36:03This recording is not available yet.
Cybersecurity on a budget: Securing your code and infrastructure for free
Download resourcesAbout this session
Alexandre-Xavier Labonté-Lamoureux, who does cybersecurity in a site reliability engineering team at Ubisoft, presents in French a catalogue of free and open-source tools a developer can adopt when the security budget is not coming, most of them emitting JSON reports to build on. He follows the software lifecycle: code scanners (SonarQube, SonarLint in the IDE, Cppcheck for C++, FindSecurityBugs for Java, gosec for Go), dependency scanners (OWASP Dependency-Check, RetireJS, Snyk, Trivy) with automated updates through Renovate, secret scanners (Trivy, TruffleHog, git-secrets, Gitleaks, GitGuardian) deployed as pre-commit hooks or as a central pipeline sweeping every repository, infrastructure-as-code scanners for Terraform and Helm (tfsec, Snyk, Trivy), scanners for what is already deployed (Starboard and Trivy Operator for Kubernetes images, Trivy's AWS mode as a free stand-in for Security Hub) and API fuzzers, from stateless OWASP ZAP fed an OpenAPI spec to the stateful RESTler that found 28 bugs in GitLab's APIs. He warns that failing pipelines on every critical CVE can block urgent releases and that entropy-based secret detection catches keys that rules miss.
In many organizations, securing a budget to fund cybersecurity is still a problem. Even now, executives are reluctant to fund cybersecurity, seeing it as an expense rather than an investment, despite the fact that cyber attacks increase by 50% year over year and while the media is plagued with reports of newly discovered vulnerabilities and new data breaches. Developers are struggling to ensure that the software that they produce is secure and vulnerability free. What if one of my software dependencies has a vulnerability that I'm unaware of? What if a mistake was made in my infrastructure as code and now I'm exposing a resource publicly on my cloud provider? What if someone has accidentally leaked a secret and a disgruntled employee decides to sell it to malicious actors? This talk will explore solutions to these topics. More specifically, this talk will cover secret management, code vulnerability scanning, dependency scanning, infrastructure as code scanning and fuzzing from a prevention and developer's point of view. The solutions proposed will use free (gratis) software and can easily be adapted to almost any developer's workflow.
Key takeaways
- Run a dependency and container scanner such as Trivy in the pipeline and fail the build on high and critical CVEs, but plan an exception path so an urgent bug-fix release is not blocked by a fresh CVE.
- Automate dependency upgrades with Renovate (or Dependabot on GitHub) with rules to pin code-generation tools such as gRPC and protobuf so generated code and generator stay in sync.
- Keep secrets out of Git with pre-commit scanners on developer machines plus a central pipeline that sweeps all repositories, and rotate any secret the moment it is pushed; prefer tools with entropy detection to catch encoded keys.
- Scan what is already running, not just the code: Starboard or Trivy Operator for Kubernetes images, Trivy's AWS mode for misconfigurations such as wildcard IAM policies and unencrypted storage, and pipe the JSON into Grafana.
- Fuzz your APIs from the OpenAPI spec with ZAP, or with a stateful fuzzer like RESTler that can infer authorization bugs by swapping tokens and IDs between accounts.
Speakers
Alexandre-Xavier Labonté-Lamoureux
Alexandre-Xavier Labonté-Lamoureux is a senior student in Software Engineering at the École de Technologie Supérieure (ÉTS). He is an open-source software advocate and he is volunteering in likely-minded students scientific and technology clubs at… Read moreRead less
Alexandre-Xavier Labonté-Lamoureux is a senior student in Software Engineering at the École de Technologie Supérieure (ÉTS). He is an open-source software advocate and he is volunteering in likely-minded students scientific and technology clubs at his university. He has been involved in the cybersecurity community for more than four years, notably in the Delegation of IT Competitions at ÉTS where he has given many workshops on the subject of reverse engineering. While he and his team have been busy winning 1st place at Northsec CTF 2020 and 2nd place at Northsec CTF 2021, Alexandre-Xavier also likes to design challenges, mostly with the goal of teaching and sharing his knowledge. Some of his recent accomplishments include organizing UnitedCTF 2021 where 230 students were introduced to cybersecurity, presenting workshops at Montréhack, mentoring a Canadian team students who participated to the European Cyber Security Challenge (ECSC) and the International Cybersecurity Challenge (ICC), building the cybersecurity foundations for a DevOps team at Ubisoft Montreal and winning the Cybertalent Trophy from École Cybersécurité for his accomplishments.
