Secure Software Development Lifecycle | GitKon 2022| James Brotsos, Checkmarx

Summary

In this talk, James Brostos discusses the importance of integrating security into the Software Development Lifecycle (SDLC). He emphasizes the significance of injecting security measures at the right stages, especially during pull requests. Brostos introduces various tools for securing SDLC, such as stack analysis, software composition analysis, and secret detection. He stresses collaboration between developers and security teams to ensure fast deployments without compromising security. The talk also highlights the need for security training and the use of IDE-integrated tools for detecting and fixing vulnerabilities. His goal is to make security a seamless part of the development process.

Takeaways

• 😀 Security should be integrated early in the Software Development Lifecycle (SDLC), ideally during the pull request or push event stage.
• 😀 Developers should collaborate closely with application security teams to define security policies and focus on important vulnerabilities.
• 😀 The ideal time for running security tools like stack analysis is during pull requests to catch vulnerabilities early and save costs.
• 😀 Tools like stack analysis and software composition analysis are essential for identifying security vulnerabilities, including those in third-party libraries.
• 😀 Secret detection tools help find leaked tokens or sensitive information in the repository's history, even if the repo is private.
• 😀 Security integration into the SDLC should be a cooperative, non-policing process between developers and security teams.
• 😀 Running security scans too late in the development process can lead to costly and time-consuming context switching when vulnerabilities are discovered post-deployment.
• 😀 Threat modeling sessions during the architecture phase help developers identify potential security risks with APIs and data flows before coding begins.
• 😀 Developers should use their preferred IDEs for triaging security findings directly in their development environment, making fixes easier and faster.
• 😀 Training on security vulnerabilities, like SQL injection and cross-site scripting, should be integrated into the organization’s internal resources, such as wikis or training tools, to raise awareness across teams.
• 😀 Security results should be accessible and actionable, with tooling that highlights newly discovered or fixed vulnerabilities, providing clarity for developers during pull requests.

Q & A

What is the main focus of the talk?

The main focus of the talk is on securing your Software Development Lifecycle (SDLC) with an emphasis on tooling and training.

What is the role of James Brostos in Checkmarx?

James Brostos is a developer advocate and the head of product for Checkmarx, an application security testing platform.

What is the core purpose of Checkmarx's solution?

Checkmarx provides security engines that run on your source code to detect vulnerabilities and enhance security in your application.

What is the main takeaway from the talk regarding security in SDLC?

The talk emphasizes integrating security into the SDLC as early as possible to save time and costs, reducing the chances of security bugs being found later in the deployment process.

What is the best stage in SDLC to inject security scans?

The best stage to inject security scans is during the pull request or push event, specifically when merging code from a feature branch to the main branch.

What security tools are recommended for securing SDLC?

Tools recommended include stack analysis (SAST), software composition analysis (SCA), secret detection, and tools for analyzing infrastructure as code and identifying configuration weaknesses.

Why is it important to run security tools during pull requests?

Running security tools during pull requests allows developers to detect vulnerabilities before they are merged into the main branch, thus ensuring faster deployment without compromising security.

How does secret detection help in securing SDLC?

Secret detection helps by identifying secrets or tokens that might be accidentally exposed in the code or its history, ensuring that sensitive data doesn't get leaked, even if the repository is private.

What role does threat modeling play in SDLC?

Threat modeling helps in identifying potential security risks, especially related to APIs and design flaws, before development starts, allowing for better-informed decisions during the architecture phase.

How can developers consume and act on security results effectively?

Developers can consume security results in their IDEs where they can directly triage vulnerabilities, understand their attack vector, and quickly fix them before resubmitting pull requests.

What does James recommend for improving security training in organizations?

James recommends working with application security teams to build internal wikis or tools that provide security training resources, helping developers recognize and fix vulnerabilities in their code.