Content
While many developers are aware of cybersecurity risks, they may not have the resources and guidance to enforce cybersecurity during software development and implementation. To aid developers, the advisory offers guidance on a sustainable and automated approach to vulnerability management through Software Bill of Materials (SBOM) and real-time vulnerability monitoring. SBOM also improves response times by allowing developers to quickly identify and fix vulnerable components and collaborate across the organisation for holistic vulnerability management. This streamlined process not only minimises complexity but also fosters collaboration among developers and cybersecurity professionals, allowing cybersecurity risks to be addressed proactively without stifling innovation.
Clearly articulate what’s trusted to do what, and ensure those relationships are enforced
Although proper secrets management and application of the principle of least privilege are necessary for secure IAM, they are not sufficient. The lifecycle of identities, from creation to deprovisioning, must be carefully managed to reduce risk for CI/CD and other environments. Furthermore, one must also take steps to ensure the owasp proactive controls security of the operating systems, container images, web servers, or other infrastructure used to run or support the CI/CD components identified above.
Three step approach to managing vulnerabilities through SBOMs
Everyone knows the OWASP Top Ten as the top application security risks, updated every few years. Proactive Controls is a catalog of available security controls that counter one or many of the top ten. CI/CD environments can be complex and may often seem like a opaque-box to developers. However, visibility into these systems is critical for detecting potential attacks, better understand one’s risk posture, and detecting and remediating vulnerabilities. Though their value is often underestimated, logging and log analysis are vital for providing visibility into CI/CD systems.
- A risky crypto algorithm may be one that was created years ago, and the speed of modern computing has caught up with the algorithm, making it possible to be broken using modern computing power.
- While SBOM signing is not a native feature, external tools can be integrated into the workflow.
- First, security vulnerabilities continue to evolve and a top 10 list simply can’t offer a comprehensive understanding of all the problems that can affect your software.
- A secure architecture pattern is a standard solution that has been reviewed and hardened against known security threats.
- However, development managers, product owners, Q/A professionals, program managers, and anyone involved in building software can also benefit from this document.
Attacks on Maven proxy repositories
For details, including GitHub and GitLab examples and additional references, please see the original advisory published by CSA. After a plug-in or other integration has been approved, it must be incorporated into the organization’s configuration management processes. The software must be kept up-to-date, especially with any security patches that become available. The extension must also be continually reviewed for value; if it is no longer needed, the extension should be removed.
Call to Action
One example of a failure involves using untrusted software in a build pipeline to generate a software release. Another example is insecure deserialization, where an application receives an object from another entity and does not properly validate that object, resulting in an attack being loosed upon the application that received the object. An application could have vulnerable and outdated components due to a lack of updating dependencies. A component, in this case, was added at some point in the past, and the developers do not have a mechanism to check for security problems and update their software components.
Identity and Access Management (IAM) is the process of managing digital identities and controlling their access to digital resources. Examples of identities include system accounts, roles, groups, or individual user accounts. IAM has wide applications well beyond CI/CD, but mismanagement of identities and their underlying credentials are among the most prominent risks impacting CI/CD environments.
To simplify the process, it’s important to understand the various classifications of these controls. NIST IR 8286 categorizes application security controls into five groups based on how each control functions. The OWASP Top Ten Proactive Controls 2018 is a list of security techniques that should be included in every software development project. Developers should either remove vulnerable components if the functionalities provided through these components are not crucial or update these components to non-vulnerable versions.
Vulnerabilities Prevented
In this blog post, I’ll cover the basics of query parameterization and how to avoid using string concatenation when creating your database queries. The OWASP Top 10 Proactive Controls is similar to the OWASP Top 10 but is focused on defensive techniques and controls as opposed to risks. Each technique or control in this document will map to one or more items in the risk based OWASP Top 10. The OWASP Top 10 Proactive Controls describes the most important controls and control categoriesthat security architects and development teams should consider in web application projects. The advisory also features OWASP Dependency-Track the reference platform for how to consume and analyze SBOMs.
Value proposition of SBOM and real-time monitoring of vulnerabilities
- A subject is an individual, process, or device that causes information to flow among objects or change the system state.
- We hope that the OWASP Proactive Controls is useful to your efforts in building secure software.
- Developers should securely store signed SBOM into centralised repositories to support collaboration across teams, including SecOps, Incident Response (IR) and development teams.
- One example of a failure involves using untrusted software in a build pipeline to generate a software release.
- Examples of identities include system accounts, roles, groups, or individual user accounts.
Two such areas of interaction, the dependencies used by projects running within the pipeline and the third-party integrations and plug-ins with the CI/CD system itself will be discussed below. First, one should take steps to reduce the likelihood that secrets can be stolen in a usable format. Secrets should never be hardcoded in code repositories or CI/CD configuration files.
When designing a new application, creating a secure architecture prevents vulnerabilities before they even become part of the application. Incident logs are essential to forensic analysis and incident response investigations, but they’re also a useful way to identify bugs and potential abuse patterns. No matter how many layers of validation data goes through, it should always be escaped/encoded for the right context. This concept is not only relevant for Cross-Site Scripting (XSS) vulnerabilities and the different HTML contexts, it also applies to any context where data and control planes are mixed. First, security vulnerabilities continue to evolve and a top 10 list simply can’t offer a comprehensive understanding of all the problems that can affect your software. Entirely new vulnerability categories such as XS Leaks will probably never make it to these lists, but that doesn’t mean you shouldn’t care about them.
This includes cloud application security controls, integrating security into the early stages of the software development lifecycle (SDLC), automation, and more. This residual risk can be measured using the same techniques as those applied in the overall risk assessment. If the residual risk falls outside the acceptable limits, the risk owner must determine whether additional measures can bring it within an acceptable threshold. Applications are designed to provide access to valuable organizational data and system resources; this very function also makes them a target for hackers and malicious actors.
Proactive controls provide positive patterns to implement solutions considered secure by design. The integration of Open-Source Software (OSS) in software development introduces significant cybersecurity challenges, particularly regarding vulnerabilities in third-party dependencies. On Log4j, many organisations struggled to assess system compromises due to a lack of visibility into their software components and dependencies, with delayed responses to discovered vulnerabilities. On Heartbleed, it affected the widely used OpenSSL cryptography library, leading to the theft of 4.5 million medical records from a major overseas hospital chain.
Please don’t hesitate to contact the OWASP Proactive Control project with your questions, comments, and ideas, either publicly to our email list or privately to Jim Manico. Beyond these general principles, some specific guideline relevant to CI/CD configuration will be explored below. Learn why CISOs at the fastest growing companies trust Wiz to accelerate secure cloud development.