Suche senden
Hochladen
Real Cost of Software Remediation
•
3 gefällt mir
•
2,683 views
Denim Group
Folgen
What is the real cost of remediating software?
Weniger lesen
Mehr lesen
Technologie
Melden
Teilen
Melden
Teilen
1 von 32
Jetzt herunterladen
Downloaden Sie, um offline zu lesen
Empfohlen
How-To-Guide for Software Security Vulnerability Remediation
How-To-Guide for Software Security Vulnerability Remediation
Denim Group
The Self Healing Cloud: Protecting Applications and Infrastructure with Autom...
The Self Healing Cloud: Protecting Applications and Infrastructure with Autom...
Denim Group
Remediation Statistics: What Does Fixing Application Vulnerabilities Cost?
Remediation Statistics: What Does Fixing Application Vulnerabilities Cost?
Denim Group
Using ThreadFix to Manage Application Vulnerabilities
Using ThreadFix to Manage Application Vulnerabilities
Denim Group
SecDevOps: Development Tools for Security Pros
SecDevOps: Development Tools for Security Pros
Denim Group
Managing Your Application Security Program with the ThreadFix Ecosystem
Managing Your Application Security Program with the ThreadFix Ecosystem
Denim Group
ThreadFix 2.2 Preview Webinar with Dan Cornell
ThreadFix 2.2 Preview Webinar with Dan Cornell
Denim Group
Hybrid Analysis Mapping: Making Security and Development Tools Play Nice Toge...
Hybrid Analysis Mapping: Making Security and Development Tools Play Nice Toge...
Denim Group
Empfohlen
How-To-Guide for Software Security Vulnerability Remediation
How-To-Guide for Software Security Vulnerability Remediation
Denim Group
The Self Healing Cloud: Protecting Applications and Infrastructure with Autom...
The Self Healing Cloud: Protecting Applications and Infrastructure with Autom...
Denim Group
Remediation Statistics: What Does Fixing Application Vulnerabilities Cost?
Remediation Statistics: What Does Fixing Application Vulnerabilities Cost?
Denim Group
Using ThreadFix to Manage Application Vulnerabilities
Using ThreadFix to Manage Application Vulnerabilities
Denim Group
SecDevOps: Development Tools for Security Pros
SecDevOps: Development Tools for Security Pros
Denim Group
Managing Your Application Security Program with the ThreadFix Ecosystem
Managing Your Application Security Program with the ThreadFix Ecosystem
Denim Group
ThreadFix 2.2 Preview Webinar with Dan Cornell
ThreadFix 2.2 Preview Webinar with Dan Cornell
Denim Group
Hybrid Analysis Mapping: Making Security and Development Tools Play Nice Toge...
Hybrid Analysis Mapping: Making Security and Development Tools Play Nice Toge...
Denim Group
Running a Software Security Program with Open Source Tools
Running a Software Security Program with Open Source Tools
Denim Group
Blending Automated and Manual Testing
Blending Automated and Manual Testing
Denim Group
RSA 2015 Blending the Automated and the Manual: Making Application Vulnerabil...
RSA 2015 Blending the Automated and the Manual: Making Application Vulnerabil...
Denim Group
Security Training: Necessary Evil, Waste of Time, or Genius Move?
Security Training: Necessary Evil, Waste of Time, or Genius Move?
Denim Group
Running a Software Security Program with Open Source Tools (Course)
Running a Software Security Program with Open Source Tools (Course)
Denim Group
Benchmarking Web Application Scanners for YOUR Organization
Benchmarking Web Application Scanners for YOUR Organization
Denim Group
Building Your Application Security Data Hub - OWASP AppSecUSA
Building Your Application Security Data Hub - OWASP AppSecUSA
Denim Group
ThreadFix 2.1 and Your Application Security Program
ThreadFix 2.1 and Your Application Security Program
Denim Group
Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007
Denim Group
Do You Have a Scanner or Do You Have a Scanning Program? (AppSecEU 2013)
Do You Have a Scanner or Do You Have a Scanning Program? (AppSecEU 2013)
Denim Group
Mobile Application Assessment By the Numbers: a Whole-istic View
Mobile Application Assessment By the Numbers: a Whole-istic View
Denim Group
Mobile Application Assessment - Don't Cheat Yourself
Mobile Application Assessment - Don't Cheat Yourself
Denim Group
AppSec Survey 2.0 Fine-Tuning an AppSec Training Program Based on Data
AppSec Survey 2.0 Fine-Tuning an AppSec Training Program Based on Data
Denim Group
Using Collaboration to Make Application Vulnerability Management a Team Sport
Using Collaboration to Make Application Vulnerability Management a Team Sport
Denim Group
Monitoring Attack Surface to Secure DevOps Pipelines
Monitoring Attack Surface to Secure DevOps Pipelines
Denim Group
Application Assessment Techniques
Application Assessment Techniques
Denim Group
ThreadFix 2.4: Maximizing the Impact of Your Application Security Resources
ThreadFix 2.4: Maximizing the Impact of Your Application Security Resources
Denim Group
Secure DevOps with ThreadFix 2.3
Secure DevOps with ThreadFix 2.3
Denim Group
Software Security: Is OK Good Enough? OWASP AppSec USA 2011
Software Security: Is OK Good Enough? OWASP AppSec USA 2011
Denim Group
What Permissions Does Your Database User REALLY Need?
What Permissions Does Your Database User REALLY Need?
Denim Group
Cyber security - It starts with the embedded system
Cyber security - It starts with the embedded system
Rogue Wave Software
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security World
Denim Group
Weitere ähnliche Inhalte
Was ist angesagt?
Running a Software Security Program with Open Source Tools
Running a Software Security Program with Open Source Tools
Denim Group
Blending Automated and Manual Testing
Blending Automated and Manual Testing
Denim Group
RSA 2015 Blending the Automated and the Manual: Making Application Vulnerabil...
RSA 2015 Blending the Automated and the Manual: Making Application Vulnerabil...
Denim Group
Security Training: Necessary Evil, Waste of Time, or Genius Move?
Security Training: Necessary Evil, Waste of Time, or Genius Move?
Denim Group
Running a Software Security Program with Open Source Tools (Course)
Running a Software Security Program with Open Source Tools (Course)
Denim Group
Benchmarking Web Application Scanners for YOUR Organization
Benchmarking Web Application Scanners for YOUR Organization
Denim Group
Building Your Application Security Data Hub - OWASP AppSecUSA
Building Your Application Security Data Hub - OWASP AppSecUSA
Denim Group
ThreadFix 2.1 and Your Application Security Program
ThreadFix 2.1 and Your Application Security Program
Denim Group
Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007
Denim Group
Do You Have a Scanner or Do You Have a Scanning Program? (AppSecEU 2013)
Do You Have a Scanner or Do You Have a Scanning Program? (AppSecEU 2013)
Denim Group
Mobile Application Assessment By the Numbers: a Whole-istic View
Mobile Application Assessment By the Numbers: a Whole-istic View
Denim Group
Mobile Application Assessment - Don't Cheat Yourself
Mobile Application Assessment - Don't Cheat Yourself
Denim Group
AppSec Survey 2.0 Fine-Tuning an AppSec Training Program Based on Data
AppSec Survey 2.0 Fine-Tuning an AppSec Training Program Based on Data
Denim Group
Using Collaboration to Make Application Vulnerability Management a Team Sport
Using Collaboration to Make Application Vulnerability Management a Team Sport
Denim Group
Monitoring Attack Surface to Secure DevOps Pipelines
Monitoring Attack Surface to Secure DevOps Pipelines
Denim Group
Application Assessment Techniques
Application Assessment Techniques
Denim Group
ThreadFix 2.4: Maximizing the Impact of Your Application Security Resources
ThreadFix 2.4: Maximizing the Impact of Your Application Security Resources
Denim Group
Secure DevOps with ThreadFix 2.3
Secure DevOps with ThreadFix 2.3
Denim Group
Software Security: Is OK Good Enough? OWASP AppSec USA 2011
Software Security: Is OK Good Enough? OWASP AppSec USA 2011
Denim Group
What Permissions Does Your Database User REALLY Need?
What Permissions Does Your Database User REALLY Need?
Denim Group
Was ist angesagt?
(20)
Running a Software Security Program with Open Source Tools
Running a Software Security Program with Open Source Tools
Blending Automated and Manual Testing
Blending Automated and Manual Testing
RSA 2015 Blending the Automated and the Manual: Making Application Vulnerabil...
RSA 2015 Blending the Automated and the Manual: Making Application Vulnerabil...
Security Training: Necessary Evil, Waste of Time, or Genius Move?
Security Training: Necessary Evil, Waste of Time, or Genius Move?
Running a Software Security Program with Open Source Tools (Course)
Running a Software Security Program with Open Source Tools (Course)
Benchmarking Web Application Scanners for YOUR Organization
Benchmarking Web Application Scanners for YOUR Organization
Building Your Application Security Data Hub - OWASP AppSecUSA
Building Your Application Security Data Hub - OWASP AppSecUSA
ThreadFix 2.1 and Your Application Security Program
ThreadFix 2.1 and Your Application Security Program
Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007
Do You Have a Scanner or Do You Have a Scanning Program? (AppSecEU 2013)
Do You Have a Scanner or Do You Have a Scanning Program? (AppSecEU 2013)
Mobile Application Assessment By the Numbers: a Whole-istic View
Mobile Application Assessment By the Numbers: a Whole-istic View
Mobile Application Assessment - Don't Cheat Yourself
Mobile Application Assessment - Don't Cheat Yourself
AppSec Survey 2.0 Fine-Tuning an AppSec Training Program Based on Data
AppSec Survey 2.0 Fine-Tuning an AppSec Training Program Based on Data
Using Collaboration to Make Application Vulnerability Management a Team Sport
Using Collaboration to Make Application Vulnerability Management a Team Sport
Monitoring Attack Surface to Secure DevOps Pipelines
Monitoring Attack Surface to Secure DevOps Pipelines
Application Assessment Techniques
Application Assessment Techniques
ThreadFix 2.4: Maximizing the Impact of Your Application Security Resources
ThreadFix 2.4: Maximizing the Impact of Your Application Security Resources
Secure DevOps with ThreadFix 2.3
Secure DevOps with ThreadFix 2.3
Software Security: Is OK Good Enough? OWASP AppSec USA 2011
Software Security: Is OK Good Enough? OWASP AppSec USA 2011
What Permissions Does Your Database User REALLY Need?
What Permissions Does Your Database User REALLY Need?
Ähnlich wie Real Cost of Software Remediation
Cyber security - It starts with the embedded system
Cyber security - It starts with the embedded system
Rogue Wave Software
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security World
Denim Group
Thread Fix Tour Presentation Final Final
Thread Fix Tour Presentation Final Final
Robin Lutchansky
Programming languages and techniques for today’s embedded andIoT world
Programming languages and techniques for today’s embedded andIoT world
Rogue Wave Software
20th Anniversary - OWASP Top 10 2021.pptx
20th Anniversary - OWASP Top 10 2021.pptx
Dedy Hariyadi
The quality attribute of upgradability
The quality attribute of upgradability
Len Bass
Software Lifecycle
Software Lifecycle
Soumen Sarkar
Embracing the Rise of SecDevOps
Embracing the Rise of SecDevOps
Tom Cappetta
Application Security Program Management with Vulnerability Manager
Application Security Program Management with Vulnerability Manager
Denim Group
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
Aaron Rinehart
Twelve Factor - Designing for Change
Twelve Factor - Designing for Change
Eric Wyles
Site-Reliability-Engineering-v2[6241].pdf
Site-Reliability-Engineering-v2[6241].pdf
DeepakGupta747774
Rolling Out An Enterprise Source Code Review Program
Rolling Out An Enterprise Source Code Review Program
Denim Group
Enterprise Vulnerability Management: Back to Basics
Enterprise Vulnerability Management: Back to Basics
Damon Small
Tell me how you provision and I'll tell you how you are
Tell me how you provision and I'll tell you how you are
Juan Vicente Herrera Ruiz de Alejo
How to achieve security, reliability, and productivity in less time
How to achieve security, reliability, and productivity in less time
Rogue Wave Software
The State of DevSecOps
The State of DevSecOps
DevOps Indonesia
State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019
Stefan Streichsbier
POD-Diagnosis: Error Detection and Diagnosis of Sporadic Operations on Cloud ...
POD-Diagnosis: Error Detection and Diagnosis of Sporadic Operations on Cloud ...
Liming Zhu
Software Security for Project Managers: What Do You Need To Know?
Software Security for Project Managers: What Do You Need To Know?
Denim Group
Ähnlich wie Real Cost of Software Remediation
(20)
Cyber security - It starts with the embedded system
Cyber security - It starts with the embedded system
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security World
Thread Fix Tour Presentation Final Final
Thread Fix Tour Presentation Final Final
Programming languages and techniques for today’s embedded andIoT world
Programming languages and techniques for today’s embedded andIoT world
20th Anniversary - OWASP Top 10 2021.pptx
20th Anniversary - OWASP Top 10 2021.pptx
The quality attribute of upgradability
The quality attribute of upgradability
Software Lifecycle
Software Lifecycle
Embracing the Rise of SecDevOps
Embracing the Rise of SecDevOps
Application Security Program Management with Vulnerability Manager
Application Security Program Management with Vulnerability Manager
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
Twelve Factor - Designing for Change
Twelve Factor - Designing for Change
Site-Reliability-Engineering-v2[6241].pdf
Site-Reliability-Engineering-v2[6241].pdf
Rolling Out An Enterprise Source Code Review Program
Rolling Out An Enterprise Source Code Review Program
Enterprise Vulnerability Management: Back to Basics
Enterprise Vulnerability Management: Back to Basics
Tell me how you provision and I'll tell you how you are
Tell me how you provision and I'll tell you how you are
How to achieve security, reliability, and productivity in less time
How to achieve security, reliability, and productivity in less time
The State of DevSecOps
The State of DevSecOps
State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019
POD-Diagnosis: Error Detection and Diagnosis of Sporadic Operations on Cloud ...
POD-Diagnosis: Error Detection and Diagnosis of Sporadic Operations on Cloud ...
Software Security for Project Managers: What Do You Need To Know?
Software Security for Project Managers: What Do You Need To Know?
Mehr von Denim Group
Long-term Impact of Log4J
Long-term Impact of Log4J
Denim Group
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Denim Group
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Denim Group
Optimizing Security Velocity in Your DevSecOps Pipeline at Scale
Optimizing Security Velocity in Your DevSecOps Pipeline at Scale
Denim Group
Application Asset Management with ThreadFix
Application Asset Management with ThreadFix
Denim Group
OWASP San Antonio Meeting 10/2/20
OWASP San Antonio Meeting 10/2/20
Denim Group
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
Denim Group
Managing Penetration Testing Programs and Vulnerability Time to Live with Thr...
Managing Penetration Testing Programs and Vulnerability Time to Live with Thr...
Denim Group
Security Champions: Pushing Security Expertise to the Edges of Your Organization
Security Champions: Pushing Security Expertise to the Edges of Your Organization
Denim Group
The As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native Applications
Denim Group
An Updated Take: Threat Modeling for IoT Systems
An Updated Take: Threat Modeling for IoT Systems
Denim Group
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Denim Group
A New View of Your Application Security Program with Snyk and ThreadFix
A New View of Your Application Security Program with Snyk and ThreadFix
Denim Group
Enabling Developers in Your Application Security Program With Coverity and Th...
Enabling Developers in Your Application Security Program With Coverity and Th...
Denim Group
AppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation
Denim Group
The As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native Applications
Denim Group
Enabling Developers in Your Application Security Program With Coverity and Th...
Enabling Developers in Your Application Security Program With Coverity and Th...
Denim Group
AppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation
Denim Group
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
Denim Group
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
Denim Group
Mehr von Denim Group
(20)
Long-term Impact of Log4J
Long-term Impact of Log4J
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Optimizing Security Velocity in Your DevSecOps Pipeline at Scale
Optimizing Security Velocity in Your DevSecOps Pipeline at Scale
Application Asset Management with ThreadFix
Application Asset Management with ThreadFix
OWASP San Antonio Meeting 10/2/20
OWASP San Antonio Meeting 10/2/20
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
Managing Penetration Testing Programs and Vulnerability Time to Live with Thr...
Managing Penetration Testing Programs and Vulnerability Time to Live with Thr...
Security Champions: Pushing Security Expertise to the Edges of Your Organization
Security Champions: Pushing Security Expertise to the Edges of Your Organization
The As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native Applications
An Updated Take: Threat Modeling for IoT Systems
An Updated Take: Threat Modeling for IoT Systems
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
A New View of Your Application Security Program with Snyk and ThreadFix
A New View of Your Application Security Program with Snyk and ThreadFix
Enabling Developers in Your Application Security Program With Coverity and Th...
Enabling Developers in Your Application Security Program With Coverity and Th...
AppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation
The As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native Applications
Enabling Developers in Your Application Security Program With Coverity and Th...
Enabling Developers in Your Application Security Program With Coverity and Th...
AppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
Kürzlich hochgeladen
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
V3cube
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
Principled Technologies
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
Enterprise Knowledge
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
vu2urc
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
apidays
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
hans926745
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
DianaGray10
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
wesley chun
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
apidays
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Drew Madelung
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
The Digital Insurer
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
Pixlogix Infotech
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
Igalia
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
The Digital Insurer
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
lior mazor
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
ThousandEyes
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
hans926745
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
Khem
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
Gabriella Davis
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
UK Journal
Kürzlich hochgeladen
(20)
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Real Cost of Software Remediation
1.
The Real Cost
of Software Remediation Dan Cornell CTO, Denim Group @danielcornell © Copyright 2011 Denim Group - All Rights Reserved
2.
Agenda •
Introduction / Background • An Innocent Question • Finding a Structure for Remediation Projects • Methodology • Remediation Data • Analysis and Recommendations • Questions © Copyright 2011 Denim Group - All Rights Reserved 1
3.
Introduction / Background
• Me (Dan Cornell) – Founder and CTO of Denim Group – Software developer by background (Java, .NET, etc) – OWASP San Antonio, Global Membership Committee • Denim Group – Build software with special security, performance, reliability requirements (think “Rugged”) – Software security remediation – Help organizations deal with the risk associated with their software • Code reviews and application assessments • SDLC consulting • Secure development training – instructor-led and eLearning © Copyright 2011 Denim Group - All Rights Reserved 2
4.
Fixing a Cross-Site
Scripting (XSS) Vulnerability How long does it take? A) 9.6 minutes B) 16.2 minutes C) 84 minutes D) It doesn’t matter E) All of the above © Copyright 2011 Denim Group - All Rights Reserved 3
5.
Fixing a Cross-Site
Scripting (XSS) Vulnerability How long does it take? A) 9.6 minutes – Average fix time for stored XSS (no load) B) 16.2 minutes – Average fix time for reflected XSS (no load) C) 84 minutes – Average fix time for stored and reflected (loaded) D) It doesn’t matter E) All of the above © Copyright 2011 Denim Group - All Rights Reserved 4
6.
Fixing a Cross-Site
Scripting (XSS) Vulnerability How long does it take? A) 9.6 minutes – Average fix time for stored XSS (no load) B) 16.2 minutes – Average fix time for reflected XSS (no load) C) 84 minutes – Average fix time for stored and reflected (loaded) D) It doesn’t matter E) All of the above © Copyright 2011 Denim Group - All Rights Reserved 5
7.
Remediation Worst Practices
• When the security team: – Demands a development team devote time and budget to remediation – Provides them with no direction or support – Has the development team attempt to make fixes on their own – Complains when things don’t work out © Copyright 2011 Denim Group - All Rights Reserved 6
8.
Remediation Worst Practices
• Result: No new features and half- or non-fixed vulnerabilities • Good luck getting your next remediation project approved © Copyright 2011 Denim Group - All Rights Reserved 7
9.
Finding a Structure
for Remediation Projects • Desired outcome: predictable and effective remediation projects – Predictable: know how long they will take and how much they will cost – Effective: targeted vulnerabilities actually get fixed • A community of stakeholders – Security – Development – IT Audit / Compliance © Copyright 2011 Denim Group - All Rights Reserved 8
10.
Remediation Projects •
Inception • Planning – Calculate Risk – Agree on Fix and Confirmation Methods – Determine Level of Effort – Schedule • Execution – Set up Development Environment – Fix Vulnerabilities – Confirm Fixes and Perform Functional Testing – Deploy © Copyright 2011 Denim Group - All Rights Reserved 9
11.
Remediation: How To
Guide • Describes methodology for software security remediation projects • Includes tips and best practices • Free online denimgroup.com/howtoguide_download_register.html © Copyright 2011 Denim Group - All Rights Reserved 10
12.
That’s Great But…
• How long will it actually take me to fix my vulnerabilities? • Software security remediation projects are software development projects – So estimate them as such • Best practices: – Bottom-up estimation – Cluster vulnerabilities where possible • It would be nice to have some data to use as a starting point… © Copyright 2011 Denim Group - All Rights Reserved 11
13.
Data! • Took
data from 15 remediated applications • Two types of analysis: – Vulnerability-level (4 applications) – Project-level (13 applications) • Data from Inception and Planning phases was too messy • Data from Execution phase was useable © Copyright 2011 Denim Group - All Rights Reserved 12
14.
The Good (Why
This Data Might Be Useful) • Some data is better than no data – As long as you understand potential areas of bias – Read “How to Measure Anything” by Douglas W. Hubbard • Had relatively large sample size for some vulnerability types © Copyright 2011 Denim Group - All Rights Reserved 13
15.
The Bad (Some
Potential Sources of Bias) • Relatively small sample size • Based on a single project type – Outsourced software security remediation projects • Data required cleanup and normalization • Vulnerability data centered around technical vulnerabilities – Most identified by automated static analysis © Copyright 2011 Denim Group - All Rights Reserved 14
16.
Vulnerability-Specific Data (20+
Sample Count) Vulnerability Type Sample Count Average Fix (minutes) Dead Code (unused methods) 465 2.6 Poor logging: system output stream 83 2.9 Poor Error Handling: Empty catch block 180 6.8 Lack of Authorization check 61 6.9 Unsafe threading 301 8.5 ASP.NET non-serializable object in session 42 9.3 XSS (stored) 1023 9.6 Null Dereference 157 10.2 Missing Null Check 46 15.7 XSS (reflected) 25 16.2 Redundant null check 21 17.1 SQL injection 30 97.5 © Copyright 2011 Denim Group - All Rights Reserved 15
17.
Some Thoughts and
Notes • Apparently deleting code and changing logging methods are easy • Cross-Site Scripting – Vulnerability count tracks with data from WhiteHat, Veracode, other sources – Harder to fix reflected XSS than stored XSS • Lack of Authorization Check – Fix consisted of copy/pasting file include into a number of files • SQL Injection – Surprisingly high – Reason: fixes were for more complicated SQL injection vulnerabilities © Copyright 2011 Denim Group - All Rights Reserved 16
18.
So If I
Have 6 Stored XSS Vulnerabilities… … my remediation project should take about an hour, right? But wait! © Copyright 2011 Denim Group - All Rights Reserved 17
19.
Remediation Is Not
Just About Coding Fixes • This data is from one of four steps in one of three phases – “Fix Vulnerabilities” step in the “Execution” phase • What about Inception and Planning? – No great data available yet • What about the rest of Execution? – Set up Development Environment – Fix Vulnerabilities – Confirm Fixes and Perform Functional Testing – Deploy – Overhead © Copyright 2011 Denim Group - All Rights Reserved 18
20.
Where Is Time
Being Spent? 70% Indicates the weighted average versus the average of 60% 59% individual projects 50% 44% 42% 40% 37% 30% 31% 28% 29% 24% 24% 20% 17% 20% 15% 15% 16% 10% 9% 3% 2% 0% 0% 0% 0% Setup Development Fix Vulnerabilities Confirm Fixes / QA Deploy Overhead Environment © Copyright 2011 Denim Group - All Rights Reserved 19
21.
Some Thoughts and
Notes • Setup Development Environment – Best case: existing development environment or VM – Worst case: Safari expedition to recreate environment setup because organization no longer had this knowledge • Instructions on setting up a development environment were a deliverable • Fix Vulnerabilities – This is what people focus on but there is wide variation © Copyright 2011 Denim Group - All Rights Reserved 20
22.
Some Thoughts and
Notes (continued) • Confirm Fixes / QA – Sometimes this took more time than the actual fixes – Best case: Existing set of automated functional / regression tests • Deploy – Best case: use an existing planned release • Overhead – Surprisingly high in some cases © Copyright 2011 Denim Group - All Rights Reserved 21
23.
Using the Data
• I thought you said to estimate bottom-up? – Yes. Do that – Use the vulnerability data as a guide for estimation – Use the project composition data for validation – Use the lessons of the data to try and minimize required investment © Copyright 2011 Denim Group - All Rights Reserved 22
24.
What Can I
Do To Minimize Remediation Costs? Avoid introducing vulnerabilities into your software (you are all welcome for this piece of sage advice) © Copyright 2011 Denim Group - All Rights Reserved 23
25.
What Can I
Do To Minimize Remediation Costs? • Have ready access to development environments for the developers doing the remediation • Automated functional / regression testing helps speed security fixes • Use planned deployments when possible © Copyright 2011 Denim Group - All Rights Reserved 24
26.
Which Vulnerabilities Get
Fixed and When? • Use your data-backed, bottom-up WBS for risk management and planning • Serious vulnerabilities that are easy to fix? Consider an out-of-cycle release • Otherwise leverage planned releases © Copyright 2011 Denim Group - All Rights Reserved 25
27.
The Outlier •
We remediated one vulnerability not included in the study that was more expensive to fix than all vulnerabilities in the study – Authentication issue in a connected system • Requirements and architecture vulnerability – Automated scanners – static or dynamic: powerless to find it • Should have / would have been caught by even a basic threat modeling or abuse case session © Copyright 2011 Denim Group - All Rights Reserved 26
28.
So Where Does
This Leave Us • Good: – We have a framework – We have some data • Less good: – The data comes with a number of caveats • Given a framework and some data you should be: – Better able to execute successful projects – Better able to estimate projects – Better able to minimize project costs © Copyright 2011 Denim Group - All Rights Reserved 27
29.
Next Steps For
Me • Release a more in-depth report • Include more data in the analysis • Perform deeper analysis – Impact of size of project (hours) – Impact of number of vulnerabilities remediated – Impact of platform – And so on… • Include data on logical vulnerabilities © Copyright 2011 Denim Group - All Rights Reserved 28
30.
Next Steps For
You • Review your existing vulnerability data • Create a “back of the envelope” plan to address open vulnerabilities – Run different scenarios: “All critical and high” “All public-facing apps” and so on • Talk to developers – How do they set up development environments? – When do they do planned releases? • Fix some vulnerabilities! – Application-level vulnerabilities persist for a long time © Copyright 2011 Denim Group - All Rights Reserved 29
31.
Remediation Resource Center
• Resources for remediating software security vulnerabilities – Videos – How-to Guide – Blog posts denimgroup.com/remediation © Copyright 2011 Denim Group - All Rights Reserved 30
32.
Questions? Dan Cornell
dan@denimgroup.com Twitter: @danielcornell www.denimgroup.com blog.denimgroup.com www.denimgroup.com/remediation (210) 572-4400 © Copyright 2011 Denim Group - All Rights Reserved 31
Jetzt herunterladen