Follow this presentation to see how an OSS audit and static code analysis can be used to reduce and mitigate the security risks associated with open source software and Internet-based applications. Presented January 2016 at the Open source compliance seminar hosted Brooks Kushman and Rogue Wave Software.

1. Cyber Security Overview
Jeff Hildreth
Sr. Account Executive Automotive &
Aerospace/Defense
Jeff.Hildreth@roguewave.com

2. Agenda
• Why is this a reality in Automotive
• How to mitigate risk
• Augment existing processes to demonstrate security
compliance
2

3. Cybersecurity. Why do I care?

5. Cyber Supply Chain Management and TransparencyAct of 2014

6. 6
Requirements
Analysis
System
Design
System Test
Component
Design
Component
Implementation
Component
Test
System
Integration
Item
Definition
Hazard and
Risk Analysis
System
Safety
Concept
System and
Component
Design
Qualitative
Safety
Analyses
Quantitative
System
Analyses
Safety Case
Verification
and
Validation
SECURITY?
ISO 26262

7. Accept
Sprint 1
Sprint 2
Sprint n Release
Change
Adjust and Track
Feedback
Review
Next Iteration
No!
Yes
!
Release
to Market
Integrate
and Test
Integrate
and Test
Integrate
and Test
Agile Development – Integrated Security
Characteristics
• Multiple testing
points
• Rapid feedback
required
• “Outside” testing
does not meet
agile needs

8. Application code
3rd party components
Ensure the open source code provider has a strong security plan
APIs and Web Services
Prevent buffer overflows and ensure your code is safe before adding it to your code
Test your
code
Look for flaws
early
Make security
a priority

9. 9© 2015 Rogue Wave Software, Inc. All Rights Reserved.
Common attacks
Organizations have failed to prevent attacks
Lack of time Lack of focus
Lack of
tools/proper
tools
Survey:
1700 developers,
80% of them
incorrectly answered
key questions
surrounding the
protection of sensitive
data
SQL injection
Unvalidated
input
Cross-site
scripting
Most breaches result from input trust issues
Heartbleed:
buffer overrun
BMW patch:
HTTP vs. HTTPS

10. © 2015 Rogue Wave Software, Inc. All Rights Reserved.
Security is hard but it’s important
10
Agile, continuous integration,
continuous delivery
Understanding processes
Educating teams
Implementing tools
Enforcing compliance
Measuring success
Adopting new standards
Systems integrators vs.
systems builders
Multiple development teams

11. © 2015 Rogue Wave Software, Inc. All Rights Reserved.
Who owns security?
11
Security is everyone’s
responsibility
Developers
 Focused on making code
functional
 Meeting deadlines
 Developing code faster
 Security is an
afterthought
IT
 Cleaning up the
aftermath of breaches
 Preventing system hacks
 Creating a safe structure
 Security is a priority
Developers
 Focused on making code
functional
 Meeting deadlines
 Developing code faster
 Security is an afterthought
IT
 Cleaning up the
aftermath of breaches
 Preventing system hacks
 Creating a safe structure
 Security is a priority
Tools
 Automate detection of
vulnerabilities
 Fit into existing processes
 Aggregate reports to see
trends

12. 12© 2015 Rogue Wave Software, Inc. All Rights Reserved.
Understanding vulnerabilities
Klocwork
On-the-fly scanning
OpenLogic
Secure open source
“On-the-fly”
Analysis Build Analysis / Test
Organizations need automation and scanning support

13. Open Source and CVE
The Common Vulnerabilities and Exposures (CVE) system provides a reference-
method for publicly known information-security vulnerabilities and
exposures. MITRE Corporation maintains the system, with funding from
the National Cyber Security Division of the United States Department of Homeland
Security. CVE is used by the Security Content Automation Protocol, and CVE IDs
are listed on MITRE's system as well as the US National Vulnerability Database.
Audit your
code
Review CVE
Monitor &
Remediate

14. Defect reduction efforts
OWASP, MISRA, ISO 26262
See where and how the defects are being reduced
Chart defects and establish a baseline in order to focus
on priorities
Compliance
of standards
Continuous
reporting &
trending
Agile development team: baseline scanning, triage the critical issues first

15. QUESTIONS
dave.mclouglin@roguewave.com
15