Putting to your Robots to Work V1.1

@salesforceApril 23, 2013

Putting Your Robots to WorkSecurity Automation at Twitter

@salesforce April 2013@alsmola | @ndm | @presidentbeef

The future


Philosophical Guidelines


Get the right information to the right people


Find bugs as quickly as possible


Don't repeat your mistakes


Analyze from many angles


Let people prove you wrong


Help people help themselves


Automate dumb work


Keep it tailored


Automating Security


Manual security tasks

Code review

External reports

Pen testing


Automated security tasks

Code review

External reports

Pen testing

Static analysis tools

Dynamic analysis tools

CSP


Manual security workflow

Run tool Wait for it...

Interpretreports

Fix stuff


Manual security workflow

Run tool Wait for it...

Interpretreports

Fix stuff

Repeat


Put your robots to work!

Code committed

Run dynamictools

Run static analysis tools

Gatherreports

Issuenotifications

Automate dumb work


After automation


Jenkins CI


Security Automation Dashboard (SADB)


CSP

Brakeman

ThreatDeckPhantom Gang

Roshambo

Emaildevelopers

Emailsecurity


Open SourceStatic analysis for Ruby on Rails

brakemanscanner.org


WriteCode

RunTests

CommitCode

Push to CI

CodeReview

QA DeployCode

Brakeman can run anytime

SaveCode

Find bugs as quickly as possible


Developer

Mesos +Brakeman

CodeRepository SADB

Push Code

Pull Code

Send Report

Send EmailGet the right information to

the right people


Historical trends

2007 2008 2009 2010 2011 2012 2013


Historical trendsTwitter starts using Brakeman

2007 2008 2009 2010 2011 2012 2013


Reports


Anatomy of a warning

Warning message



When warning first reported



Code location, link to repo



Code snippet



Rails-specific information

Help people help themselves


Anatomy of a warningFalse positive report button

Let people prove you wrong


QuickTime™ and aH.264 decompressor

are needed to see this picture.


CSP

Brakeman


Roshambo

Emaildevelopers

Emailsecurity


Mixed-content Sensitive forms posting over HTTPOld, vulnerable versions of jQueryForms without authenticity tokens

What does it look for?


Don't repeat your mistakes


Phantom-gang 2.0


CSP

Brakeman


Roshambo

Emaildevelopers

Emailsecurity


Detecting XSS

Analyze from many angles


QuickTime™ and aH.264 decompressor

are needed to see this picture.


Implementing CSP is not trivial


HTTP Strict Transport Security


X-Frame-Options


X-Xss-Protection

X-Content-Type-OptionsX-Xss-Protection


SecureHeaders

Automate dumb work


Header status page


CSP

Brakeman


Roshambo

Emaildevelopers

Emailsecurity


ThreatDeck


CSP

Brakeman


Roshambo

Emaildevelopers

Emailsecurity


Review all the things


Ro-Sham-Bo


Ro-Sham-Bo

Needs to be reviewed

Automate dumb work


Our journey thus far

Manual tasksLow visibility

Late problem discovery

Automated tasksTrends and reports

Automatic notifications


Tools in this presentation

Putting to your Robots to Work V1.1

Technology

Transcript of Putting to your Robots to Work V1.1