Application Security Foundations Level 1

• Running code
• Written code
• 3rd party code

• Have a security team, get the appsec team to review the applications and 2 weeks of developers to fix those vulnerabilities.

• Involve AppSec team members with a development team in their activities for a week or two

• Scan 25 apps over 6 months
• Compile the results
• Access your top 3 vulnerabilities
• Provide a lesson/training on these top 3 vulnerabilities
• Work with teams to eliminate critical vulnerabilities in the next 3 months
• Eliminate all the high vulnerabilities next

• Beware of false positives
• Start with critical, discuss with the teams. Then move to High

• Secure coding guidelines
• Web app security requirements
• Secure Design discussions
• Create a best practices documentation

• Possible supportive activities: * start a lunch and learn program and have one event per month, for at least 3 months.

• Possible supportive activities:
• have a deep dive lunch and learn about xss
• send emails with info
• add a test to every pipeline
• reate unit tests using the XSS Filter Evasion Cheat Sheet from OWASP

• Educate Developers about SBOM and have them create SBOMs for their applications, use a SCA tool which creates SBOMs and also does SCA

• Vulnerability (VA) Scans and Assessments
• Gathering Metrics/ Measurement
• Developer Education and Advocacy Programs
• Security Reference Materials (including hardening guides)
• Targeting an Entire Bug Classes
• Security Regression Testing (with unit tests)

• Secure Code Reviews (Static Application Security Testing)
• Secure Coding Library/ Templates
• Targeting an Entire Bug Classes
• Forcing secure coding with IDE tooling
• Giving Developers Security Tools

• Software Composition Analysis (SCA)
• Gathering Metrics/ Measurement
• Forcing use of secure packages with proxying to secure package management tools

• Strategy is the overall campaign plan (Goals)
• Tactics actual means to gain an objective ( AppSec activities)

• Mitigate
• Reduce
• Accept
• Document

• What could go wrong?
• What keeps you up at night?
• How would you hack your app?

• Use secure coding guidelines
• Peer reviews

• Libraries
• Packages
• Frameworks
• Plugins

• Educate them about security
• Policies to be followed
• Laws to be followed
• Secure Design & Architecture
• Threat modelling
• Don’t assume they know

• Coordinated Disclosure
• CVE assignment

• Started by Microsoft
• Run only if you have a good appsec program
• Beg bounties
• Be professional
• Think about Triage
• Fix as much as you can first

• This is how i would like you to do it

• Enforce

• High level enforcement

• This will them to take the ownership

• Examples 1:
  • After incident
  • Incident report
  • Post mortem report
  • Use Data
  • Tanya Janca - Security Metrics That Matter

• Clone their repo/pipeline
• Add security
• Needs to Fast and Accurate

• 2-3-4 weeks focused on accomplishing some tasks

• Prioritise

• Sometimes there just isn’t a tool on the market that does what you need; this is when you must create your own

• Defect Dojo
• Repo Kid

Practicing for big events make sense, so why not practice emergencies?

• Missing patches
• Poor configurations

• Coreruleset

• Fail gracefully for vulnerabilities like XSS

• No interruptions
• Reviewed by Security person or champion

1. What are you going to accomplish? Be extremely specific?
2. Which application(s), systems or networks? Name them?
3. When will you aim to achieve this goal? Are there steps you can list or a timeline you can provide?
4. Why did you select this goal? What value will it bring to your org?
5. Are you being realistic? Is the cost of this goal going to provide significantly more value to your org? Management will really want to know the answer to this, be ready.
6. What AppSec activities will help you achieve this goal?
7. What Tools will you use to help you achieve this goal?