Adventures in the programming jungle

These are my notes of OWASP Belgium Chapter meeting of 16th of June.

OWASP Summit 2017 debrief

The talk was a debrief about the OWASP Summit 2017 which was held in London; more than 200 participants, 176  working sessions, 6 rooms. To see all the outcomes of the summit you can check the Summit Outcomes.

Some info about some of the discussed topics:

• OWASP Top 10 2017
  • discussions about the process
  • have a broader audience, not developers only
  • more can be found here.
• mobile security testing guide
  • guide updated
  • new content added; more topics like the best practices for use of OAUTH2 (??)
  • more can be found here.
• define agile security practices
  • participants redefined the session goals to discuss security practices for agile development teams.
• SAMM 2
  • more can be found here.
• app sec education
  • what is the perfect/best curriculum to teach app sec at school.
• security GitHub integration
  • drafted a letter to be able to  reach out github with a request for comment.
  • more can be found here.
• threat modeling (TM) sessions
  • OWASP wants to be more visible on threat modeling.
  • TM OWASP pages revamp
  • TM templates
  • TM iot devices
  • TM diagram techniques
  • TM cheat sheets & lightweight TM
  • new slogan: “The sooner the better, never too late”
• OWASP playbook series
  • actionable consistent process to getting started with various application security topics.
  • more can be found here, here and here.
• OWASP Testing guide v5

Threat modeling lessons from Star Wars

This is an introductory talk about threat modeling having as goal to demystify the threat modeling is hard and can be done only by very smart/trained people.

You can start to threat model by answering 4 questions:

1. What are you building?
   • You must represent/draw somehow the item that you want to build.
   • The DFDs (data flow diagrams) are the most common way to represent the system under build but other options are available like Swim Lanes diagrams.
   • You can use any kind of diagram that fits your needs.
2. What can go wrong?
   • Find the threats using STRIDE, Attack Trees, CAPEC Kill chain, Check Lists.
   • A small introduction to STRIDE mnemonics was done.
3. What are you going to do about it?
4. Did you do an acceptable job at 1-3?

The second part of the talk was called “Top 10 lessons” and actually contained a list of 10 misconceptions about the threat modeling:

1. Think like an attacker
   • it is very difficult to think like an attacker doesn’t help you to know what you have to do.
2. You’re never done threat modeling
   • the 4 states of a threat modeling:
     • model
     • identify threats
     • mitigate
     • validate
3. The way to threat model is…
   • should focus on what delivers value by helping people find good threats
   • for each threat modeling phase (model, identify, mitigate, validate) there are different techniques to do the job.
4. Threat modeling as one skill
   • there are different techniques : DFDs , Attack trees, etc…
5. Threat modeling is born not taught
   • threat modeling is like playing a violin; you need to train yourself and you will not be able to play correctly from the beginning.
   • practice, practice, practice
6. The wrong focus
   • focus on the software being build not on the assets that you want to protect or by thinking about your attackers.
7. Threat modeling is for specialists
   • threat modeling should be like version control, anyone can and should threat model.
8. Threat modeling without context
   • see threat modeling not in a vacuum but as part of a chain, that can help different teams (dev team, operations team) to fix (security) problems.
9. Laser like focus on threats
   • requirements drive threats.
   • threats expose requirements.
   • threats needs mitigations.
   • un-mitigatable threats drive requirements.
10. Threat modeling at the wrong time
    • you must start threat modeling early.

Main take-aways: anyone can threat model and should; all the necessary technique can be learned.