speaker: Kelly Fitzgerald

Interesting points and urls

• Remember that the first three digits of your Social Security Number are based on where you live. Also interesting that you get SSN at birth now and didn’t in the past.
• Spokeo – paid service that shows info about person including what credit card and ad agencies think about you. Thinks speaker is a boy. You can opt out of spokeo everything except name and age.
• Knowing someone’s primary email, helps you see many acccounts – facebook data, etc.
• On Facebook, most people keep unprotected profile pic, other pics, freinds list (ex a friend’s comments). Also watch for backgrounds in photos. Surroundings, books,reflections in glass/computer monitors
• If you buy from someone on e-bay, you can probably find their location
• Your Facebook friends are 70% people looking at your profile and 30% random noise
• bing.com/social will show interesting info
• openbook shows open posts by person
• openstatussearch.com – make sure you have locked down status
• wolfram alpha self-analytics tool
• many people use full name or email in profile. Don’t use twitter/linked in/etc pictures because can connect your online pic to the rest of your internet presence. The search by image services aren’t good yet. [facial recognition seems like this will fail eventually too]
• truedater.com – people will post stories about you. Similarly for don’t date him girl
• People on linked in can pay to see who saw your profile
• Amazon wish lists are public by default
• United has upgrade status public. Only has first letter of first name and three letters of last nme. Could only find it new person already
• Zillow, trulia, spokeo, blockshopper – all have your home’s info. Can’t get zillow off
• Finding criminals can be tough because need to know county arrested in. But can search your and neighboring counties
• Megan’s law offender app – shows where sexual offenders are
• SearchDiggity – free tool to search for PII. Worry about typing in your info is still a valid fear
• Do sensitive things on other taccounts, don’t use Oauth for touchy situtations, track old accounts down and delete them
• Facebook has a blog – you can use it to find out about updates
• Misinformation lets you stay anonymous
• Can see people’s charitable and political donations
• See if your credit card company offers virtual credit card numbers. Can use for online purchases and set short expiration date. Like a one time use number

My take
Great presentation. She took a guy who had a PII leak on a tv show and how much more she could find out about them. Entertaining and informative. It was a little short, but the Q&A were great. She brought cupcakes to bribe people to ask questions. I think we would have anyway as they were thoughtful questions. And it was good to get a break at the end.

Imagine application security is health care
We have a lot of doctors and patients. Think of app security as a public health issue. How do you stamp out SQL Injection as a disease. Can’t scale up patient level tehniques (penetration tests) to wipe out completely. New tools to instrument body to provide continuous real time monitoring. Annual checkups are reactive. That’s discovering a problem way too late and many people don’t even go that often. One day your phone will know you are sick before you do.

Tools are failing us

• Static analysis tools – request.getParameter() and conn.executeStatement() calls aren’t explicit anymore. They are within your framework. Unless the tool knows your framework, it wont fin issues.
• Penetration testing – spending time figuring out how to get tools to intercept traffic, doesn’t go fast enough to work with DevOps and Agile.

Showed the diagram that we climbing the wrong hill. We need “Continuous AppSec”

Definitions

• Portfolio Scale: The right defenses for every application are present, correct and used properly. (you can’t look at thousands of apps manually
• DevOps speed – applicaton security happens continuously and in real time

An example – clickjacking

• Want to design a sensor so that if a vulnerability gets injected, we get notified. Could look at headers.
• Datasource: HTTP, analysis technique: passive, expriment style: positive,environment: test
• Choose based on speed, accuracy, feedback , scalability, ease of use and cost
• Rather than an annual PDF per app, you can get data for the entire porfolio. Store in data warehouse so can get dashboard

Jeff wrote a tool: check your headers. Can check headers for common issues against a public website.

Other uses

• Access control – could have tool generate matrix from code rather than rely on old doc. Help identify missing ones. Ask developers to produce sensors. Can feed into Sonar dashboard. [need standards or per app]
• Known vulnerable libraries – Run DependencyCheck during every build (OWASP tool)
• CSRF – run tests trhough ZAP, use ZEST to check CSRF token, get results via ZAP REST API
• Check correctness of controls – tool don’t even try to validate correct. Write code test first so your tests cover this. Jeff used JUnit.
• Injection – this is a data flow problem – for example, build an IAST sensor
• Security intelligence – can gather any information such as outbound connections

What sensors you need

• most likely to have at least one vulnerability of: identifiaion and authentication, session management. Static analysis companies find XSS because they check for that well
• Figure out what most important to you

Model

• Can’t do security testing without a model
• Testers don’t know model so waste time testing SQL in an app without SQL
• Risk of not testing things that are needed

Nice Venn diagram to show not testing what we care about. Plus spotty even within the areas that do overlap.

Continuous Application Security
Map business concerns, defense strategies, actual defenses and sensors. Should start with business concerns not sensors. That say a new threat/business priority becomes a sensor and you get data back on it in the dashboard. Real time data, iteration.

Get started by building a sensor and creating a dashboard with Excel. Then can switch to point where can show covers business concerns and can add more based on business.

Business case to do: build sensor ones,get benefits forever. Now, a pen tester IS the sensor and is a very expensive one.

Detecting attack is not the same as detecting vulnerabilities.

Most of the industry is looking at compliance. Want to get to monitoring. Thn can have a strategy and optimization. [Like the levels used by CMM and many other processes.]

We can never improve if our only metric i whether we are doing what everyone else is doing. This wouldn’t work to stamp out a disease and shouldn’t b our approach.

My take
I always like seeing Jeff Williams speak. He is a great speaker and usually presents a unique spin on an idea orr a new idea. I liked the heallth care hook here.

speaker: Milton Smith

Open Ecosystem

• JP (java community process
• OpenJDK contirbutors including IBM and Apple

Security communications

• RSS feed for security alert
• (CPU) Critical Patch Update Advisories – for “normal” patches. Dates published a year in advance
• eBlasts – emails
• Blogs – Java PM blog

CVSS – common vulnerability scoring system

Added security track to JavaOne

Working on a platform is not the same as working an application. Current analysis tools don’t understand new syntax yet. Use tools where apply though.

Oracle considers Java to be strategic. Safety and security of Java is a top priority. Delayed Java 8 becuase security wasn’t ready.

Oracle is focusing on fixing applets (to limit attackers from using malicious applets), accelerating remediation and new security features.

Most vulnerabilities were in deployment and 2D because of applets. Interesting because don’t affect most people. And because applts are old.

Recent security features

• Easy way to disable Java on different platforms (Java 7 update 1)
• Java “best before” – Java should encourage updates. Baked date into binaries for knowing it is out of date once new CPU out (Java 7 update 10)
• End user can adjust plugin security levels via slide (Java 7 update 10). Removed low and custom levels in update 21
• Dynamic blacklisting support. Vendors call to say they learned released jars are vunlerable (java 7 update 21)
• Signing sandboxed applications (java 7 update 21)
• Enble stanadrdized revocation services – deal with stolen digital certs, now on by default (java 7 update 25)
• Provide ability to lock JARs to specific servers or domains (java 7 update 25)
• Turn off JRE out of date warnings – companies want to manage on own (java 7 update 40)
• Add whitelisting for enterprise and partners – prevents 3rd party ads and spearfishing from exploiting (java 7 update 40)
• Working on Java uninstaller to improve so adversaries can’t target older versions of Java as easily

Future

• With the January Java 7 update 51 release, self/un-signed applets will be blocked by default. All applets written before update 25 won’t run by default. Can lower seurity to Medium to change defaults. Can still create a CA within a company

Oracle’s Secure Coding Guidelines

My take
I’m not sure what I was expecting, but this felt light and fuzzy. Or maybe I knew a lot of this. Or maybe I’m tired because there wasn’t a break and I didn’t choose to miss a session in order to take one. The charts were interesting. As were the new features.