Latest / CYBR.Signal / CI/CD OWASP Top 10: What does it mean for you?

Transcript

CI/CD OWASP Top 10: What does it mean for you? · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: My name is Michael Farnum.
• 0:03
  SPEAKER_00: Hope you're doing well.
• 0:04
  SPEAKER_00: Hope you had a good Thanksgiving getting ready for the rest of the holiday season.
• 0:10
  SPEAKER_00: So wanted to talk today about something I actually missed and I'm a little bit ashamed of myself.
• 0:18
  SPEAKER_00: I think it got launched back in November, which is the OWASP top 10 for CICD pipelines.
• 0:24
  SPEAKER_00: So if you're not familiar with OWASP, that's open web application security projects, been around a while.
• 0:29
  SPEAKER_00: They created this top 10 list, uh mid-2000s, sometime, can't remember exactly.
• 0:37
  SPEAKER_00: That was all about kind of giving the breakdown of the top 10 threats they saw in or vulnerabilities they saw in web applications as they got developed.
• 0:46
  SPEAKER_00: That moved around and became projects for different areas.
• 0:51
  SPEAKER_00: There's been video game top 10, if you can believe it.
• 0:54
  SPEAKER_00: There's been an API top 10, there's a couple of other uh OWASP top 10.
• 1:00
  SPEAKER_00: So it's not just web application security, but the OWASP label is kind of stayed there.
• 1:06
  SPEAKER_00: And now they have one out called for the CI C D pipeline top 10.
• 1:12
  SPEAKER_00: So CI CD, if you're not familiar with that term, continuous integration, continuous development, essentially the uh the pipeline of tools and uh processes for a developer to be able to take their code from being on their desktop all the way to production being deployed, being used, whether that's web application, whatever that is, traditionally, or I mean, well, nowadays it's almost always web application, but it can be other applications as well.
• 1:45
  SPEAKER_00: So that pipeline is extremely important these days and is actually I don't want to say neglected or ignored, it just hasn't the security tools haven't caught up with it.
• 1:57
  SPEAKER_00: So as a developer begins development on their integrated development environment within their on their desktop or wherever they're developing from, and that moves through the development process, and they have pieces of code from different repositories, maybe open source repositories, that kind of stuff that gets integrated into that.
• 2:17
  SPEAKER_00: Uh, all of those pieces, and now it has a lot of the infrastructure as code that's in there as well.
• 2:25
  SPEAKER_00: So if you're using, if you're deploying into the cloud, uh maybe using Terraform scripts or something like that to build that environment where it's going to get deployed, that's infrastructure as code that's in the CICD pipeline as well.
• 2:40
  SPEAKER_00: All of those pieces in the pipeline, all of the tooling, all of the where the uh the code sits, where the code comes from, if it's not written natively by the developer, which a lot of it's not, it's pulling from some kind of repository somewhere.
• 3:00
  SPEAKER_00: All of those things have been really big lately in breaches over the last couple of years, and solar winds, and several other ones that you would recognize probably if you're paying attention in this industry, just huge things all came down to supply chain attacks, generally, just all included in the CI CD pipeline, how that code gets written, integrated, developed, deployed, all of those things in the CI CD pipeline.
• 3:32
  SPEAKER_00: So that that's important that it got launched.
• 3:36
  SPEAKER_00: What does that mean?
• 3:38
  SPEAKER_00: Well, it I think generally, overall, it's a good thing because it is creating more of a sense of hey, there's more thought going into securing the CI CD pipeline.
• 3:49
  SPEAKER_00: That's a good thing.
• 3:50
  SPEAKER_00: That's already been happening, but it's it's having an OWASP top 10 for it is good.
• 3:57
  SPEAKER_00: That's a good good thing to have.
• 4:00
  SPEAKER_00: Draws attention to it.
• 4:01
  SPEAKER_00: What does that mean for developers?
• 4:03
  SPEAKER_00: Uh, developers can be quick to be tempted to say, okay, well, now you're gonna be in certain security on every single piece of the pipeline, you're gonna be getting in my way, you're gonna stop things.
• 4:14
  SPEAKER_00: 100% understand how that can be a fear.
• 4:18
  SPEAKER_00: We've got to create tools and already have, and then a lot of them have been created, some of them still need to be created, and processes that run at that same speed and do minimal have minimal interruption or any of that to the CI CD pipeline as developers are pushing out code and trying to get things done.
• 4:39
  SPEAKER_00: These tools and processes have to move at the same speed as development does.
• 4:45
  SPEAKER_00: So I think that lesson generally has been learned.
• 4:48
  SPEAKER_00: So, as developers, I wouldn't get too worried about it unless you just got a security department that just loves stopping things, and that's the case, you got a whole nother problem.
• 4:57
  SPEAKER_00: But for security people, it absolutely means there's more focus going to be put on that.
• 5:02
  SPEAKER_00: I say it does.
• 5:03
  SPEAKER_00: OWASP is not as big as it used to be, but it's still a very good place to get a lot of good information.
• 5:10
  SPEAKER_00: So, overall, OWASP top 10 CI CD pipeline project, I think is a good thing.
• 5:17
  SPEAKER_00: I don't think developers need to worry about it too much because there are a lot of tools that have already been developed over the last few years that are moving at that same speed.
• 5:26
  SPEAKER_00: People know it.
• 5:27
  SPEAKER_00: Now that the project is there, I think that'll help things.
• 5:30
  SPEAKER_00: Let me know what you think.
• 5:32
  SPEAKER_00: Talk to you next time.