Security Does Not Need To Be Fun_ Ignoring OWASP To Have A Terrible Time - Dwayne McDaniel - CNCF 2023.pptx

1、mcdwaynemcdwayneSecurity Does Not Need To Be Fun:Ignoring OWASP To Have A Terrible TimemcdwaynemcdwayneHi,Im DwayneDwayne McDaniel I live in Chicago Ive been a Developer Advocate since 2016 On Twitter mcdwayne Happy to chat about anything,hit me up Besides tech,I love improv,karaoke and going to roc

2、k and roll shows!mcdwayneAbout GitGuardianGitGuardian is the code security platform for the DevOps generation.With automated secrets detection and remediation,our platform enables Dev,Sec,and Ops to advance together towards the Secure Software Development Lifecycle.mcdwaynemcdwayneWhat Does Good Sec

3、urity Look Like?mcdwaynemcdwaynemcdwaynemcdwaynemcdwaynemcdwaynemcdwaynemcdwaynemcdwaynemcdwayneAll Technology Has Human CostsmcdwaynemcdwayneWhat Does Bad Security Look Like?mcdwaynemcdwayne“All happy families are alike;each unhappy family is unhappy in its own way.”Leo Tolstoy,Anna Kareninamcdwayn

4、emcdwayneA Few Unhappy Families CompaniesApache Log4Shell CVE-2021-44228Reported:24 November 2021-Had existed since 2013Log4J allowed requests to arbitrary LDAP and JNDI servers,which in turn could execute any code,including opening interactive shells.Impacted over 44%of corporate networks worldwide

5、.Top Companies With Products Affected Include:Adobe,Cisco,AWS,Broadcom,IBM,Okta,VMwaremcdwaynemcdwayneA Few Unhappy Families CompaniesUber Reported:15 Sept,2022Teenager from the Lapsus$hacking group phished login info from a super adminImmediately discovered access credentials hardcoded in PowerShel

6、l scripts that allowed pwnageReported first in the New York TimesmcdwaynemcdwayneCircleCIReported:4 January 2023An unauthorized third party leveraged malware deployed to a CircleCI engineers laptop in order to steal a valid,2FA-backed SSO session.Attackers ultimately gained access to many customers