Brakeing Down Security Podcast Blog

Liz Rice is the Technology Evangelist with container security specialists Aqua Security, where she also works on container-related open source projects including kube-hunter and kube-bench. She was Co-Chair of the CNCF’s KubeCon + CloudNativeCon 2018 events in Copenhagen, Shanghai and Seattle, and co-author of the O’Reilly Kubernetes Security book. She has a wealth of software development, team, and product management experience from working on network protocols and distributed systems, and in digital technology sectors such as VOD, music, and VoIP. When not building startups and writing code, Liz loves riding bikes in places with better weather than her native London.

Liz Rice (@lizrice on Twitter) https://www.lizrice.com/

https://medium.com/@lizrice/non-privileged-containers-based-on-the-scratch-image-a80105d6d341

https://www.forbes.com/sites/adrianbridgwater/2018/07/23/shift-happens-why-your-software-needs-to-shift-left/#41aac6047f8c

https://www.cloudops.com/2018/10/takeaways-from-liz-rice-pop-up-meetup-on-container-security/

https://thenewstack.io/cloud-native-security-patching-with-devops-best-practices/

https://changelog.com/gotime/56 - podcast with Liz

https://kubernetes-security.info - co-author of O’Reilly Kubernetes security book

https://www.slideshare.net/Docker/dont-have-a-meltdown - Liz Rice/Justin Cormack slides

https://www.bbc.com/news/technology-41753022 - NHS ransomware issue in 2017

https://docs.docker.com/config/containers/container-networking/ - docker portmapping

https://techbeacon.com/9-practical-steps-secure-your-container-deployment

If security needs to “Shift Left”, what can devs do to accommodate the change?

Everyone will have to make adjustments, not just security… right?

Reverse uptime…

Forgotten data?

Test Driven Development

Why do we need security as far left?

“We don’t patch, we just push a fix, ”

“We’ll fix it in production…”

Or we pump more resources to overcome perf issues

Is there time for code reviews?

“We don’t need change management…”

https://testssl.sh - @drwetter

Automation: How does security that solve security issues?

Do Microservices solve everything?

What don’t they solve?

What does security need to embrace to make the shift less painful?

What does development need to embrace to make the shift less painful?

Cause security wants to get in there…

There are already DevSecOps processes a-plenty and many . Why aren’t companies adopting them?

Maturity?

Lack of resources?

Negligent devs - how can you ignore the news of breaches?

Setting Goals

“Start Small” - what’s an example of a small goal?

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Here is a new episode of Brakeing Down Security Podcast!

Monday, January 21, 2019

2019-002-part 2 of the OWASP IoT Top 10 with Aaron Guzman

intro

CFP for Bsides Barcelona is open! https://bsides.barcelona

Aaron Guzman: @scriptingxss

https://www.computerweekly.com/news/252443777/Global-IoT-security-standard-remains-elusive

https://www.owasp.org/index.php/IoT_Attack_Surface_Areas

https://scriptingxss.gitbooks.io/embedded-appsec-best-practices//executive_summary/9_usage_of_data_collection_and_storage_-_privacy.html

OWASP SLACK: https://owasp.slack.com/

https://www.owasp.org/images/7/79/OWASP_2018_IoT_Top10_Final.jpg

Team of 10 or so… list of “do’s and don’ts”

Sub-projects? Embedded systems, car hacking

Embedded applications best practices? *potential show*

Standards: https://xkcd.com/927/

CCPA: https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act

California SB-327: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180SB327

How did you decide on the initial criteria?

Weak, Guessable, or Hardcoded passwords
Insecure Network Services
Insecure Ecosystem interfaces
Lack of Secure Update mechanism
Use of insecure or outdated components
Insufficient Privacy Mechanisms
Insecure data transfer and storage
Lack of device management
Insecure default settings
Lack of physical hardening

2014 OWASP IoT list: https://www.owasp.org/index.php/Top_10_IoT_Vulnerabilities_(2014)

2014 list:

BrakeSec Episode on ASVS http://traffic.libsyn.com/brakeingsecurity/2015-046_ASVS_with_Bill_Sempf.mp3

OWASP SLACK: https://owasp.slack.com/

What didn’t make the list? How do we get Devs onboard with these?

How does someone interested get involved with OWASP Iot working group?

https://docs.microsoft.com/en-us/azure/iot-fundamentals/iot-security-best-practices

https://www.iiconsortium.org/pdf/SMM_Description_and_Intended_Use_2018-04-09.pdf

https://www.dhs.gov/sites/default/files/publications/Strategic_Principles_for_Securing_the_Internet_of_Things-2016-1115-FINAL_v2-dg11.pdf

https://api.ctia.org/wp-content/uploads/2018/08/CTIA-IoT-Cybersecurity-Certification-Test-Plan-V1_0.pdf

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/747977/Mapping_of_IoT__Security_Recommendations_Guidance_and_Standards_to_CoP_Oct_2018.pdf

https://www.mocana.com/news/mocana-xilinx-avnet-infineon-and-microsoft-join-forces-to-secure-industrial-control-and-iot-devices

https://www.microsoft.com/en-us/research/wp-content/uploads/2017/03/SevenPropertiesofHighlySecureDevices.pdf

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Here is a new episode of Brakeing Down Security Podcast!

Sunday, January 13, 2019

2019-001: OWASP IoT Top 10 discussion with Aaron Guzman

Aaron Guzman: @scriptingxss

https://www.computerweekly.com/news/252443777/Global-IoT-security-standard-remains-elusive

https://www.owasp.org/index.php/IoT_Attack_Surface_Areas

https://scriptingxss.gitbooks.io/embedded-appsec-best-practices//executive_summary/9_usage_of_data_collection_and_storage_-_privacy.html

OWASP SLACK: https://owasp.slack.com/

https://www.owasp.org/images/7/79/OWASP_2018_IoT_Top10_Final.jpg

Team of 10 or so… list of “do’s and don’ts”

Sub-projects? Embedded systems, car hacking

Embedded applications best practices? *potential show*

Standards: https://xkcd.com/927/

CCPA: https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act

California SB-327: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180SB327

How did you decide on the initial criteria?

Weak, Guessable, or Hardcoded passwords
Insecure Network Services
Insecure Ecosystem interfaces
Lack of Secure Update mechanism
Use of insecure or outdated components
Insufficient Privacy Mechanisms
Insecure data transfer and storage
Lack of device management
Insecure default settings
Lack of physical hardening

2014 OWASP IoT list: https://www.owasp.org/index.php/Top_10_IoT_Vulnerabilities_(2014)

2014 list:

BrakeSec Episode on ASVS http://traffic.libsyn.com/brakeingsecurity/2015-046_ASVS_with_Bill_Sempf.mp3

OWASP SLACK: https://owasp.slack.com/

What didn’t make the list? How do we get Devs onboard with these?

How does someone interested get involved with OWASP Iot working group?

https://docs.microsoft.com/en-us/azure/iot-fundamentals/iot-security-best-practices

https://www.iiconsortium.org/pdf/SMM_Description_and_Intended_Use_2018-04-09.pdf

https://www.dhs.gov/sites/default/files/publications/Strategic_Principles_for_Securing_the_Internet_of_Things-2016-1115-FINAL_v2-dg11.pdf

https://api.ctia.org/wp-content/uploads/2018/08/CTIA-IoT-Cybersecurity-Certification-Test-Plan-V1_0.pdf

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/747977/Mapping_of_IoT__Security_Recommendations_Guidance_and_Standards_to_CoP_Oct_2018.pdf

https://www.mocana.com/news/mocana-xilinx-avnet-infineon-and-microsoft-join-forces-to-secure-industrial-control-and-iot-devices

https://www.microsoft.com/en-us/research/wp-content/uploads/2017/03/SevenPropertiesofHighlySecureDevices.pdf

Here is a new episode of Brakeing Down Security Podcast!

Wednesday, December 26, 2018

2018-045: end of the year podcast!

Join the combined forces of:

Jerry Bell (@maliciousLink) from Defensive Security Podcast! (https://defensivesecurity.org/)

Bill Gardner from the "RebootIt! podcast"

https://itunes.apple.com/us/podcast/reboot-it/id1256466198?mt=2

Ms. Berlin and Bryan Brake for the end of the year podcast!

BrakeSec Podcast = www.brakeingsecurity.com

RSS: https://www.brakeingsecurity.com/rss

Here is a new episode of Brakeing Down Security Podcast!

Tuesday, December 18, 2018

2018-044: Mike Samuels discusses NodeJS hardening initiatives

Mike Samuels

https://twitter.com/mvsamuel

https://github.com/mikesamuel/attack-review-testbed

https://nodejs-security-wg.slack.com/

Hardening NodeJS

Speaking engagement talks:

A Node.js Security Roadmap at JSConf.eu - https://www.youtube.com/watch?v=1Gun2lRb5Gw

Improving Security by Improving the Framework @ Node Summit - https://vimeo.com/287516009

Achieving Secure Software through Redesign at Nordic.js - https://www.facebook.com/nordicjs/videos/232944327398936/?t=1781

What is a package: (holy hell, why is this so complicated?)

A package is any of:

a) a folder containing a program described by a package.json file
b) a gzipped tarball containing (a)
c) a url that resolves to (b)
e) a <name>@<tag> that points to (d)
f) a <name> that has a latest tag satisfying (e)
g) a git url that, when cloned, results in (a).

https://medium.com/@jsoverson/exploiting-developer-infrastructure-is-insanely-easy-9849937e81d4

https://blog.risingstack.com/node-js-security-checklist/

https://www.npmjs.com/package/trusted-types

https://github.com/WICG/trusted-types/issues/31

Here is a new episode of Brakeing Down Security Podcast!

Monday, December 10, 2018

2018-043-Adam-Baldwin, npmjs Director of Security, event stream post mortem, and making your package system more secure

Adam Baldwin (@adam_baldwin)

Director of Security, npm

https://foundation.nodejs.org/

https://spring.io/understanding/javascript-package-managers

Role in the NodeJS project

Advisory? Active role? Maintain security modules?

Are there any requirements to being a dev?

Are there different roles in the NodeJS environment?

Is there any review of system sensitive packages? (or has that ship sailed…)

Discussion of timeline from NodeJS security team

When were you notified? (or were you notified at all?)

What steps were taken to fix the issue?

Lessons learned?

Official npm security policy: https://www.npmjs.com/policies/security (good stuff!)

Event-stream (initial bug report): https://github.com/dominictarr/event-stream/issues/116

Only affected bitcoin Wallets from ‘Copay’

https://nakedsecurity.sophos.com/2018/11/28/javascript-library-used-for-sneak-attack-on-copay-bitcoin-wallet/

“Cue relief, mixed with frustration, for anyone not targeted. Developer Chris Northwood wrote :

We’ve wiped our brows as we’ve got away with it, we didn’t have malicious code running on our dev machines, our CI servers, or in prod. This time.” (

https://medium.com/@jsoverson/exploiting-developer-infrastructure-is-insanely-easy-9849937e81d4

“The damage this could have caused is incredible to think about. The projects that depend on this aren’t trivial either, Microsoft’s original Azure CLI depends on event-stream! Think of the systems that either develop that tool or run that tool. Each one of those potentially had this malicious code installed.”

https://thehackernews.com/2018/11/nodejs-event-stream-module.html

“The malicious code detected earlier this week was added to Event-Stream version 3.3.6, published on September 9 via NPM repository, and had since been downloaded by nearly 8 million application programmers.”

https://www.analyticsvidhya.com/blog/2018/07/using-power-deep-learning-cyber-security/

Hacker News (with comments): https://news.ycombinator.com/item?id=18534392

Official npm blog post: https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident

https://blog.npmjs.org/post/175824896885/incident-report-npm-inc-operations-incident-of

https://resources.whitesourcesoftware.com/blog-whitesource/top-5-open-source-security-vulnerabilities-november-2018

2017 package/user stats: https://www.linux.com/news/event/Nodejs/2016/state-union-npm

According to npmjs.org: over 800,000 packages (854,000 packages, 7 million+ individual versions)

Dependency hell in NodeJS:

https://blog.risingstack.com/controlling-node-js-security-risk-npm-dependencies/

“Roughly 76% of Node shops use vulnerable packages, some of which are extremely severe; and open source projects regularly grow stale, neglecting to fix security flaws.”

History of NodeJS security issues:

ESLINT: https://nodesource.com/blog/a-high-level-post-mortem-of-the-eslint-scope-security-incident/

Left-pad: https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/

How to ensure this type of issue doesn’t happen again? (or is that possible, considering the ecosystem?)

What can devs, blueteams, or companies that live and die by NodeJS do to increase security, or assist in making NPM Security team’s job easier?

What the responsibility is of consumers of open source?

What can be done to ensure vetting for ‘important’ packages?

Can someone manage turnover? (or is that ship sailed?)

Security scanners:

https://geekflare.com/nodejs-security-scanner/

https://techbeacon.com/13-tools-checking-security-risk-open-source-dependencies-0

Threat assessment or ‘what could go wrong in the future’?