The document discusses open source software (OSS) security issues and strategies for addressing vulnerabilities. It notes that while open development allows many eyeballs to find bugs, in reality most don't know what to look for and vulnerabilities are still regularly found. It then provides data on vulnerabilities reported over time for several major OSS projects. The document advocates applying a secure development lifecycle and vulnerability management process to address issues early. It also discusses automating scanning of code and binaries for vulnerabilities and integrating these tools into developer workflows.

2. Agenda

3. OSS Security Resources https://aka.ms/OSSsecurity

6. Development Realities

13. bashHOLE?

14. Shell Shock.. meh

17. Not just named vulnerabilities…

18. Cathedral and the Bazaar
1999: “Given enough eyeballs, all bugs are
shallow.”
2003: Michael Howard & David LeBlanc
assert most don’t know what to look for
2006: Coverity & others release reports of
selectively scanned Open & Closed source
projects, claiming proof Linus’ Law works
2014: Heartbleed, Shellshock, Poodle, etc
2017: …
https://www.flickr.com/photos/hades2k/7001927337

20. More audience participation!
How many vulnerabilities do you
think there have been in OpenSSL
since Heartbleed?

21. Average
CVSS 5.36

22. Trending Now: compromise OSS integrity
http://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-registry
http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/index.html
https://www.wordfence.com/blog/2017/09/display-widgets-malware/

23. Show Me The Data

24. OSS Component Vuln Data Slides
1 1 1
4
8
3 4 5 4
2
12 12
4
16
4
24
34 34
8
0 0 0 0 0 0 1
3
0 0
5
1
3
10 10
6
1
16
13
0
5
10
15
20
25
30
35
40
1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017
CVE Counts by Year
OpenSSL Apache Struts

25. OSS Component Vuln Data Slides
0
10
20
30
0
20
40
60
80
100
0
50
100
150
200
250
300
0
1
2
3
4
5
0
50
100
150
200
250
300
2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017
Freetype FFMPEG Chromium Electron

27. Data from public sources is limited
FFMPEG
NVD: 253
CVE Details: 253

28. High value data isn’t free
FFMPEG
NVD: 253
CVE Details: 253
VulnDB: 1,200+

29. Efficiency At What Cost?
A single application
◦ may have hundreds of different
third party libraries implemented
◦ may have multiple copies of the
same component or library
implemented

30. Debate!
What should you measure library quality on?
◦ Count of vulnerabilities
◦ Frequency of update releases
◦ Average severity of vulns (CVSS or other)
◦ Existence of POC or Exploit

31. OSS Vulnerability Lifecycle and SDL

34. Cost to Fix Vulnerabilities
The National Institute of Standards and
Technology (NIST) estimates that code
fixes performed after release can result
in 25+ times the cost of fixes performed
during the design phase.
tl;dr: Pay me now or pay me later… with
interest.

35. Secure Development Lifecycle

36. Vulnerability Management Process
Identify
Issue1
Assess
Impact2
Dev & Test
Fix3
Deploy
Fix4
Post
Release5

37. OSS Vulnerability Lifecycle
Identify
Issue
Assess
Impact
Dev &
Test Fix
Public
Release
w/ CVE
Post
Release
Identify
Issue
Assess
Impact
Dev &
Test Fix
Public
Release
Post
Release
Identify
Issue
Assess
Impact
Dev &
Test Fix
Public
Release
Post
Release
Identify
Issue
Assess
Impact
Dev &
Test Fix
Public
Release
Post
Release

38. When to Point Fix

40. Cloud Architecture and OSS (Generic)
Data Center
Facility Security
HVAC
Power
Shared HW
Network
Storage
Compute
ILO / Serial
BIOS / Firmware
VM OS - IaaS/PaaS/Other
Linux BSD Windows

42. Start Operationally Secure
Vendor Build
and Publish
• Guidance
• Attestation
• Validation
Marketplace
• Start secure
by default
• Image health
• Better trust
decisions
Deployment
• Secure
templates
• Hardening
guides
Running
• Stay secure
• Baselines
• Monitoring
Agents

43. Zooming in on the Cloud – “Scanning”
100x
• Source Code
• Intellectual property
• Vulnerability
• Binary in builds
10x
• VM / Infra / OS
• Packages
• Configuration
• Authenticated (Internal)
1x
• Edge / Port
• Un-Authenticated
• Authenticated (web app)

44. Automate and Integrate
Automate what can be automated
◦ Source Code Scanning
◦ Binary Scanning
◦ Both for IP, Security, and freshness
Integrate
◦ The solutions and tools *MUST* be integrated Into your developers workflow and build
systems

46. Get It Done
• Automate everything you can:
◦ Detection and inventorying of OSS implemented in source code, cloud tenants, etc
◦ Notifications of out of date and vulnerable OSS that needs updating
◦ Updating packages - Greenkeeper
• Complete a Security Assessment of OSS components prior to use
• Routinely update OSS components to current version
• Microsoft employee? Go further down the OSS Risk Rabbit Hole
and stream the STRIKE presentation. Find it at aka.ms/osssec

47. www.motleyzoo.org