The Curious Case of Knowing the Unknown

By Vandana Verma Sehgal on 07 Aug 2021 @ Defcon : Appsec Village
📹 Video 🔗 Link
#threat-hunting #threat-modeling #architecture #reverse-engineering
Focus Areas: 🛡️ Security Operations & Defense , 🦠 Malware Analysis , 🏗️ Security Architecture , 🕵️ Threat Intelligence

Presentation Material

AI Generated Summary

The talk addresses the critical security risks posed by third-party dependencies and supply chain vulnerabilities in modern DevSecOps environments. It argues that traditional security models are insufficient given that 80-90% of application code often originates from open-source libraries and containers, creating a vast, poorly understood attack surface.

Key findings highlight that vulnerabilities in transitive dependencies—as seen in the Apache Struts and a mail parser incident—can lead to widespread compromises like the Equifax breach. The speaker demonstrates a live exploit against a vulnerable Java application using an outdated Struts version, showing how path traversal and remote execution can occur through manipulated file uploads. Infrastructure-as-code is similarly risky if base images or configurations are flawed, potentially deploying vulnerable environments from inception.

Techniques advocated include continuous, integrated scanning of source repositories, container registries, and infrastructure code throughout the development lifecycle, not just at release. Chaos engineering is proposed as a disciplined method to proactively test failure modes, validate security controls, and improve observability. Automation is essential to scale these efforts and meet compliance mandates like GDPR.

Practical implications stress that DevSecOps requires a cultural shift: security must be a shared responsibility, not a gate. Security champions and cross-team collaboration are vital for knowledge sharing and rapid response. The “shift left” strategy must be coupled with continuous monitoring, as vulnerability severity can escalate (e.g., medium to critical) with code changes. Ownership and transparency across development, operations, and security teams are necessary to manage the “unknown” dependencies effectively. Penetration testing remains complementary but cannot replace automated, integrated security practices. The core takeaway is to proactively secure the entire software supply chain before incidents occur.

Disclaimer: This summary was auto-generated from the video transcript using AI and may contain inaccuracies. It is intended as a quick overview — always refer to the original talk for authoritative content. Learn more about our AI experiments.