Cyber Security and Open Source

Cyber SecurityAnd Open Source

Managing Expectations, Reducing Fears and Understanding Reality

Chad CravensOpen Source Systems

www.ossys.com

About The Speaker

1Open Source Systems – www.ossys.com

2007 - Graduate of New Mexico Institute of Mining and Technology(Scholarship for Service Recipient)

2007 – 2011 Federal Employee at SPAWAR(Space and Naval Warfare Systems Center)

2012 – Software Engineer at Small Wall St Firm2014 – Founded Open Source Systems

Chad CravensCharleston, SC

Software Fanatic

Stickler for Software Quality and Security!

What Is Cyber Security?


The state of being protected against the criminal or unauthorized use of electronic data, or the measures taken to achieve this.

- Confidentiality- Availability- Integrity

Life in the day of a Program Manager


Walk a day in her shoes…..

People

Personalities

Customers

Burn Rates

Teams

Processes

Budgets

Implementation

IntegrationHiringStakeholders

DeadlinesVendors

Technology

What is the Issue with Open Source?


Who’s afraid of theBoogey Man?

False

Expectations

Appearing

Real

What is this “Open Source” thing?-- A FEAR of the unknown --

Let’s Use this Open Source Tool!


Billy Bob from dev team 6 suggestsWe use this open source product

What is the license?Is it supported?

Who developed it?What’s the cost?Is it accredited?

We are your Super-Vendor!


Mr. Big-Name Vendor in a suit sayswe should use their product instead

What is the license?Is it supported?

Who developed it?What’s the cost?Is it accredited?

YESYES

YES

YES

YES

YES

YESYES

YES

YES

YES

YES

YES YES

Turn FEAR into Knowledge


The Right Tool for the Right Job

First, What are the threats?


• Zero-day Exploits• Web-Based Attacks• Ransomware• Social Media Scams• Phishing• Internet of Things• Mobile Attacks

http://www.symantec.com/content/en/us/enterprise/other_resources/b-istr_main_report_v19_21291018.en-us.pdf

Second, Debunk the Myths


First thing, “Open Source” is BIG:

Operating Systems

Enterprise Libraries

Message Brokering

Encryption

Embedded SystemsProgramming Languages

Front-End Development

MVC FrameworksNetwork Devices

Mobile

“Big Guys” Going Open Source


Tesla released all patents as open source

Netflix custom software released as open source

.NET Core is now open source

Oracle acquired Sun, giving it Java and MySQL

Open Source in the Government


http://www.data.gov/

https://government.github.com/community/

http://mil-oss.org/

http://code.nasa.gov/

April, 2009 Whitehouse Report

Debunking Myths


“Open Source is Insecure”Reality:- Source code is not needed to circumvent security- Licensing has little effect on the security of software

“Open Source is More Secure”Reality:- Open-sourcing bad / insecure code will not make it secure- Only good coding practices will create secure code- Having more reviewers may benefit the security of a project

Debunking Myths


“Anyone Can Contribute Malicious Code”Reality:- Projects have a core team of contributors- Additions to the code are analyzed before merged

“Hackers Can More Easily Exploit”Reality:- Tools allow tracing of binaries, the exploit is in the binary not

the code- Hackers do not need source code to exploit

Exploit Example!


Human Ingenuity Knows No Bounds

<div style="background:url('javascript:alert(1)')">

The MySpace Worm – Samy Is My Hero

<div id="mycode" expr="alert('hah!')" style="background:url('javascript:eval(document.all.mycode.expr)')">

JavaScript in a background CSS attribute in a <div> tag:

Putting javascript in an expr attribute


Putting javascript in an expr attribute


Using newlines to bypass filtering of “javascript”

Security is About Management


Program Defensively!

1. Injection Flaws2. Broken Authentication / Session Management3. Cross-Site Scripting4. Insecure Direct Object References5. Security Misconfiguration6. Sensitive Data Exposure7. Missing Function Level Control Access8. Cross-Site Request Forgery9. Using Components with Vulnerabilities10. Unvalidated Redirects and Forwards

Security is About Knowledge


Security is About Processes


Embrace Agile!

What Agile Is Not:• A Buzzword for Companies• A Fad• A JIRA Account

What Agile Is:• A Suite of Processes,

Methodologies and Tools

• Testing• Metrics• Automation

Use Open Source Effectively


Use ORM tools to help mitigate SQL injection

Use unit testing to build test suites against your code

Use Jenkins for testing and build automation

Use SonarQube for code quality testing (PMD / FindBugs)

Use Open Source Effectively


Use OWASP Zap to dynamically scan web-based software

Use picketlink for XACML policy enforcement

Use OpenSSL for Cryptographic functions

Use AspectJ for Logging and configuration management

Use Open Security Standards


Use Mature Open Source Projects


Roots in Open Source


Cyber Security has roots in Open Source

Open Source Cyber Lab


Thank you!
