Michael Kaufmann: From Application Security to Developer Security

In this talk, Michael Kaufman discusses the critical shift from application security to developer security, highlighting the importance of integrating security earlier in the development lifecycle, often referred to as 'shifting left'. He emphasizes that security practices are often under-adopted within development teams despite the rising costs of security breaches. Drawing parallels between historical medical innovations and security practices, he illustrates the challenges of integrating security tools seamlessly into developers' workflows. Kaufman also provides insights into developer attack vectors including social engineering, typo-squatting, and malicious code in dependencies, using the infamous Event Stream incident as a case study. He advocates for greater awareness of security tools and practices among developers, particularly through hands-on exercises, training, and the use of advanced security tools like GitHub Advanced Security and CodeQL for automated code scanning.

[Music] ladies and Gentlemen please welcome our next speaker Michael Kaufman presenting the topic from application security to developer security shift left with GitHub Advanced security well if I talk to my clients about security then everybody is is aware that that security must be a high priority right and that's that's really obvious if you look at the numbers from the last years um these are the official losses

reported to the ic3 ic3 is the Department of the FBI so these are the official numbers in the US and you can see in the last two years the losses basically doubled and are now at 12.5 billion doar a year and this is just the official numbers if you imagine what else is there that is not reported I mean this are huge numbers and that that's why

every customer also in a lot of studies and and um everything security is always a high priority but if I work with developer teams and and devops teams that maintain and run applications looking at how well integrated are security practices there I don't see a lot of things right so so the adaption from security practices that I would say are state-of-the-art are still very low in the

field and the question is why is that and I have one comparison for you and I want to compare it with uh two ground break breaking inventions in medicine in the 19th century and they're both on this picture picture that you hopefully see um every moment um are the two ground breting inventions and that is anesthesia and antiseptics so anesthesia was first discovered in 1846 and with

the laser and it was used worldwide within one year right and um a few years later it was ubiquitous and like everybody used it if you compare this with an antiseptics this was very divisive and uh 20 years later it was still only half harded implemented uh in in in most countries around the world but it's now also considered the foundation of of of modern medicine so

what made these two inventions so different what what made the adaption so different right and it's also in the picture you cannot see the picture now um I hope this will change um no if not I I would just skip it I hope there are not more pictures okay so there's a picture you see it here in the background so that man in the middle that is

a surgeon and then on the right side you see this machine this is antiseptics so this started with a machine that created a lot of vapor and on the other side you have um anesthesia right with with deal ether where your your patient will just be rendered unconscious and if you imagine this from the standpoint of the surgeon right for a surgeon if your patient is screaming

and moves so that's not a good working environment right so um anesthesia really makes your working environment much better and um antiseptics was this machine it was you could not see well so this made your working environment worse and who decides or or who has a big influence on the adaption of new invention that's the surgeon that's the main actor here so if I compare this with

um def Ops and security right um an athesia is stops so we make the the world of developers better we help developers to be able to deploy on Friday and still go home with a good feeling we help them through automation automated tests that makes the life of a of an engineer much better but security is like antiseptics it makes noise it's not integrated in the process

we have separate company reviewing our code uh then it's already deployed to production and we get a big big Exel with a lot of findings some of them are related to the architecture it's really hard to change them so it's it's kind of pain and that's why developers sometimes refuse it right so they don't like it and they do it because they have to but it's not

ideal and I think that's that's the reason right why security is not yet as adapted as other leops practices so okay short introduction who am I uh Michael cman I'm the managing director of cban Germany uh we're a consulting company we help our customers uh with devops with um yeah implementing new engineering techniques with shifting left uh on their way to the cloud um I'm in industry

for yeah more than 20 years um doing devops or application life cycle management like we called it in the early days for more than 15 years or nearly 15 years um wrote some books about it and uh yeah regular speaker on some conferences I'm a Microsoft MVP Microsoft party and yeah happy to connect uh I will be later at to ask me anything um corner so step

by and happy connect this a message working yes um I just discuss discussed it here before the talk um if we talk about security and incidents uh there's still one big problem in our industry and that's that's that's a big misconception and that's that's from the movies right if you look at hackers in the movies you always see a guy normally with a hoodie and he's typing

very fast in a terminal with green uh things and then you hear them people saying things like oh I hacked the third firewall and I cannot get here they keep changing the IP address and like what the that's not how hacking works right if you ever debuck or find try to find a buck in a software you're probably more likely to to look like the second guy

and you read a lot you you do open security information uh research and and it's not hacking in a terminal it's just has nothing to do with it but that's why a lot of people they don't dare to speak about security because they since I cannot hack it's a skill I don't have I don't want to talk about it but that's not the case right like everywhere

in the in in engineering we have our special skills in some things and some skills we don't have but we could acquire them right so if you want to learn to hack a thing you can learn that skill it's not so difficult but this misconception how people get hacked um lead also to a lot of misconception how the entire thing works and I really like that here

how people think they get hacked right so by the hacker that is sitting there and typing very fast and they really get hacked this for example here this games in Facebook where you expose personal information that then can be used to for example reset your passwords and to set the scene for the talk I want to talk about a real incident and the problem with incidents is

that they're normally so complex that they're really hard to understand but if you talk solar wind or something that's so we don't even know yet where it started then we have some information but it's very cloudy and then it gets really complicated so I want to take one which is very simple but really shows well how an attack can be orchestrated and what I want to talk

about is the event stream incident and event stream was a very popular npm package the incident happened in 2018 some years ago but I think it really shows the story very well so event stream was a very popular package millions of downloads and like every so open source package at the beginning the maintainer is really happy right wow my package has a lot of success and at

some point they realize this is a lot of work I don't get paid for it I get hundreds of issues every day everybody wants something from me and I really could need help and one guy offered help and that was a user called right n control and he helped rearing issues he helped created some pool requests and it was over a month and uh he gained the

trust of the maintainer so event stream was used in many many packages and many many applications and one of these applications was called copay copay was uh was an open source wallet for for cryptocurrency and copay was attacked so many times in in many different ways it's now called bit pay uh it's still out there but it's called differently so copay was U yeah a user of

event stream uh right n control gained the trust of the maintainer and at some point was given right access to the event stream repository so what did right and control do he would introduce a new dependency to a package called flatmap stream and a package was new one it has just one uh commit in GitHub it was it's just one version on npm and the community was

was asking questions right the community of Eng stream why do we need this package can we write this code on our own it's not very complicated and right n control directly reacted he removed the package and updated the version to 4.0 so to a new major version so if you as a client from event stream would directly update your dependencies to the newest major version you wouldn't

have have been uh impacted by the flat stream malicious code That Was Then introduced right um but of course people don't upgrade right away to the latest version and um that's what happen so the flat map stream uh package got a new version and the way versioning works in npm you would already uh always get the newer version if you if you build it and the new

version had malicious code and the malicious code would directly check is the client running in copay if yes it would decide on some things uh then then it will look how many Bitcoins are in the wallet if it's more than 100 Bitcoins it would Harvest all the Bitcoins upload it to an control server together with the private keys and uh that's it right you can imagine 100

Bitcoins is a lot of money so it's worth investing a few month Social Engineering like n right right n control did um and you can make a lot of money with it and I really like this incident because it really shows how things can can happen in in in in a time frame right it starts with social engineering attack uh then you attack the supply chain so

you do not directly ingest malicious code into the software itself you're just in just one new dependency and then at some point uh you you at the dependency and then people do not talk about it because you already upgraded it you removed the dependency but of course your your dependents they still get the bishes code and that really shows how how you have to think about security

from a developer perspective right um there are a lot of attack vectors uh the developer can be attacked through social engineering the development environment can be hacked um the source code of course if you can inject something there one line of code basically can can yeah remove a lot of security it can for example yeah remove authentication requirements for parts of your website um the build system

can be attacked like in the solar wind incident the package itself can be tempered uh deployment consumer and so on but the biggest part of the biggest risk are the dependencies and if you look at today's applications every dependency you introduce has its dependencies on its own and these have dependencies and these have dependencies so it's a big tree of dependencies it's thousands of dependencies with just

one package what you see here is a visualization of Gatsby so if you um install gby this is the tree of dependencies you get and I play this visualization in 10 times uh faster than it normally would be because it's so many it's a 2,000 and something and like every dependency in Gatsby here has the same attack vectors right so you cannot just attack the the application

you want one of these dependencies industry you can attack looks strange okay you can detect the developer you can attack the development environment the package and so on yeah and uh this is also something you have to take in mind that that these are attch vectors in every dependency you have brings other dependencies and they are potential attack vectors for application so what we're trying to do

is shift left security because fixing security bug um has different costs at different stages so I know you can really argue about these numbers and uh I I have the source here but I've seen it in dollars and Euros I I think the absolute number here doesn't matter but if you fix a security bug during development it basically cost you nearly nothing right you fix it and

that's it if you fix it after deployment to a test environment or while already uh manual tests are running on it or something it cost you a lot more if it's in production it can lead to millions and that your company gets bankrupt right so this costs in mind um the more you shift left um the cheaper is security for you and a lot of times I

I have discussions with customers about um pricing costs for security tools and it's always like okay have you considered what a breach will cost you and then normally the discussions are over so security costs money uh if you want to do it right in a productive way um but it will also save you a lot of money one moment so let's start with developer security um so

how can you attack developers right we've already seen um the social engineering but there are more things that you can do to to attack a developers and um I made up this one quote here I think a developer is just a normal employee that is normally local admin runs unsecured web servers and um has access to a ton of other systems and a lot of people come

up oh I've never thought about this way right um if I talk to administrators they always know that they're a target of aex right and and they will for them it's natural if they do administrative tasks they they log with their admin account and then they log out they don't work all day long as as domain admin on their laptop and and read emails for a lot

of developers that's not the case any here a few um leave the hand up uh if you work as local admin some don't dare yeah see yeah on on on security conferences it's normally no no no we would not do this if I see the same person or developer conference and like all people have their hands up they're like yeah yeah also work as Lo so it's

it's it's getting less but it's still a lot of developers are local admin and they normally work all day long on the machine where they have their Outlook where they open their email and they're local admin and uh that's just they don't think that they get attacked because why would I be attacked I'm a developer um but there are right so and uh I will show you

right away what you can do um social engineering and fishing fishing is uh a really big topic and I really want to stress this because mostly also developers they hate fishing simulations they say ah I'm good I know what fishing mes look like right so I know that and um I I worked for another company they did fishing um simulations and I started there with a big

team of nearly 30 people and they hated it I know what fishing is and in the course of two years like nearly everybody in the team would would at least once accidentally click on on on a normally simulation M you can see here two fishing males one is real real deal and one um is uh simulation from the company and um the number of fishing ma reported

really went up right if you do simulations their reporting will go up and what what especially Engineers often forget when they think about fishing that in theory if I give you two Maes and I ask you is this fishing or not you can tell that it's fishing but if you're are in a moment uh that you're are primed that you're expecting an email that you have some

urgency in that case you you you you lower you're not looking for this signs you have you're not looking for the URLs right so if you just check your B bank account at the end of the month and your salary is not yet there and you get an email from HR that says hey we have a problem with your salary then then you're just expecting this email

in this moment you will not check you maybe just click on it and then you think oh I didn't not check it or in the morning you log in you have problem logging in and now you get an email that says we have problem logging you in and you might just expect it I was on a call with a colleague from another unit and he was like

oh I'll send you the file and I got this SharePoint something uh file and I clicked on it because I was said what what tool and then of course I did not enter my credentials I reported the fishing but it was a real fishing that I received but the moment you are primed and the moment it is urgent you lower your your your defense I would say

and it happens that people click on it so I really advise you do fishing simulations people will hate it but people will get better they will create awareness and they will report more and less but besides fishing there are other things how you can attack developers there's something called typo squatting or form of it is namespace shadowing so if you're developer and you type on type in

your console npm install cross n or npm install cross minus n so the second one is the real deal this is what you want the package cross minus n that will help you with environment variables but the first one will steal all your environment variables and upload them to a control server or the same with namespace shadowing where you would just forget to enter a namespace right

so the normal package lives in the namespace aure and the other one has it not and of course npm here fights to get out this malicious packages but sometimes you have 400 packages a day that get uploaded so this is like a a really uphill battle so if you don't have measures in place to find these dependencies that can be a real problem and it's not just

attacking developers to install time where you upload your for for example all your environment variables or check for Secrets around some of these packages we just add the other dependency as a sub dependency we just forward all the calls to the dependency and then lie there in a package and wait until they're at the client right so they they they can they live there and if you

don't have a package or something that scans the dependency and say you have a problem here you might not even know it so you you added a dependency to cross and or something it will just do what it's supposed to do and at some point it can yeah act malicious um when it's already installed in a user application I asked some some developer colleagues and say hey

send me some examples for secrets you are using in your day-to-day life and like everybody sent me something um so if you're not having secret somewhere as a developer you you're either not work you're just working with local applications that don't have even a database or uh you don't do test automation so the moment you do test automation you have test accounts and you have secret somewhere

that you have to enter and if you work against an API you need tokens so if you look around at a develop a machine there are a ton of secrets that you can steal right hopefully it's just on the machine and it's not in the code but uh it's there so so attacking a developer will give you a lot of uh yeah secrets that you can use

then to attack other things and that's that's why we really have to make engineers and developers aware that they're a target of attex so what can you do with the credentials of a developer um you can do spare fishing right so if you have the real credentials of a developer and can send emails in his name if it will come from an engineer people are much more

likely to open attachments to click on it because this is is a trusted uh person right and you might send something to an admin who thinks oh it's come comes from a developer I can open it um you can log on to machines a lot of developers have access to test machines um a lot of test machines still today are in the same domain as a production

domain so you log on also an administrator locks on if it's not the newest patched machine you can use a tool like MiMi cuts to read passwords even from other persons and then you have the admin password um you can inject code you can execute code on on test machines on build scripts you can modify the pipelines um you have access to test environments and sometimes even

BR right then you have access to BR then basically game over and a certain attacker you have achieved your goal um this is a screenshot of mimik cuts anybody knows mimik Cuts some people do I really advise you to try it out and it's not just if you have the newest patched Windows ver it will not show you passwords from other windows accounts that are logged in

on your machine but you will still get a lot of clear text uh tokens from GitHub from gitlab from office um a lot of clear text information and on not patched machines that I have not uh that are not maybe that are maybe a few years old you can get really clear text passwords from all other users that are logged into the machine right so if you

have a test machine which is not the latest version from Microsoft patched and an administrator is logged in you can log in on them same machine and then you have the password of the domain admin and I think this is the the thing that also developers have to learn about security that attackers do not think in lists they they think in trees and um the way that

you can come from from one account or from from from credentials that you find somewhere uh there's always a way to get somewhere right so for example you find test accounts uh documented in in a text file that are used for automated tests they can be used to log into a development machine where also here the developer mka has uh access so you can mimik cards get

his credentials log into a test machine where he's on and on this test machine you have domain admin Lisa and then you have Lisa's credentials and you can log into production right that's why you should always separate domains for test and production and not have the same domains um accounts because this will then pollute your production um and there are a lot of tools that help you

with this for example Blood Hound so Blood Hound you can just run it in your ad environment and it will just um say yes to everything and then create a big craft how you can navigate from one node so you will get all the computers all the logged in all the accounts who is logged where and this way you can like create your tree how you can

navigate to a system and there are a lot of other tools that you can use to get the first step right one is finding credentials one is social security one is fishing um this responder that you can run in your network that will just respond with yes to all login requests and if you have weak passwords you can just brute force them and get the password out

of it um you have devices like pineapple where where uh machines log in so so there are lot of Entry levels but the thing is once you have the credential what what then so um what to do right so um you should do security awareness trainings with your developers there are some games that you can in in your Sprints that you can have execute them or or

play them at the end of the Sprint and uh of course fishing simulations we talked about that that's like a must do for me um but I think the best thing you can do are catcher the flag events or red team blue team simulations and they still have a I wouldn't say a bad reputation but they have a reputation that they're only for the big companies right

we are not Microsoft we cannot do red team blue team exercises and I think that's not true I think um if you have develop and you just just think about it what would the developer more like to do filling out a spreadsheet with risk factors for the application or doing a hackathon where they try to attack their own application and I think the answer is really easy

right you you have some developers you say hey attack your own application and then you have another team and say hey protect it try to find out that you get attacked and they will have a lot of fun and you can add some consultants and some red team support at the beginning if you need it but normally if you're the developer you know your system you know

how to hack it right so if you really think about it um they will find a way even without help give it a little bit help and it's more fun of course you need a lot of um rules around it right so you cannot put real information on the internet you don't want or unsecured on the internet you don't want to um put your production system down

so you really need a rules here that uh allow you or that tell you what to do and what not to do in the simulation but this kind of hackathon they're a lot of fun and they will create a lot of awareness and they will really teach the engineers how to think as a attackers so this is really like uh yeah give a man a fish or

or teach uh teacher how to fish right so this really teaches developers to think like attackers and and brings a lot of awareness and security into their life um one topic I really want to highlight also are virtual development environments because virtual development environments this is for me the perfect and I see right so this is something it it brings so much security because it will remove

this I work as a local admin from one day to the other you don't need to be in local admin if you have virtual development environments and uh it makes you not just much more secure but also much much more productive so GitHub itself they uh built GitHub on COD spaces and they created code spaces because GitHub is is a big monolit right and it's it's a

big mono repo and just foring this repo was was a very long process in installing this was all Mac based installing all the tools on Mac it was like hours to days until a new engineer could start writing the first line of code for GitHub now they have code spaces um they have pre-built images with sparse check out and and people will just download the image and

they can work in in in seconds basically yeah or maybe minutes but really fast so this really is a production booster you don't have to care about local tools installed you always have the right configuration with the right version in your virtual environments if you're Morrow windows uh guy there's also deathbox which is the Microsoft product which is more wish Studio focused and there are other tools

I'm not caring about the tool itself but um having Project Specific or product specific virtual development environments makes developers much more productive if they have a config as code that that developers can share that their tooling with a team at least most of the tooling are the most important one it makes the entire team more productive and it makes you more secure because developers are not local

admins anymore so developer security let's shift over to code security that's what people always think about right if we talk about death Ops or our shifting death security uh that's the code how do we get the code secure so most um vulnerabilities or the average availability is 4 years in code until it get detected and lock forj was around in the code for seven years until it

got r um detected and and and used and that's the reason why you should always scan your code even if you don't touch it um at some point with new queries because when lock for J was found it was only half an hour later there was an cql query on GitHub that could help you find it and I think a few hours later there was also a

variant analysis that would check your code if you did the same um mistake then look for Jed so if you're also vulnerable to this um XML injection in that case and there are a lot of other um code scanning tools out there right so um code ql is just one of them I just want to highlight this a little bit because it's the native uh GitHub tooling

here it was acquisition it was called sem and GitHub acquired it some years ago and it's based um from a company that was founded in Oxford and it was like um yeah 30 people that worked there many many years on that so this is really not not something uh this some something theory is why and I think the real power of code ql is um that it

combines the the the the the good engine of code ql with the open source Community right and if you compare what code ql can find cves compared to other tools and of course every vendor will tell you will show you other graphs where they are in the front and the others not I'm not saying that um gab is so much better than the other ones right you

probably find other things but I think at the end it's not what you find here in in this case you could see that they find everything is an API and and open themselves for all Partners so if you go into GitHub and you click on new workflow and you pick security you will find a ton of other tools that you can integrate there's verac code there's sneak

there's like like every security tool that creates sarif and sarif is an open standard for uh code analysis results so every tool Sona Cube can be integrated the same way you can integrate Sona uh code ql in this case right and uh that's really cool and you can not only use code scanning tools you can also use infrastructure scanning tools and integrate them the same way because

you probably in your repository there's also infrastructure as code there might be terraform there might be bicep there might be kubernetes uh there might be Docker and all of these tools can also be analyzed right so for example you can use anchor or CLA if you want open source tools you can use wi Source Aqua or whatever Tool uh to do container security and they will integrate

the same way into GitHub Advance Security like the native engine does and not only container other infrastructure uh I've seen the talk before the question was Hey how do I detect um um a public S3 bucket and there's a cool open source to it's free it's called checkoff it comes with around 1,000 outof the Box rules for AER for AWS and one of them is finding public

as three buckets you can see here on the right side and I think Now the default is sarif so the first uh I think it was a put request from me I'm not mistaken um they supported sarif but it was not the default um and you could just upload in the sarif file to GitHub and it will show up the same way it does in your pull

request so if you create a new S3 bucket in terraform and it's public uh you will get a warning and you cannot merge your Port request so it's a really great integration so I have one very small demo because we still have something to cover and that is just the the P request integration of code ql right so this is a put request where I added one

line let's go here to FES changed yeah internet is and you can see here right this is the line I added it's eval this code and um we get a warning that says o code injection this code execute depends on user provided value and I said developer I like really why and you can click here on show path and you can see how code Q works so

you always have a source and you have a sync source is where the data comes from user input file something and the sync is something that happens here for example the execution and you can see the source here is window look location search and it's developable yeah yep that's something the user can enter and enter and then you can see how the data flows through your application

so in this case it's not a lot and here is the sync and here it gets executed and you can see on the way how your data travels through your application that it's not sanitized and that there's no check um for um yeah for special characters so you might um add here code that gets then executed but GitHub will not just show you the way travel through

you will also you can also see um the query if you open the alert um you can learn a lot about the event but the best thing is you have now autofix and here GitHub leverag the power of cql combined with co-pilot so co-pilot said oh Yep this is bad code let me think how to fix it and it rites a lot and you get a warning

this is still beta and be careful and uh look at it but it will give you here the fix for the problem and you can click commit fix and it will directly fix this issue for you right so anytime you have something in a pull request uh co-pilot is there and tries to help you how to fix your issues so this is security Hub here you can

find all code scanning alerts I just one and I just wanted to show you here how you can see right there's a lot of documentation uh the queries are open source you can look at them you get a lot of recommendation so it's a really good documentation compared to other systems in my opinion that developers can work with right so developers know why this is a case

because they know how data travels through the application they can see where the data was assigned to and how it is traveled and why it is an issue and they can read here a lot of information how to mitigate the issue so um yeah I think that's enough for the demo along side so of course there's a lot of lot to talk just about cql how you

can configure it how you can write your custom queries um but I would move on rather to the other topics we still have two topics to cover and only a few minutes um secret scanning so if you look at the leaked secrets in public repositories you can see that the numbers goes up and up and up and up and it's still if you continue There new data

it's it's still growing and that of all the the security features I show you today they get up Advanced security um you have to pay a lot of money if you're an Enterprise and they're free for open source so for all your public repos you can just enable it and still there are a lot of secrets in there and uh if you look at incidents I think

in 95% of all incidents at some way in their Tech chain there is a secret leak right it might be on developer machine it might be on SharePoint it might be on on a file share but at some point in the attack there's a secret leak because a secret is somewhere and you should automate that right there are a lot of tools um if you don't have

giab Advan security there's Kitty leaks spectral Ops skit Secrets Whisperer a lot of tool tools that can help you if you still have file shares somewhere in your Enterprise you might use bash Powershell and some RX to to to automate something of that or use dumpster dumpster is a tool for that um but giab Advanced security has least a good solution for your code and what they

do is they partner with um with providers they have now I think over 80 providers right Asia AWS Google Hashi cor all of them and a lot have changed how these companies treat secret so in the past it was always just a long string with some characters and you've seen now more and more prefixes and often it's just prefix and a control number at the end of

course you don't know that but but they can calculate ated and and gab will work with a partner because having just a string is security by obscurity right it's just you have a key and the attackers they have time time is the one thing that is normally not the issue and they can provide all doors uh Pro try all doors um but for an engine to find

something it's much harder if it's just a string this way GitHub can determine right away and and the number of false positives they they have really trouble it's really low and um in public repost it's that GitHub will directly send the secrets to the provider so they have to implement an an an API endpoint so they will send it there and it's up to the provider to

revoke the secret or do whatever they want for private repost not for private repost the default is they will not send it out you will get an alert it's up to you to revoke it it's up to you to decide what you want to do with it um but you can opt in and say yes please send all my secrets to the provider whatever it is uh

for verification or you can manually um send individuals Secrets there so that's a really good thing to have a very confidence about secrets that they're Secrets um GI up um Advanced security also allows for custom patterns so there are patterns for example if you have um yeah spring boot or Oracle databases connection strings you can also search um by by having real complex um Regular expressions for

for old passwords or more like uh connection strings and and with the prefix and and postfix of this secret so um you can also customize this very well to your on Prem environments to supply chain security um I think it's the most important part and then I can talk about hours for that um but it's also a little bit a boring part um because it's very much

into the details and um I think the important part is you need it right so there's no way around it um and in get you have the dependency graph and on top of this dependency graph you have depender Bo that automates the update process and it can automate um update of security um fixes but it can also update like all updates so so normal major version updates

minor version updates as you can automate this uhon here there are other tools you can also use anchor you can use dependency track um a lot of these tools work work the same way um so in GitHub you have three features basically you have the dependency graph which is the underlaying thing that constructs how your um dependencies your dependency tree is built and then you have depender

board that goes through it and looks for vulnerabilities in the tree and will alert you and you can configure if you want this alert daily right away once weekly digest you can really configure this and then in the update you could click on give me a fix and dependa would would create a p request that you can then merge and it will be updated to a nonvulnerable

version but if you enable security updates kab will regularly check and will automatically create P requests for you the next step is then version updates you need a config file for this and you have a ton of options here you can exclude versions exclude packages exclude major versions and uh this will also give you put request for normal uh normal updates and you can group them together

so that for Yan updates you will get only one pull request that will update all your your dependencies in one go and yeah if you have the put request you don't have to worry about it right you don't have to update it yourself if the underlaying file changes so um dependabot will take care of this and you will communicate with dependabot through comments in the put request

right so you say at dependabot merge give a comment and depend on what says yes I merge it and we'll merge it if there's um an underlying change of the get dependabot will automatically update uh the source Branch for you and you still can merge it so it's a really easy process and really reduces the time that developers take to update their dependencies um that's a quite

new feature which um you can export um a software bill of materials from the dependency graph right this is just uh the stateof quot of all your dependencies in a file and you can sign it so this way you can attach your your sbom your software build material to your package you can also package assign your package and uh this is a requirement for example for for

public customers in the US you always have to provide an es bomb if you deliver software and this way you can also sign it and have a proov that nobody tempered with your es bomb and nobody tempered package so and that was the last slide and now I have the image from before that you cannot see still um and uh yeah I I hope I I could

uh move a little bit uh the the security part from being like the um like the antiseptics to to Anesthesia right to make it a little bit better or to get an understanding so how can we integrate this with a developer first mindset um using virtual development environments doing exercises for developers like awareness trainings or red team blue team simulation and providing the the tooling for automating

dependency management and code analysis and and and secret scanning so that this is all baked into the process so thank you very much and um if you have questions now would be the [Applause] H slight is sound there okay um should we first to the room or I don't know if we have a mick that's one question uh event stream the event stream okay okay so the

question is um will would have GitHub did detected it and would help against the the incident yes and it would because the moment that flat map stream had the vulnerability um it was reported to The giab Advisory database and dependabot would have said you there's a dependency in there right so and you would get the alert and you could fix it so it would help you by

just surfacing uh the the dependency um let me see do you see any other way to secure developer machines except CDE how to deal with developer needs to be able to install various helper productivity tools um yeah I think that's the the perfect thing for for virtual environments and this can be local this can be in the cloud um I'm a big favor of the cloud because

normally internet connection is not an issue today and um I mean problem is still if you're Windows space then you need a Windows machine but uh I tried death box lately and it's really awesome I was really impressed how fast it is so this is really optimized for also running Visual Studio it's probably very much for net developers and your Java is like I need a Clips

I've not tried that but the box was really really fast and you can completely customize it it's really like your own development environment you can install all your tools you have a config file so you can share the config um with your other developers um but uh yeah I think that's the best way for me to be productive for developers and um and still be more secure

I think being local admin on a machine where you read your emails where you do your teams and you open all your files that's just not a good idea and you need something to fix that if you can work with locally without admin rides okay but still installing all the tools on your local machine is also not a productive way right having a container having a virtual

machine is just more productive in the long run and Hardware is not the bottleneck and network is not the bottleneck right so that that should be always you can containerize it locally you can have a VM locally but you should have some form of container that you use to develop does dependabot deal with a maven ecosystem and Gradle project yes it does not as good as with

other languages so a lot of packages are supported like stb for example for Scala and and also for Java it is supported but not natively so you need a build and in the build you have to like uh run uh the tool and then upload the results there's a native GitHub action so it's really easy to implement it but there's one step more you have to do

compared to npm new get um I think Maven is supported fully and I think gradal or one of the other I'm not 100% they're both supported but you have to do some something in a build that that will update the uh upload the results next question how code ql compares to sonar Cloud are they similar tools or different tools for different purposes well there there are different

tools for different purposes I would say so Sona cloud is a really good tool and especially you can use both right sonar Cloud uses sarif so you can integrate the results also in advanced security um I think the the findings from cql are more accurate you have less false positives um but you have less supported languages so for example if you use cobal cobal is only Sona

Cloud we don't support C cobal In One Security I'm sorry so that's for example a reason I have customers that use sonar cloud and and advanced security but I think the the the queries are more powerful in the cql engine but I'm I'm maybe a little bit biased so you have to compare it but I think um sonar cloud is more about code quality and code ql

is more about code security I would say and both can both so code ql does also do give you quality checks and so clock giv also security but I think one is more for security another a little bit more technical attemp are there any tools to detect application architecture level security um that's a difficult question um I think there are some tools not in the GitHub ecosystem

here here I would say code ql detects some of it so as it knows the flow of the application right so it it creates from your code a database and not just the syntax tree but also the data flow tree how the data flow through application it can detect patterns that are bad because it's normally related to that right you have the flow of data and some

somewhere in there is something but it's not specialized on that and I'm not aware of 3D tools because it depends how do you AR how do you document so so if if it's uml what tool do you use and I'm not aware of a good tool I would recommend here I think architecture is still something that you probably have to do manually that's my my take how

good is depender Bo in terms of not suggesting updates to versions that contain malicious code that's very good and uh I have it actually in My Demo I didn't didn't show you because there was a little bit were short in time um there's a action in GitHub action that is called dependency review you implement it and uh it will check and give you an an open sff

score and it will fail your pull request if you add a new dependency to a vulnerable dependency yeah it will fail that was it online any more here if not I'm happy to take them in the ask me anything Corner if I find it and uh yeah thanks for being here and enjoy the rest of the day