Continuous Security, DevOps, and DevSecOps
Recently I participated in a hackathon building tools to help the blue team inventory our external attack surface. We are a large business with many global locations, datacenters, and devices, built up over time and via acquisition, so there is a lot to search for, and our internal inventories don't…
Docker is a fantastic piece of technology for teams. Some time ago, I published a series of articles on building a docker security program, which covers doing a threat assessment, image static and runtime analysis, and overall container patching and maintenance. I was asked recently about deployment security, which was…
I don't often come get a chance to use pivot techniques, so I sometimes find myself searching for reminders about various methods and their trade offs. I put together this list of common pivot techniques I have used, along with a quick to setup docker-compose environment to get you playing…
Last year, I interviewed a number of coding bootcamp graduates who were taught the MEAN stack exclusively. When looking at their final projects, all of them had NoSQL injection vulnerabilities present, indicating that perhaps the schools were not teaching secure coding. When I asked them about this (gently, because it…
Companies selling "security scorecards" are on the rise, and have started to become a factor in enterprise sales. I have heard from customers who were concerned about purchasing from suppliers who had been given poor ratings, and in at least one case changed a purchasing decision based initially on the…
Today, I will walk through configuring a daily DAST scan against an application, using Jenkins and ZAP. The process can be used similarly with any DAST scanner, depending on how the specific scanner is setup. This is the second part of a series. In part one, I walked through initial…
In my last post, I talked about integrating security tools with an agile process, and mentioned some ways to automate security checks during development. In this article, I'll walk through a basic Jenkins setup for CI/CD, and integrate SonarQube and DependencyCheck for security scanning. In my next article, I'll…
Recently, a distant cousin reached out to me for help in researching a persons history. My cousin's father had met and gotten engaged to a woman who my cousin thought was trying to steal from him. After starting this relationship, he started to change his behavior - pushing away his…
Updated in December 2019 to account for recent changes in the product landscape. In summary, I switched from PIA to Mullvad for VPN, and no longer recommend StartPage for search. Friends and family sometimes ask me for advice about security tools or practices they should use to improve their own…
A lot of security advice I read tends to fall into two camps: tailored to enterprises with full time security and infrastructure teams, or rapid fire tool installation without context for solo web developers. In this article, we will tread a middle path, and look at some ways to manage…