Security Journey's hi/5

1. Kube-goat: A deliberately vulnerable Kubernetes cluster https://reconshell.com/kube-goat-a-deliberately-vulnerable-kubernetes-cluster/

To truly learn how to protect Kubernetes clusters, it’s helpful to exploit known bad security settings.

2. Microsoft says mandatory password changing is “ancient and obsolete” https://arstechnica.com/information-technology/2019/06/microsoft-says-mandatory-password-changing-is-ancient-and-obsolete/

Embrace password managers for your Enterprise and remove the motivation for creating short passwords.

3. How Performance Became the Nemesis of the Secure Python Code https://www.securityjourney.com/post/how-performance-became-the-nemesis-of-the-secure-python-code

With Python, simpler and readable code contains fewer bugs and vulnerabilities. Great advice for every language!

4. Secure your code review: 8 key questions to ask https://techbeacon.com/security/secure-your-code-review-8-key-questions-ask

Train your developers' eyes for security – security code review is crucial.

5. The Need for Continuous and Dynamic Threat Modeling https://blogs.cisco.com/security/the-need-for-continuous-and-dynamic-threat-modeling

Security is a journey that requires influencing and enabling teams to adopt and employ best practices and controls for their architectures.

1. Uncomplicate Security for developers using Reference Architectures
Reference architectures assist developers in building secure applications and limit rework as a result of later security reviews.

2. “Huge upsurge” in DDoS attacks during pandemic
Acknowledge that a DDoS attack is coming your way, and architect your system in a scalable manner to ensure that you can absorb a DDoS attack of any size.

3. Codecov discloses 2.5-month-long supply chain attack
Attackers are targeting the supply chain to magnify distribution of the attack. Assess all your systems with the assumption that attackers are coming for your supply chain.

4. Grype – Vulnerability Scanner For Container Images & Filesystems
All DevOps build pipelines must include one to many vulnerability scanners. If you use containers, you must scan your containers!

5. Security Coaches
Security coaching changes your application or software security program and adds value on top of a security champions program.

1. Threat matrix for Kubernetes

The application of the ATT&CK methodology to Kubernetes is the subject matter that everyone using Kubernetes should know.

2. 5 Objectives for Establishing an API-First Security Strategy

The five objectives are a good reminder that when using API (and we all are), think security first.

3. Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams

Threat model all the things!

4. Deep dive in CORS: History, how it works, and best practices

Put in the work to enable CORS for your web applications.

5. NSA: Top 5 vulnerabilities actively abused by Russian govt hackers  

Application security is more than just the application. We must build a strong foundation across all the other layers of our system.

1. The Current State of DevSecOps Metrics

Measure what matters, and what gets measured gets attention. Apply this guidance to your DevOps program to measure the value of security.

2. 5 ways to prevent code injection in JavaScript and Node.js

JavaScript is susceptible to code injection via several different code constructs. Stop using these, please. Code securely!​

3. Do app sec like a boss: The top 25 pros to follow

Twitter is where security congregates to argue and share. Join the discussion.​

4. Why Vulnerability List Methodologies Matter (And why we trust CWE & OWASP)

Use all applicable lists as a guide but base your priority on your vulnerability and threat data.​

5. Securing Your PostgreSQL Database​

Secure those databases as a proactive defense in depth measure. Attackers enjoy the weakest link.​

1. PHP's Git server hacked to add backdoors to PHP source code​
Supply chain attacks are bigger than vulns in open source; when the attack is deliberate, the stakes are higher.

2. Redefining Threat Modeling: Security team goes on vacation
We can all agree that threat modeling is non-negotiable; use Segment’s model as a reference for how to do threat modeling using a self-service approach.​

3. Software Security at Rocketship Pace
SAST is table stakes, but your SAST solution must eliminate the frustrations that many developers feel with loud tools that provide limited value.

4. SSRF Attack Examples and Mitigations​
Let’s get ahead of the OWASP Top Ten 2021 edition and start dealing with SSRF now!​

5. Deprecating TLS 1.0 and TLS 1.1
Goodbye, old friends! We don’t and won’t miss you at all, TLS 1.0 and 1.1.​

1. Post-Spectre Web Development

The web is changing, and we must adapt our threat model and our mitigations across the board to prepare for future attacks.
​
2. The security scanner that cried wolf​

Keep your eyes focused on the results of your container scanners and use additional tools besides trivy to scan for vulnerabilities in your workloads.

3. Understanding Private Keys​

While we don’t recommend that you dig into the depths of crypto, a software engineer should understand how crypto works at a high-level.

4. ShellCheck - A shell script static analysis tool

Use static analysis tools against all the things, shell scripts included!​

5. Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline​

DevOps is here to stay – let’s embrace DevOps + security is standard operating procedure.

1. Stop forcing security and engineering to collaborate! 
   • Security and engineering must collaborate in a seamless approach to protecting customer data. We’ve tried silos for the past twenty years, and that hasn’t worked. Let’s try collaboration for five and see who wins.​
2. The top open-source tools to secure your app sec pipeline
   • Open-source provides a solid set of application security tools. We’ve only used a handful of these, and we’ll be diving in right alongside you!​
3. Leveraging your Role as Technical Product/Project Manager to Improve Application Security 
   •  A strong security culture extends beyond the developers and encompasses the product adjacent. Work with your product/project managers to instill security principles and best practices, something as simple as the key questions for them to ask about security.​
4. Docker Security Cheat Sheet
   • An OWASP Cheat Sheet is an invaluable nugget of application security goodness. This one covers Docker, but there are around seventy others.​
5. New Old Bugs in the Linux Kernel 
   • Flaws may lie dormant for decades before manifesting as vulnerabilities. For those that think their code will be retired before them, think again.

1. Can a Programming Language Reduce Vulnerabilities?​

A programming language can reduce vulnerabilities, and the future of application security must walk in lock step with improving the languages and frameworks to eliminate classes of vulns.​

2. “Zero Data App – Own your data, all of it.” Is this an app we can download and use now?

To move personal privacy forward, we need app options that let us keep our data in a secure enclave instead of in a cloud service.​

3. Someone Is Hacking the Hackers

Attackers use their techniques against themselves from time to time.​

4. Fuzzing Java in OSS-Fuzz

Fuzzing is an underutilized technique for finding vulns, and we need to lean into it more.

5. 8+ open-source Kubernetes vulnerability scanners to consider​

K8s is a modern staple of application delivery, and it can also be a source of security vulnerability due to cluster or pod misconfiguration.​

1. Top 10 web hacking techniques of 2020
( https://portswigger.net/research/top-10-web-hacking-techniques-of-2020 )

While the OWASP Top 10 is more high level, this list gives you the down and dirty for how attackers are using the web to break applications.​

2. What your DevOps team needs to know: 4 lessons from exploited vulnerabilities
( https://techbeacon.com/security/what-your-devops-team-needs-know-4-lessons-exploited-vulnerabilities )

Learn from security past to prevent vulnerabilities in security future.​

3. Security Chaos Engineering: How to Security Differently​
( https://www.verica.io/blog/security-chaos-engineering-how-to-security-differently/ )

Security chaos engineering is a discipline that can have a large impact on improving your security posture and culture.​

4. Introducing sigstore: Easy Code Signing & Verification for Supply Chain Integrity
( https://security.googleblog.com/2021/03/introducing-sigstore-easy-code-signing.html )

Code signing reduces or even eliminates many classes of software supply chain vulns.​

5. Nuclei: Fast and customizable vulnerability scanner based on simple YAML based DSL
( https://github.com/projectdiscovery/nuclei/ )

Nuclei is a new tool for security engineers, developers, pen testers, and bug bounty hunters to consider adding to their arsenal.​

1. Finding Evil Go Packages
https://michenriksen.com/blog/finding-evil-go-packages/

Go is better protected from a software supply chain issue, but nothing is 100% safe.

2. Shifting Engineering Right: What security engineers can learn from DevSecOps
https://segment.com/blog/shifting-engineering-right/

​All security people need to learn to practice developer empathy – walk a mile in your developer’s shoes.

3. Hacking is not a crime – and the media should stop using 'hacker' as a pejorative
https://www.theregister.com/2021/03/03/debate_hackers_for/

Hacking is not a crime, so stop using the term in a negative connotation, and PLEASE stop using pictures of men in basements wearing black hoodies with bright computer screens!​

4. Hackers hack at unhackable new chip for three months. Chip remains unhacked
https://www.pcgamer.com/unhackable-chip-not-hacked-yet/

If a room of primates can create all the works of Shakespeare on typewriters given infinite time, then nothing is unhackable.

5. What hacking attacks can teach us about defending networks
https://www.zdnet.com/article/what-hacking-attacks-can-teach-us-about-defending-networks/

Reminder for us as Application Security people that the stakes of a specific vulnerability are high! Push MFA everywhere.