1295520	So, there are plugins which are available for Gradle, Maven and many other projects which allow us to integrate them as part of our whole lifecycle.
1295520	1300770	We can integrate with Jenkins, which can allow us to integrate with the CI-CD pipeline.
1301400	1310340	So, apart from that, we also have OWASP Dependency Check, which is an intelligent supply chain management or component analysis project
1310340	1318920	or a platform that allows organizations to identify and reduce risk from the third party early in the lifecycle.
1318920	1330300	And this can also help us in tracking the application, tracking the libraries, tracking the frameworks that we are using, operating systems and hardware components.
1330300	1334160	It's like a huge list. Apart from that, what else it helps us?
1334160	1345180	It helps us in identifying multiple risk areas like component with known vulnerabilities, out-of-date components, modified components, license risks.
1345780	1348380	Then there are many other things which are coming soon.
1348380	1354760	So, it includes a comprehensive auditing workflow for triggering results.
1354760	1361160	Because once we have scanned it, if we don't have a proper result, obviously we are going to suffer it.
1361160	1364380	So, once we figured that out, we need to have the results.
1364520	1370040	And not just that, it is very simple to configure as well.
1370040	1373780	Because configuring a tool is like a nightmare sometimes.
1373780	1383280	I've been in the industry for quite some time now and I've worked on all the tools starting from the basic tool to the advanced tool that we have.
1383280	1387760	So, I know sometimes it's like pain to configure a tool.
1387760	1390560	So, this is like a pretty easy to configure project.
1390620	1394000	And we can go ahead and get started with the bigger projects.
1394300	1397420	Now, we have gathered the requirements.
1397620	1400020	We've done the threat modeling.
1400020	1402640	We've done the source code review.
1402640	1403680	What else we have done?
1403680	1406120	We've done the software composition analysis.
1406300	1408080	So, what else is pending?
1408460	1409840	Vulnerability testing.
1409840	1415300	When I started in the industry, we were doing very less of a code review.
1415580	1417980	Leave the software composition analysis.
1418020	1420860	We were just doing the vulnerability assessment and we are good.
1420880	1425220	And I have been an evil person in the project team.
1425220	1429600	Where if there was a critical vulnerability, I have stopped the releases.
1429600	1431260	But then over the year, we all grow.
1431260	1432220	We in the industry grow.
1432220	1436440	We understand, okay, stopping a release is never going to answer us.
1436560	1439640	So, we need to go through all the life cycle.
1439640	1441300	How about we start early?
1441300	1442300	We shift left.
1442300	1443440	And that's where we are.
1443440	1445100	We are all shifting left.
1445480	1447200	We are talking about it.
1447500	1453300	So, now in the vulnerability testing, what are the things we cater to?
1453300	1456400	Like, what exactly we can use?
1456400	1459300	Or how exactly we can perform a vulnerability testing?
1459300	1462640	We've been doing, okay, most of the aspects we must be knowing.
1462640	1463500	I'm sure.
1463500	1468480	But then how about using the open source project for that?
1468580	1471320	So, let me go ahead and get to it.
1471320	1474520	So, this one, I'm sure you must be aware about it.
1474520	1477520	Web Application Security Testing Guide.
1477820	1483600	Which is an exhaustive guide on how to start an application security testing.
1483600	1486300	Robots.txt file.
1486320	1487820	What is crawling?
1487820	1489260	What is spridering?
1489260	1491200	What is STLC?
1491220	1492860	Software Development Life Cycle.
1492860	1495220	Everything in detail.
1495320	1498640	If there is a flaw, information gathering.
1498920	1501420	Everything summarizing it.
1501420	1503660	Like, okay, this is what it is.
1503820	1510300	Then, if this has a problem, what will be the vulnerability?
1510440	1514280	Once the vulnerability is there, how to remediate it?
1514280	1518320	I've created a presentation on how to implement a web security testing guide.
1518320	1520360	You can actually look through it.
1520360	1526040	So, which provides a good detail about how to use the web security testing guide.
1526040	1527540	And it will help you.
1527540	1528360	Trust me.
1528360	1530680	It's an amazing guide.
1530700	1535180	So, when I was introduced to OWASP, this was the first thing I was introduced to.
1535180	1537840	There's a web security testing guide which exists.
1537860	1539920	And I should start using it.
1539920	1546240	And that's where my journey in detail in application security testing started off.
1546240	1551620	Now, when application security testing guide is there, we're talking about applications.
1551740	1555400	But in the beginning, I mentioned that we're all talking about modernization.
1555400	1558520	We're all talking about using APIs.
1558520	1564780	So, when all of these things are there, how to make sure that we are using them correctly?
1565060	1567780	And there's no flaw in them.
1567780	1573520	So, OWASP API Security Top 10 answers just that.
1573520	1586060	Wherein, it is a good list of the top 10 breaches or the top breaches that can happen from all the vulnerabilities which are listed in the project.
1586360	1591460	And it also helps at the same time that how to fix that bug.
1591460	1594620	How this bug can be avoided.
1594620	1599580	All of these things are part of OWASP API Security Top 10 Guide.
1599580	1604100	And not just that, the project leaders keep on enhancing it.
1604100	1608700	Wherein, API Security Testing Guide, they start working on it.
1608700	1612420	They are planning to merge it with the Application Security Testing Guide.
1612880	1615960	It's more of an add-on to it.
1616040	1618200	So, API Security Testing would be there.
1618200	1622480	But then, it will be an add-on to Web Application Security.
1622480	1624980	Applications are using APIs.
1624980	1627580	But how to secure those APIs?
1627580	1630900	How to find the bugs at the right time?
1630900	1634440	Especially with the rise of APIs that we have seen.
1634440	1636060	There's a huge amount of APIs.
1636060	1639380	Even for a small function, we start using APIs.
1639380	1642440	A small web app call, we start using it.
1642440	1646820	APIs, when they expose application logic.
1646820	1650760	And they contain so much sensitive data.
1651320	1652840	Like PIR data.
1653560	1657720	And there's so much other information when that's there.
1657720	1660360	So, it becomes evitable that we secure them.
1660360	1664320	So, this crucial project helps in understanding
1664320	1670420	or making us understand what role API plays in an application architecture.
1670420	1676280	And how we can take help from the API Security Project to secure them.
1676280	1681000	At the same time, how emergence of APIs,
1681000	1683860	especially specific issues related to them,
1683860	1686640	need to be considered into the radar.
1686640	1689220	We cannot just avoid them.
1690320	1692920	Now, when we have something for APIs,
1692920	1694840	when we have something for applications,
1694840	1697360	do we not need it for mobile?
1697360	1702000	Because we all are working day in and day out on the mobile devices.
1702000	1704900	So, we need something for mobile devices as well.
1704900	1707320	So, there has to be something like a testing guide
1707320	1712920	which should be there for mobile or mobile application security testing.
1712920	1717220	Project leaders and everyone call it as Mobile Security Testing Guide, MSTG.
1717220	1720400	Which is an exhaustive list of testing procedures
1720400	1725440	which contains Android, iOS, and many other things.
1725440	1731120	So, it's like a complete detailed project on mobile security testing.
1731120	1734940	So, I would say, I would recommend you to go back and check
1734940	1742520	how it can help you in mobile security development of an application.
1742540	1747880	So, if you want to take a view, this helps just with that.
1747880	1752440	Another important aspect is that it also has a beautiful ASVS
1752440	1755320	which is Application Security Verification Standard
1755320	1761720	which has step-by-step information and an exhaustive checklist.
1761720	1764020	Because now you have a big testing guide.
1764340	1766980	And from that testing guide, you tend to make a checklist.
1766980	1767800	I did it.
1767800	1772940	Trust me, I had no idea there is something called ASVS that exists way back.
1773320	1779460	But now I would say that it's like a beautiful moon for me
1779460	1784260	where it is helping me in my own projects now also.
1784480	1786740	And I recommend it to the developers.
1786740	1793240	I recommend it to the functional testers who are actually working on all the groundwork.
1793240	1796440	So, this really helps in mobile security.
1796940	1799880	Another thing is how to automate everything.
1799880	1801780	Now we are doing web application testing.
1801780	1805200	We are doing the mobile security testing.
1805200	1808320	But is there any tool that can help us in doing that?
1808320	1810060	That is an open source tool.
1810120	1814580	So, OWASP ZAP, which is Z-Attack Proxy, helps just with that.
1814580	1820200	There are so many APIs which are available which we can integrate with the QA tools
1820200	1822940	or functional testing tools like Selenium.
1822940	1825100	Many other tools that can be integrated.
1825280	1832140	And if we specifically want to call a specific API from this tool, we can just do that.
1832140	1834160	So, ZAP really helps.
1834160	1836600	And especially how it came into existence.
1836600	1842520	The project leaders, they were developers.
1842520	1843940	Yes, you heard it right.
1843940	1846780	They were not the security testers. They were developers.
1847120	1851600	So, they were facing a lot of issues with the application security testing.
1851600	1853560	And sometimes it becomes crazy.
1853560	1861060	So, they developed a project, ZAP, and now it's being used widely all over the world.
1861060	1864980	And it has multiple test cases.
1864980	1869020	You can create your own test cases and upload it on it.
1869040	1873340	If I talk about myself, I also have created multiple test cases.
1873340	1875040	And I have uploaded on ZAP.
1875040	1877020	And I keep testing them.
1877100	1881620	I make sure that I use it exhaustively for my pen test assignments.
1881880	1885920	Apart from that, there's another project which is AMAS project.
1885920	1889940	Now, what is this AMAS project? You might not have ever heard it.
1889940	1894200	So, when I heard about it, I felt, oh, there's something that exists.
1894200	1895040	Wow.
1895080	1900180	So, OWASP AMAS project performs the network mapping of attack surface.
1900180	1903420	And it can also check for the external asset discovery.
1903420	1908780	So, if there are any assets which are outside the organization, we can actually figure them out.
1908780	1914280	Using this open source information gathering and active reconnaissance technique, which it has.
1914280	1920920	So, it can actually use multiple search engines.
1920920	1924320	It can use the SIM tools.
1924320	1928460	It can leverage APIs from multiple tools.
1928460	1932260	It can also leverage and figure out web services.
1932260	1936240	So, it's an amazing project which provides the reconnaissance technique.
1936240	1942380	And once we have our application, we want to know what are the components which are open source or which are on the internet.
1942380	1945540	So, AMAS project is the project to go for it.
1945540	1949360	And I would strongly recommend you just take a look at it.
1949460	1952700	So, you should actually take a look at this project.
1952700	1957120	Now, once we have done that, we have got the requirements gathered.
1957120	1960400	We have got the requirements gathered.
1960400	1962500	Then we have done the threat modeling.
1962500	1964460	We have done the source code review.
1964460	1967040	We have done the software composition analysis.
1967040	1968180	What else we have done?
1968180	1970280	We have done the vulnerability testing.
1970280	1974440	Now, once that's done, is there any place we can document it?
1974440	1982020	If, as a startup or a person who is new to the industry and I don't have a paid commercial tool, so what should I do?
1982060	1985460	Defect Dojo helps just with that.
1985780	1993640	It's an amazingly wonderful tool which actually documents the findings.
1993640	1996400	It can be integrated with commercial tools as well.
1996400	2000940	So, when it documents the findings, it provides the severity levels.
2000960	2002520	High, medium, low.
2002520	2004040	And it keeps on popping it.
2004040	2010000	If you can see on the right-hand side, there is a beautiful graphical view that it provides.
2010000	2013600	Especially if you have to send a report to the management.
2013600	2016880	Because leadership always looks for graphs, reports.
2016880	2020180	They don't want to go like, okay, these are the 10 vulnerabilities that are there.
2020180	2022060	These are these things which are there.
2022060	2024040	So, they look for numbers.
2024040	2029420	They look for understanding, okay, these are the high-level items that we need to address.
2029420	2040760	So, Defect Dojo is a tool that actually not only stores the findings, but also helps in streamlining our entire application security program.
2040760	2044440	It simplifies vulnerability management by offering templates.
2044440	2046300	So, we can have our own templates.
2046300	2047800	We can generate the report.
2047800	2049980	We can have metrics.
2049980	2057660	We can check if there are duplicate findings which were there in the past report and now it's coming up again.
2057660	2059540	There's a baseline that we can set.
2059540	2061460	We can fine-tune the project.
2061460	2070000	So, the top goal for this project is to reduce the amount of security professionals which they take in logging vulnerabilities.
2070240	2072400	So, Defect Dojo addresses that.
2072400	2076900	Because I have worked with the top-notch pen testers.
2077420	2082480	And especially the people who worked for me, they were facing a lot of challenges in reporting it.
2082780	2085120	Like, reporting it in the tool.
2085120	2086060	It's a big challenge.
2086060	2087760	Like, you have to copy-paste, this, that.
2087760	2092720	It's more of a job wherein sometimes you feel, oh, this is not what I want to do.
2092720	2094600	But this is an important task.
2094600	2099080	If you don't log it, there's no point doing all of that.
2099080	2106040	So, Defect Dojo helps in template system, which is like a template system for vulnerability.
2106040	2109310	It can provide self-service baseline tools.
2109940	2114220	It can also import common vulnerability scanners.
2114300	2119460	So, if there is a scanner which is like Collis, Nessus, it can actually fetch the data from there.
2119460	2121060	Fetch the reports from there.
2121300	2125520	And then generate the report based on the one that we require.
2125520	2128120	It can provide the beautiful metrics.
2128660	2138600	Which is like, you can see that it provides a dashboard with a beautiful summary health check of the overall product or application security program.
2139320	2147100	And, once we have that, because it's important to fix the bugs, we need to make sure that we have some defensive controls.
2147200	2149540	Now, what are these defensive controls?
2149660	2151140	Why do we need it?
2151140	2157540	Because sometimes, when we have all of it, we need open source defenses as well.
2157540	2164400	Think about, there's something which is placed in front of my application and it's helping me.
2164820	2169180	So, these defensive controls help just with that.
2169220	2173120	So, there are some of the defensive projects which I have mentioned.
2173120	2180060	There are a few projects which are under pipeline, which you can just go to OWASP.org and you can get to know about them.
2180060	2188220	So, CSRF Guard is one of the projects which helps us in avoiding CSRF vulnerability, cross-site request forgery, because that had been a pain.
2188220	2194820	Even though that's not part of OWASP anymore, but then it's still a problem with many, many applications.
2195040	2198620	So, CSRF Guard actually helps with that.
2198620	2211640	And then another project is OWASP ModSecurity Core Ruleset, which is a set of generic attack detection rules for use with the ModSecurity.
2211640	2216120	And it acts as a web application firewall.
2216120	2229360	So, Core Ruleset's main goal is to protect the web application from a wide range of attacks, including the OWASP 10, with the minimum false alerts.
2229360	2235300	Because if there's a web application firewall, it sometimes actually generates a lot of false alarms.
2235300	2240300	So, it protects us from insecure web application design.
2240300	2253360	So, ModSecurity rulesets, I would say, can actually provide a layer of protection for web application, such as WordPress, PHP, VB, or any type of web application.
2253360	2264680	It can actually potentially protect against vulnerability or vulnerable applications, which are outdated or which are using the outdated components.
2265240	2269600	It can also protect us against the generalized malicious traffic.
2269600	2274860	We've seen that DDoS or DDoS is like a big problem for any organization.
2274860	2276860	So, it helps us with that.
2276940	2284520	And it can identify that this is a malicious traffic by using the ModSecurity rulesets.
2285840	2290380	Another important project, which I never want to miss, is Proactive Control.
2290380	2301720	Now, what this Proactive Control is that once we are developing an application or once we have this application developed, we want to make sure that we are proactively monitoring it.
2301720	2314080	So, Proactive Control helps with that, wherein it provides a list of controls that developers, testers, security researchers need to know.
2314080	2321000	These are the pointers like encode data, verify for security early and often.
2321000	2323280	All of this, we should know.
2323320	2326060	And what are the frameworks and libraries we should be using.
2326060	2329740	If we are using third-party libraries, when to secure it.
2329740	2334160	So, all of that, Proactive Control is emphasizing on that.
2334160	2338940	And it's the place to go for any of the developers, I would say.
2340260	2347560	Now, once we know about Proactive Control, what else we should be looking at?
2347700	2356220	Now, we have the Proactive Controls, how about we train our developers, testers, and even the people who are part of security.
2356220	2360840	It's very, very important to secure our applications.
2361060	2367240	Because if we don't train our people, we would be leaving so much behind.
2367240	2370540	So, what are the things that can help us?
2370660	2373620	Is there any place where I can learn this?
2373920	2378380	So, OWASP WebGuard is one of the oldest projects, I would say.
2378380	2379880	One of the oldest projects.
2380340	2386340	That used to come in a CD and I have copied on my system and then started working on this particular project.
2386340	2388420	Which has matured over the years.
2388420	2398580	So, OWASP WebGuard actually is a deliberately vulnerable web application where there are so many challenges which we can solve and we can fix the bugs.
2398580	2402620	So, it gives you a view that, okay, this vulnerability could be looking like this.
2402660	2404480	So, it helps with that.
2404600	2410560	Another project is Security Shepherd, which I usually use in my trainings, which I give.
2410560	2417280	So, this is like an exercise which you can see on the screen that, yes, it's a lesson and there's a scoreboard.
2417280	2422100	Once you solve all of these things, it becomes from cross to check.
2422540	2427580	And it provides an exhaustive list of all the test cases.
2427580	2430860	There's a SQL injection that can be done multiple ways.
2430860	2433080	It provides that. There's a blind SQL injection.
2433080	2434360	How does that happen?
2434360	2435680	So, it provides with that.
2435680	2442740	So, it builds a story around an application and helps us in understanding the bugs.
2443060	2450100	Another project is DevSlock, which is more of a working project rather than a training project.
2450200	2462540	But this is still, I would say, it's a part of a learning, which provides a view of application security, DevSecOps, or DevOps with security in a working way.
2463780	2467880	This particular project can be used in the whole DevSecOps lifecycle.
2468300	2474200	And how this particular project can be used could be in the source code review.
2474200	2479060	So, the team actually works real-time on that, do the live demos.
2479060	2480760	There are failures that do happen.
2480760	2488140	Even I was part of one of the sessions wherein I gave a session on dependency check and we were troubleshooting live.
2488140	2491640	Okay, we downloaded dependency check.
2491640	2492700	What next?
2492700	2495280	How are we going to work with NVD database?
2495280	2496760	How are we going to run the scan?
2496760	2498460	Where are we going to put the jar files?
2498460	2500340	Where are we going to pick the code?
2500340	2503480	So, everything we did live on the session.
2503480	2508880	It's not like we are actually recording a video and then cutting it.
2508880	2511900	Whatever is the best shot, that should be there.
2511900	2512780	No.
2513000	2515020	They do it live.
2515200	2516180	Failures do happen.
2516180	2519120	They keep on implementing those new things.
2519120	2520440	They keep on working on it.
2520440	2524120	And all the sessions, you can see it on the OWASP project.
2524120	2531660	Similarly, they have PXE, which is an Intentionally Vulnerable API project.
2531660	2534580	Which is an amazing project you should take a look at.
2535120	2545060	So, now, once we've talked about it, how can I leave Jushop, which is like the most modern web application with all the relevant bugs.
2545060	2547320	And even I have used it for CTFs.
2547320	2550020	You can use it for CTFs within the team as well.
2550020	2557300	So, I wanted to showcase some of the test cases to one of the development team and even my team.
2557300	2563800	So, we used it as a project, as a CTF platform for the testing.
2563800	2573260	And it has actually helped us a lot in finding and making the teams understand these are the bugs that exist in an application.
2575360	2579000	So, this really helps with that.
2579760	2590000	Another thing is that when you go to Jushop, it gives you a kind of feeling like a real application.
2590000	2592140	And then you start exploiting it.
2592140	2596440	So, I really like the project and even the project leaders are super cool.
2596440	2598760	They keep on adding new stuff in it.
2598760	2610040	If you reach out to them, if you want to help them, help them in modifying some challenges or adding some new challenges, they are always open for it.
2610040	2612220	So, make sure that you reach out to them.
2612740	2619080	Once we know about these projects, how about we go to the awareness item.
2619080	2620760	Now, we have talked about testing.
2620760	2622920	How can we miss top 10 projects?
2622920	2630100	I am sure everybody knows that there is a flagship project, top 10.
2630100	2636500	And any organization which wants to secure application security, they go through top 10.
2636500	2645220	And they use top 10 as like a project which cannot be forgotten, which cannot be left behind.
2645220	2647200	It acts as a framework.
2647200	2653520	We have to make sure that top 10 bugs don't exist in an application or in our application.
2653520	2658240	You must be thinking that I have covered so many things around application security, mobile security.
2658240	2660600	And did I leave OWASP top 10?
2660600	2661480	No.
2661480	2669840	So, I have left it for the awareness session that we all should be aware that OWASP top 10 exists.
2669840	2676760	And every 3 to 4 years, there are new sets of top 10 cases which come.
2676760	2679540	And those are not done by OWASP.
2679540	2681000	It's done by community.
2681000	2682600	It's done by the organization.
2682600	2684480	The data comes from the organization.
2684560	2687160	And then people work on it. Community work on it.
2687160	2688640	Community share the feedback.
2688640	2692520	Okay, these are the test cases that are there.
2692520	2694960	Or these are the top 10 vulnerability.
2695140	2698640	And every 3 years, you would see this shuffling happening.
2698980	2705740	And past few years, I would say, SQL injection has been on top.
2705740	2710500	Which I would say that we all have to work together and make sure that that actually goes down.
2710500	2719040	There are few vulnerabilities which have taken a place like using components with open source or vulnerable components.
2719340	2723540	Using components with known vulnerabilities, which is A9.
2723540	2731080	Then XXC, that has become a part of it, which is A4, which is on the top 4 list.
2731080	2734040	So, it addresses all of that.
2734040	2740260	Then, there's another amazing project, which is ASVS, Application Security Verification Standard.
2740260	2742280	Which I've talked about in the beginning.
2742280	2744420	So, what it is.
2744420	2753160	So, the primary aim of OWASP Application Security Verification Standard is to provide an application security platform,
2753280	2757040	a standard for web apps and web services of all types.
2757560	2760980	And my experience is like, I'm a big fan of checklists.
2760980	2769120	And during my penetration testing time when I was starting off, from web testing guide, I created my own checklist.
2769120	2773460	And then later, I got to know that there is something called ASVS that exists.
2773460	2775200	It was a bummer for me.
2775200	2779840	So, I thought, why don't I introduce it to you.
2780100	2787000	OWASP Application Verification Standard has security controls, which has like 4 levels.
2787000	2790120	Starting with the cursory, which is level 0.
2790120	2794300	It goes to level 1, which is opportunistic.
2794400	2796680	Then it's standard level 2.
2796680	2798880	Then it becomes the advanced level 3.
2798880	2808040	And how it happens is like, ASVS level 1, which is for low assurance, for applications which are penetration testable.
2808040	2811220	And then those are low severity applications.
2811300	2815260	Then level 2 is like the application that contains sensitive data,
2815260	2821080	which requires protection in some form and is the recommended level for most of the applications.
2821300	2828080	Now, when it comes to level 3 ASVS, it is like the most critical applications.
2828300	2836240	And applications that perform high value transactions, like banking, I would always recommend level 3 for them.
2836240	2851340	So, the standard provides the requirements and it gives you the good checklist in the form of a word, CSV file, and a PDF, which we can take it and go back and map it to our own organization.
2851340	2862140	We can use it in the requirements gathering, requirements mapping, even SKF, security knowledge frameworks, leverage is the same.
2863360	2869420	Now, when we have mobile testing guide, why don't we have mobile top 10?
2869420	2877370	So, we do have mobile top 10, which is like the top 10 flaws in the mobile or mobile arena.
2877960	2881640	And mobile top 10 guide helps just with that.
2881640	2898780	Similarly, like OAS ASVS, we have mobile ASVS, mobile application security verification standard, which is coming up or which is there, but then it's getting matured, which provides the completeness for mobile application security testing.
2899200	2906480	Not to miss the privacy risks, because for any organization, privacy is like a big concern.
2906480	2913760	So, another list is top 10 privacy risks, which is part of application security.
2913760	2921200	And this project aims to offer tangible tips on how to embed privacy in the design of web application.
2921200	2929340	It helps developer, security tester, and everyone understand the consequences of these privacy risks.
2929340	2936100	So, these top 10 risks include web application vulnerabilities, operator side data leakage.
2936100	2945760	Insufficient data breach response. All of the privacy concerns that could be there. Insufficient deletion or insufficient deletion of personal data.
2945900	2951960	Non-transparent policies. The data which is stored in an encrypted format, which is not required.
2952000	2957420	Or the data which is required to be encrypted, that's not being stored in the encrypted format.
2957420	2961920	So, sharing of data with a third party. This addresses that.
2961920	2967420	Because there have been breaches which have happened because of sharing the data with the third parties.
2967800	2971920	Then, missing or insufficient session expiration.
2972220	2976480	Insufficient data transfer. So, all of that, it talks about it.
2976480	2982920	Now, when we have talked about all of this, how about avoiding all those automated bots?
2982920	2992320	Automated technologies which run on our application and make us part of the breaches.
2992640	3003720	So, automated threat management or automated threats to web application project helps us in understanding what are the automated threats which can be there for an application.
3003720	3008200	And it helps us in fixing all the automation bugs.
3008200	3015020	So, now what we have learned? We have gathered the requirements.
3015120	3021960	We have done the threat modeling. We have done the source code analysis. We have done the software composition analysis.
3021960	3025660	We have also done the vulnerability testing.
3025660	3028800	Now, once we have done all that, we have done the technical training.
3028800	3030960	We have some defensive controls.
3030960	3039900	We have vulnerable applications wherein we can just pick it up and start bombarding it rather than doing it on the actual live web application.
3040280	3045320	So, once we have added that, how about having a knowledge base of things which can help us?
3045320	3051900	So, application security and verification standard, I don't know why, but it's so close to my heart that it fits all the places.
3051980	3054980	Similarly, security knowledge frameworks.
3054980	3062360	If, as a developer, I want to go back and understand, okay, I'm working on a Go code, I'm working on a PHP, or I'm working on R.
3062960	3068960	Is there any place where I can just go and check if I use it in a certain way?
3068960	3071460	What could be the vulnerability on this application?
3071940	3080480	So, security knowledge frameworks is like a standard for multiple vulnerable code snippets and how to fix them.
3080480	3085580	It helps in requirement gathering, it helps in threat modeling, and many other things.
3085700	3091360	And ASVS, or application security verification, complements that beautifully.
3091880	3095920	Then, another important project is Snake and Ladders.
3095920	3100820	Now, what is Snake and Ladders and why are we talking about an application security program?
3100820	3104820	So, Snake and Ladders is an educational application security awareness game.
3104820	3108960	So, this is a board game for understanding the behaviors.
3109180	3111900	Virtuous behavior is ladder.
3112280	3117880	Then, security coding practices are OWASP proactive controls.
3118120	3122880	And devices, or snakes, are application security risk.
3122880	3125200	So, why are we picturizing it?
3125200	3132400	So, this is a board game which generally is being played in Asia, wherein if a snake bites, you will come down.
3132400	3139960	Similarly, if you have an application security risk, your application might be part of a breach or your application might be at risk.
3139960	3141880	So, let's talk about just that.
3142200	3147400	Another educational program or a project is Cornucopia.
3147400	3159080	Because there are some times wherein if we want to make developers, program managers, security testers, understand why we need Agile in a security platform.
3159080	3163600	Why we need Agile or DevOps in an application security program.
3163700	3166380	Cornucopia helps with a card game.
3166380	3172300	Like, we all are working remotely and we might need something to play for.
3172300	3175600	So, this project helps with that.
3175600	3181580	Which is a project, which is a fun game, wherein we can play online.
3181580	3184540	And I have ordered my card, which I have yet to receive.
3184540	3189400	And it's a beautiful bundle of cards, which I am going to play with my developers and make them understand.
3189400	3194620	Okay, these are the challenges that we can address by using these things.
3195880	3198760	So, I have been talking about all of it.
3198760	3201620	But is there one place where I can see all the projects?
3201620	3207860	So, this is the slide that I wanted to showcase.
3207860	3211420	This is the framework, which contains every...
3211420	3217680	So, this is the project, which contains every project that I've just told you.
3217680	3223760	Starting with requirements gathering, till the training and awareness, and how it can help.
3223940	3226840	And all of these slides will be available to you.
3226840	3229860	And you can leverage it at any point of time.
3231220	3236080	But, there comes a point when, how can you contribute to these projects?
3236080	3238420	Because these are all open source, community driven.
3238420	3240780	So, you can contribute to the code.
3240780	3246880	If you feel that there is something, which you can add it to any of the projects, please do.
3246900	3253040	But if you want to help in writing test cases, helping curate the content, please do help.
3253920	3257500	Sometimes, not enough time, wherein we can write the documentation.
3257500	3261920	If you want to help with the documentation, please do help.
3261920	3263800	The project leaders, you can help.
3263900	3271060	And also, if nothing can be possible, how about promoting a project, which is close to your heart?
3271060	3275500	Like, there are so many projects, which are close to my heart, and I keep talking about them.
3275640	3277760	So, you can actually talk about them.
3277840	3280240	You can suggest some features.
3280300	3281820	You can report the bugs.
3281960	3284260	And actually, project leaders work on them.
3284260	3286160	You can just make a pull request.
3286160	3287420	Make suggestions.
3287580	3288920	And they do work on it.
3289560	3291800	Then, how do we move forward?
3291800	3295000	Is there anything else that I can do with OWASP or OWASP projects?
3295000	3297700	If I want to be part of the bigger community.
3297860	3306320	So, OWASP.org is the place where you can go and look for the projects nearby, chapters nearby.
3306400	3307660	And projects are there.
3307660	3308720	All the projects.
3308720	3310160	Even detailed information.
3310160	3311860	I've just touched upon it.
3311900	3314220	You can actually get the detailed view of it.
3314220	3316520	So, OWASP.org is the place to go.
3316520	3320520	Then, you can also join the nearest chapter.
3320880	3322780	Like in Bangalore, I'm in India.
3322780	3323920	Bangalore has a chapter.
3323920	3324940	Delhi has a chapter.
3324940	3326020	Pune has a chapter.
3326020	3327380	Orissa has a chapter.
3327380	3330860	So, I'm sure if you are in any part of the world, OWASP has a chapter.
3331040	3336620	And if there is no chapter right now, if you want to start a community, do go for it.
3336620	3340620	You can raise a request on the OWASP.org page.
3340620	3347980	The team will work on it and provide you with the right information, sources, and help you in getting the chapter created in your area.
3347980	3352100	Even if you are a student and you want to create a chapter in your college.
3352100	3354460	So, there are student chapters which are there.
3354460	3360320	So, you can be a student leader and help in your college in getting started.
3360960	3367760	So, if you feel that you are not part of the community, you can be part of the community.
3367760	3371060	You just have to step up and ask for help.
3371100	3374140	And everyone will be there to help you.
3374140	3381400	And the one thing that I've actually received from the security community is that the peeps are so helpful.
3381640	3382860	So warm.
3382860	3384540	And I've learned a lot.
3384540	3387260	And that's when I'm able to contribute.
3388280	3391860	What you can do is, you can reach me if you have any feedback.
3391860	3394220	If you have any questions around this talk.
3394220	3400640	Or if you want to discuss about something, you can reach me here.
3401380	3404380	So, we are going to take question answers now.
3405740	3407360	Thank you so much.
3407360	3410860	And please feel free to reach me anytime.
3410860	3413580	This is Namaste, which is a form of a greeting.
3413580	3415580	And thank you or a goodbye.