start	end	text
2480	9560	Hello, everyone. So, please take a seat, grab a coffee, close the door. Do you hear me?
9980	16340	No, I'm sorry. It's a pre-recorded session. So, I can't hear you at the moment. As you
16340	22180	are listening, just record I'll be on holiday in the south of France in my swimming costume.
22720	28760	So, give me a question in the chat room. I'll be pleased to answer you at the same time.
29300	34760	So, hello, everybody. I'm Nicolas. Just a few words to present myself. I'm an independent
34760	43000	tester, security editor. I work for a decade in this cyber security industry.
43320	51720	Now, I've built my own company and I work in the red team of a financial institution in France.
51720	58540	So, as you see and heard, I'm French. So, sorry for my French. Thank you.
59460	69080	We'll talk about automating security operations. What does it mean to you and to me today?
69080	75920	Everyone has his own definition. For me, security operations could be related to
76200	81920	a bunch of activities. For now, please consider at least these activities. I will talk about
81920	90760	penetration testing, security control assessment, CTI, and DFI operations,
90760	97900	security compliance, and all about code review and web application testing.
98260	103640	We will see why and how to add automation within this activity.
104600	113300	And we'll talk about Patrol. Patrol is an open source framework for automating and orchestrating
113300	121240	tasks and security operations. It provides a solution to get a continuous and full stack
121240	130240	overview of your cyber exposure. The solution, sorry, lets you to define your assets,
130240	138340	policy, and the scan you want to perform. The scans give you findings. And all these findings
138340	146880	are then collected, analyzed, and aggregated within a unique database. We developed several
146880	154280	engines and connectors to existing security tools to assess risk on various security domains.
154280	162660	The idea is to get a risk overview from IP to data level. The scans could be start one shot,
162660	169280	scheduled on, started on the regular basis. And the final goal is to get a continuous monitoring
169280	176920	of our assets and our security posture on all stacks. All the findings, the findings could be
177100	183500	a confirmed vulnerability, a suspicious change in our systems, or a suspicious activity over
183500	191800	internet. These findings are then contextualized and tracked over the scans. And that's all for
191800	203880	me. Now, of course, it's not a tool presentation. I just want to tell you about security operation
203880	213660	and about automating SecOps. As I told you before, I work in a sys service since five years.
213660	220800	And from my windows, there are two major factors that lead current evolution of the IT landscape.
220800	228540	These are acceleration and diversification. This applies to assets, threats, and, by the way,
228540	237440	security incidents involved. We see an acceleration of digital program and diversification of assets.
237880	246340	So, thanks to the digital transformation program, we see an explosion of IT project. The information
246340	252420	systems are more and more open to the world, and then more and more open to hostilities.
252920	260400	We have to deal with new technologies every day. New product, new framework, new library,
260400	268380	and all these technologies are updated every day. We also see changes in the software delivery
268380	276900	processes. Remember a few years ago, when it was about four to five months of production per year.
276900	286140	Today, thanks to the hype of DevOps activities, we can see multiple go live in a day.
286740	293780	And a go live means a new application, and, by the way, new vulnerabilities or
295360	304200	new exposed things. The threats are growing too. The number of CVEs is growing year after year.
304200	310820	It's a metric. I don't know if it's a good metric to talk about the number of CVEs, but
311480	318700	it could be representative. But the attackers, they do a great job.
319040	323300	There are more and more, and they are more and more organized and efficient.
324080	330600	From a different point of view, we have to cover a quickly changing IT landscape,
330600	336200	and at the end of the day, it's increasingly hard to get a realistic, comprehensive,
336620	342020	and sufficiently updated vision of our cyber risk exposition.
342740	350860	We also have to face another problem. It's the talent shortage problem. We have not enough
350860	358320	people to do the job at the moment. Lots of tasks are repetitive, and this leads people to
358320	366420	lose their motivation and leave the team. We definitely believe it's time to adapt our cyber
366420	376420	defense and we have to adapt the way we do our job and we monitor our cyber security posture.
378770	387970	To face these challenges in the team, we try to manage security incidents with two goals.
387970	395530	The first one is for the red team. It's about identifying vulnerabilities on our assets
395530	402630	before attacker two. And for the blue team, it's to identify indicators of compromissions,
402630	413070	which could be past, current, or future of a potential security incidents. And to do this,
413070	420990	we have to keep us updated from many, many things. The first one is to keep us updated from the
420990	428210	continuous transformation of our assets. It could be more or less considered as shadow IT in big
428210	435190	companies. We have to keep us updated from the infosec knowledge database, the new research
435190	443130	publications, the talks talking about the new vulnerability or new way to detect certain things
443990	451230	or to exploit the vulnerability. And all the security news and the spectrum of threat scenario
451230	458310	is changing also every day. We have to manage lots of feeds of information every day.
459230	466330	And finally, we found that scanning our assets is not efficient anymore. We have to monitor
466330	474670	external resources to detect leaks, attack signals, and to understand how third parties see
474670	483190	our security posture. And for day-to-day work, it could be very hard to manage all of this
483830	493950	information. And the cyber security industry, it's a race against the clock.
494830	499730	And the third aspect we have to tackle is the window of exposure problem. It's all about
499730	507130	our reactivity. Today, we know that attackers will attack us, not just because we have a bank,
507130	515650	we are a gas industry, we are talking plenty. No, it's just because we are on the internet and
515650	522010	new vulnerabilities are found everywhere. It's just increasing the likelihood of attack scenarios.
522010	528470	So the windows of exposure is a real problem and could be handled with priority. We said
528470	534380	that we have to detect and fix the vulnerability and suspicious activities as soon as possible.
537030	545190	So facing the challenges, we think about automation and orchestration.
545470	553170	Just a quick reminder, my definitions of automation, it's setting a single task to run.
553170	560190	And orchestration, it's about automating a lot of things at once. It's about coordination and
560190	570460	management of automated tasks. Before we go, let's start our experience. A few months ago,
570460	576320	I set up a Kubernetes cluster with default configuration exposed to the internet. It
576320	586200	was unfiltered. Maybe you see what will be the next thing. Only 24 hours after, I was hacked.
586200	595820	CryptoMiner was deployed on my cluster and my server starts to mine some cryptocurrencies.
599220	606240	Forensic definitely thinks I was not targeted because I was near Nicolas.
606680	615060	Just because probably a scanner identified that a non-secure service was exposed on the public IP
615060	621820	and the attacker automatically deployed his payload on my server. So I don't blame him.
621820	628040	I don't blame him. He's doing his job. He's doing a great job for this point of view.
628660	634960	The fact we have to remember today, it's not that I'm a cheap DevOps, no. We have to accept
634960	639880	that attackers do automation and better than us in their field.
641060	648220	So why automating SecOps? The first thing is, for a defensive point of view, is to do more checks,
648220	655360	to cover a larger and diversified scope, to cover a bigger perimeter of assets and make more control
655360	663340	on each stack. And the second thing is to do it more often. It could be
664420	670440	continuous checks. It could be very useful to reduce the windows of exposure,
670440	676780	to reduce the delay in discovering and fixing a security incident.
678880	686960	The third thing I would like to say, it's about efficiency. As I told you before,
686960	690640	we have to face a big problem, a time-shortened problem.
691660	700680	The idea is to reduce the time affected to low-value-adding tasks, to focus on more complex
700680	713080	security cases. And for doing this, we have to automate the simple task. It's also a way to
713080	721540	reduce and manage costs and to start for low KPIs. It could be also very useful to
722680	730240	help you in your compliance and benchmark activities, to define and expedite the same
730240	741160	control on a subset of assets and do it continuously to see the trends and how far
742040	745380	you are compliant with your security standards.
747160	754860	So, at this time of this presentation, you should be all convinced of automation.
755820	763660	So, there are several downsides we have to discuss. Of course, there are limits. It doesn't
763660	774020	cover all of the risks in itself. If you automate your control, you will have an increasing number
774020	786360	of alerts to manage, an increasing number of false positives. We found also that it's very useless,
786360	793040	inefficient to found functional vulnerabilities. We also have to qualify and contextualize all
793040	803680	the findings we have, we have found. And about the TCO, yes, automating, we don't automate things
803680	811280	by magic. We use tools that orchestrate all the tools. So, we have also to manage and exploit
811280	821980	the tools. At the end of the day, a tool is a tool. And it's very useless without a cyber
821980	827400	defense strategy. So, if you don't have a strategy, don't try to automate things.
830360	837540	By the way, we decided to build a platform for automating and orchestrating the SecOps.
837680	843680	Because we wanted to improve our level of manageriality and to become more efficient to
843680	855990	adapt our work. The core concept is to efficiently moving from reactive to predictive, more or less
855990	864070	predictive security posture with the benefits from the power of automation.
864910	872430	And also, we decided to use... to don't develop our tools, but to use in priority the best of
872430	879710	built tools. The great tools exist, but they're not addressing all the stacks at the same level.
880270	887250	Issues of quality are very efficient to scan for vulnerabilities, for misconfiguration
887250	896690	on infrastructure and your cloud services. But the web application scanners and the
896690	901800	container security assessment and the anti-malware modules are not sufficient enough.
901800	915980	We found that we can have only one tool to cover all the security control we have to assess.
920300	927960	We found that we have to support scan policy, which are realistic from an attacker point of
927960	936020	view. And the idea was to take the benefit from the best part of
936020	942600	several security tools, making it easier to define a scan policy and to plan it.
944660	951020	And PathWall... I will talk about PathWall a little bit. PathWall is composed in two
951020	955440	independent types of applications. The first one on the left is the manager,
955440	962640	the front-end application, where you have your dashboard, you manage your assets,
962640	968820	you define your scans, you have your findings, and you try to manage the engines,
968820	975340	which are the micro-applications that perform the scan. All these applications are open source
975340	986430	and developed with Python. All features are reachable through the web UI or the REST API.
989100	996500	The PathWall engines are the probes. They are the micro-applications that perform the scans,
996500	1002360	parse, analyze, and format the findings into a unique and pivoting format.
1003160	1013260	This could be deployed on several separate servers. We can scale it that way.
1014920	1022440	For example, you can deploy probes on your internet, on your internal network,
1022440	1030840	and probes on your administration or DMZ, which are your restricted networks.
1031700	1038040	And it could be the binding of your endpoint. And these PathWall engines are...
1040800	1050160	Sorry. They scan the assets. For example, we developed an engine for Nmap.
1050240	1058480	We don't really develop Nmap, but we made a connector to Nmap. And that way, we can perform
1058480	1069260	on the same assets security scans for using Nexus, Nmap, OpenVAS, Qualys,
1069260	1079360	and other security tools from the same cockpit. And all the findings have the same look.
1079360	1086040	And we can compare and track all the findings on these assets issued by the
1087000	1097980	separate engines we use. A bit deeper. PathManager, as I told, it's the front-end application.
1098800	1106360	Here, you define your assets and a group of assets. You can also define the scans policy.
1106360	1110460	You can schedule scans and manage the scan regime.
1112340	1116400	PathWall engines, it's the second component.
1117640	1123960	The PathWall engines are the connectors with the scanner which could scan the
1124660	1129120	assets, which could be on the internet or your internal network.
1131400	1140420	The PathWall engines could be also linked to an external scanning service.
1141420	1150500	Or a link to your CTI repeater. You can also create the tickets or
1151920	1161320	inject alerts or raise alerts to your DFI system. You can also inject the data in your sim
1161320	1170440	or on your ELK if you want to analyze or to make alerts on a different way.
1174380	1184420	As today, we developed a large range of engines in various domains. For each engine, we create
1184900	1193060	a Docker image including the tool needed and the REST API to deal with them. So, you don't have
1193060	1199680	to install tools, dependencies, or manage the system requirements. It's just as simple as a
1199680	1217640	Docker pool. It's true, except from several engines, like NMAP with the Docker image,
1217640	1225100	do not embed the scanner. But it could be linked to your instance.
1225100	1237680	So, on this slide, we see a lot of engines, a lot of various domains. The idea of PathWall,
1239920	1250220	it's a framework. You can build your tool to the detection of the control you have to perform.
1250220	1260620	I don't see many companies that use PathWall with all of these engines. It's more or less
1260620	1274860	separated between the vulnerability assessment or the data lakes or the static code analysis
1274860	1285040	or dynamic code analysis. We also have a lot of ideas for the nature engines regarding
1285040	1301320	gravity management, CTI, web application scanners, and so on. So, the engines are also open source
1301320	1310660	and we accept any contribution to create or to give us ideas to develop any engine.
1311400	1331200	Maybe it's time to talk about use cases. The first one is... I come from the right team. I
1332080	1344280	always do the same. The first step of the test is to perform the recon activities. So, we
1344920	1354580	search for subdomains. We always have IP. We try to discover the port, the open port. We
1354580	1363620	fingerprint these services. We search for vulnerabilities and so on. For this, we use
1363620	1375220	several tools with the same, more or less, the same settings on your assets. So, with PathWall,
1375220	1386420	we use PathWall in our security assessment to do this as quick as possible and to do this
1386420	1398480	continuously. The second use case is to examine the source code and the running web applications
1398480	1405820	for security defects. It's to be involved in the CI-CD pipeline.
1406660	1414640	So, on each commit, we take on the code repository. We are able to clone the project
1414640	1420900	and start a static code analysis using the one-day dependency checks or the
1421340	1433140	for the GS dependencies. And the code is built in and so on. And once the web application is
1433140	1438600	deployed on the staging environment or on the predictions, we can also orchestrate
1438600	1445520	autonomous scan using Arachne, ZAP, and NIC2.
1448920	1455300	PathWall is available through the REST API, and we also developed PathWall for PyClient,
1455300	1461840	which is a Python library. So, it's very easy to integrate with all those security tools.
1464310	1472170	The third one is about efficient preparation scenario. We use it to search for early signs
1472170	1481770	of malicious domains and the websites present. The idea is to search for suspicious domains
1481770	1490630	or type of cross-query domain. And once we identify them, we can monitor them to look
1490630	1500930	for changes. Are they still parked? Are they should certificate? What is the web application
1501750	1510910	look like? Are they new exposed services? And so on. And if we have any suspicious change on the
1511750	1517490	attacker's assets, we express an alert and we manage them.
1519430	1526470	The third use case is code leaks on GitHub. Many, many, many times,
1528490	1538430	DevOps or IT people are leaking something on GitHub because, I don't know, it's easy,
1538430	1547800	we don't really know how to use it. And we don't really know that it's a public repo. It's public.
1547990	1557970	So, we want to search for leaked internal resources code. API keys, password. And we
1557970	1571970	developed just a simple scrapper on GitHub to monitor our keywords and our patterns
1572850	1583190	to just detect that we don't have leaked any security system script or API keys
1590870	1600270	We will talk about use cases, but we found that when we automate all these security tools,
1600270	1611710	we can address a lot of use cases. So I want to talk about it.
1613820	1626820	Just step back a bit. If you orchestrate the security tools, you will perform more control
1626820	1636120	and do it more often. It will result in more findings. And it will result to more alerts.
1636120	1646300	And the security dashboard will look like a Christmas tree. That's very, very, very soon.
1647900	1659560	So, well, all these events are relevant, but we have to prioritize these things.
1659560	1669700	And it's the key challenge today, because we have the capacity to detect things,
1669700	1677080	to find out the false positives. We have the technology and the experience,
1677080	1683840	but we don't have the time to manage every, every alert. So we have to prioritize.
1685320	1693340	And if you permit, I will share my morning routine with the CSF team I work in.
1693380	1703960	When a new variability is discovered every, every morning, we talk about this and we share questions.
1705440	1712460	The first thing is when a new variability is discovered, we talk about the CVSS best score.
1712460	1718660	We talk about if we are vulnerable or not. Are we exposed on the internet with this
1718660	1725400	vulnerability? This vulnerability has been identified on a critical asset.
1726140	1734140	Are we aware of any functional exploit with this vulnerability? Is there any patch or
1734140	1742920	compensation measure available? Are there any likelihood catalysts? Is this
1742920	1749920	vulnerability exploited in the world? What is the media hype level? Has the
1749920	1757200	vulnerability been exploited with relevant threat actors? And we ask for the CTI team.
1757200	1768380	We also have the question, are we already found? And the team is in charge to investigate and
1768380	1779900	research us if we can. And the next question is, are we really able to detect exploitation of this
1779900	1789440	vulnerability? And at the end of the day, at the end of my morning, sorry, the managers say,
1789440	1797600	okay, we have enough data to initiate a crisis and to treat this in priority.
1799820	1814580	It's definitely a teamwork. It's not just become within the CTI team. It's really a teamwork.
1814640	1818200	All the IT and business service lines are involved.
1819680	1826160	The second thing is that vulnerability metadata are not static. They are continuously evolving
1826160	1834300	over the time. Everything changes when a new patch is available, when a new exploit is placed,
1834300	1846420	and when a new security resource is available. One event could change the way to manage a security
1846420	1857500	incident. And as you remember, we start using the CVSS BASC score. And we want to know today
1857500	1863620	if the CVSS BASC score is sufficient enough to be a primary factor of discrimination.
1864900	1873420	Just a quick reminder of the CVSS scoring. CVSS scoring, there are three vectors. The BASC score,
1873420	1881780	which represents the internal characteristics of the vulnerability. We also have a temporal
1881780	1888080	vector, which represents the characteristics of the vulnerabilities that change over time.
1888520	1893080	And we have another component about the environmental, which represents the
1893080	1901220	characteristics of the vulnerability within the client context. CVSS is the norm, is the standard
1902820	1915600	adopted. But the CVSS BASC score is usually provided, but the temporal and the environmental
1915600	1927180	scores are on our behalf. We have clues. We have information from many parts, which are not
1931500	1944450	always on the same page. It's just a score, a BASC score. For example, we have FunFact,
1944450	1958310	which was scored at 5, and Spectre was scored at minus 5. So we just have the CVSS BASC score
1958310	1974430	and the primary discriminator. We hope to see if it's sufficient enough to do our job.
1975090	1986690	So just go deeper with it. We found that we have to manage multiple criteria for prioritization.
1986690	1994630	And we have to manage the CVSS BASC score about the batch availability, the age of the vulnerability.
1995070	2002470	We have to manage the discovery ease and the detection ease. All of this data are available
2002470	2013130	from various sites or feeds of information. But all of these are publicly and in quite good
2013130	2021940	quality. For the criteria of prioritization, it's all about the threats, about the temporal metrics.
2023650	2030080	It's about the exploit availability, exploit maturity, and the ease of exploitation.
2030620	2043380	Also, the threat intensity is very useful to know because it's a sign of the maturity and
2044300	2059120	the likelihood of occurrence of the risk. With the MITRE ATT&CK and the CTI feeds
2059120	2067060	information, it could be useful to know about the threat relevancy. Sorry,
2067060	2076180	it's very hard to say that in French, remember. And it's excluded by monitors, protectors, or not.
2077460	2085040	And the third pillar, it's about the assets in itself, the renewable assets.
2085040	2093160	Is the asset critical or not? What is the exposure of the asset? Are we
2093160	2101480	vulnerable from an asset exposed from the internet or a restricted network? And what
2101480	2112240	about the distribution of the vulnerability? If we have a vulnerability with a high CVSS
2112960	2130000	without a functional exploit on the restricted network, it's not the real priority. But
2130460	2141720	a vulnerability with a standard middle CVSS, but exposed on the internet with an exploit available
2142240	2150220	and a large distribution, it's the top one priority. So we take all these criteria for
2150220	2160380	pre-stabilization and we have to make decisions to check if we have to manage this as quick as
2160380	2168960	possible or not. The first thing is, okay, it's very useful. We have to ask for immediate
2169760	2177700	correction and we start a crisis... we open the crisis room.
2178260	2184600	The second is, okay, it's urgent. We ask for an immediate correction and we
2186060	2195840	assess that the correction is efficient. The third action is, okay, it's a vulnerability.
2195840	2203860	We know about this. Apply the fix in the next patching campaign, but no more.
2204280	2218680	Finally, if the vulnerability matches no top criteria, okay, apply a fix if possible,
2218680	2224500	but we don't have any intention of this. We have to choose our battle.
2225840	2242460	The top of vulnerability, we don't manage this. For that, we are working on the new tool,
2242460	2254800	which is a battle here. The open sourcing of the... this application is currently in discussion. I
2254800	2263460	hope it will be the case. The idea of the battle here is to manage all these metrics.
2265220	2273220	And we use... we massively use the CVE search and the app of CVE tools, which are
2273220	2284280	open source tools released by the circle. The idea is to grab some... to collect and clean data,
2284280	2291000	like CVE, CPE, cross-references, to create and update vulnerability metadata
2291630	2300880	from this... from the NVD, the exploit DB, packet store, meta-exploit, Talos,
2300880	2308420	the enable DB, and so on. And to compute a vulnerability prioritization rating using
2309290	2318380	the vulnerability metadata. And the asset criticality and exposure. And this sector
2319030	2326220	are known by platform manager. Because in platform manager, we know that
2326950	2334680	we found a vulnerability on an asset exposed on the internet, on the internet network. And
2334680	2344500	we know about the distribution too. And the idea is to provide platform manager a rating
2344500	2356620	from the vulnerability found using any scanner as well. We can also use the battle here to track
2356620	2364240	changing on the changes, sorry, on vulnerability like CVSS, exploit known, and so on. And to
2364780	2373720	perform alerting, like if we found that... if we found a vulnerability on the monitored product or
2374590	2383740	product versions, okay, we send automatically an email, we send an event, we send a slack,
2383740	2394600	we open a Jira ticket, and so on. And finally, the idea is also to share feeds with using
2394600	2407220	platform and CTI. So we will talk about this one later. I reached the end of the presentation.
2407780	2417220	So if we can just have a step back and talk about all automating, let's say your seconds,
2417220	2428060	it's quite possible. The idea is to have a cost effective activities. We start to rational the
2428060	2436020	tool integration, the product licenses, and all the things needed to deploy and use
2436750	2447600	the various security scanners, we have to. The second one is to provide turnkey solutions.
2447600	2453520	Every component is available. So document images is very easy to use and they're deployed. We
2453520	2461120	provide templates for scan policy and so on. The third one is a patrol and all of the
2461120	2468800	tool galaxy is open source and easily customizable to your specific needs. And we
2470180	2476920	have documentation, we also have to improve the documentation, but everything is available.
2479740	2487900	And globally, it's a full stack and continuous assessment. The idea is to have a 360 degree
2487900	2497140	overview on your assets to perform a real time assessment with relevant data to keep you updated
2497740	2506640	from every source where we can. Finally, it's made with love by Express.
2508340	2518940	We and all the community, the patrol community is composed by security.
2522440	2529040	And finally, if we can summarize with two things, for big companies,
2529660	2535440	it's quite an opportunity to aggregate findings from different existing tools you already have
2535440	2541500	in place. And for newcomers and small organizations, you can bring new
2542400	2550140	capacities to quickly improve your security. So what next?
2550880	2561240	We have a roadmap, of course. We are working hard to improve our integration with
2562160	2568520	all the tools, especially two tools, DeHype, which is a security incident response,
2568520	2576380	and Umbroader, which is an IT automation and security compliance tool. All of them are
2576380	2582360	open source projects, very, very mature projects.
2582440	2587940	And we definitely want to have more integration with this.
2588420	2602500	We also try to improve the Python client API. We are currently redesigning the front end
2603280	2611560	of the platform manager. We are also testing endlessly new use cases in debugging, improving
2611560	2618540	quality and security, global security of the platform. And we also are building an enterprise
2618540	2629720	solution. But it's an open source project, and it will be always the case.
2629720	2637520	Contribution is really, really needed. So if you have the ability to test it and give us
2637520	2648400	feedback, it would be very, very great for us. And if you want to contribute or just to push
2648400	2664730	new issues, we will be very happy to have this. So we are at the end of the presentation.
2665480	2674590	So if you have any questions, please do it in the chat room. And finally,
2675120	2683520	I know it's a lot late to say that, but I really want to thank the DEF CON organization.
2684160	2693830	Thank you for accepting my talk. And thank you for you guys and girls to have attended this
2693830	2700910	session. Thank you. Thank you very much. And go for questions. Thank you.