threadfix 2.5 webinar

© 2017 Denim Group – All Rights Reserved

Building a world where technology is trusted. ThreadFix 2.5Application Security at DevOps SpeedApril 18th, 2017

Dan Cornell, CTOKyle Pippin, Product Manager


Agenda


Agenda• Application Security and DevOps• ThreadFix Background• ThreadFix 2.5 Release• Coming Up in the 2.5 Series

2


Application Security and DevOps


DevOps Is Coming


Some Security Teams Will Adapt

(Others Will Not)

5


Use This Transition to Your Advantage

6


Move Security to the Left and Get Buy-In

7


Better Security Insight, More Often

8


What Does Application Security Want

• Reduce Risk Exposure

• Introduce Fewer Vulnerabilities

• Find Vulnerabilities Early

• Fix Vulnerabilities Quickly

9


What Do DevOps Teams Want?

10


How Do We Make This a Reality?

11


Application Security Testing in CI/CD Pipelines

12


AppSec Testing Policies for DevOps

13


Testing Tradeoffs

14


Decision-Making Factors

15


Reporting Recommendations

(Hint: Not With These)

16


ThreadFix Background


ThreadFix Overview• Create a consolidated view of your applications and vulnerabilities

• Prioritize application risk decisions based on data

• Translate vulnerabilities to developers in the tools they are already using

18


ThreadFix Overview

19


Create a consolidated view of your

applications and vulnerabilities

20


Application Portfolio Tracking

21


Vulnerability Consolidation

22


Prioritize application risk decisions based on

data

23


Vulnerability Prioritization

24


Prioritization with Hotspot


Reporting and Metrics

26


Translate vulnerabilities to developers in the tools they are already

using

27


Defect Tracker Integration

28


ThreadFix 2.5 Release


Secure DevOps with ThreadFix

• What does your pipeline look like?

http://www.slideshare.net/mtesauro/mtesauro-keynote-appseceu http://www.slideshare.net/denimgroup/rsa2015-blending-theautomatedandthemanualmakingapplicationvulnerabilitymanagementyourally

https://blog.samsungsami.io/development/security/2015/06/16/getting-security-up-to-speed.html


AppSec Testing for DevOps

• Configuring Testing Policies

• AppSec Testing for DevOps in Action


Policy Configuration• Testing• Synchronous• Asynchronous

• Decision• Reporting

32

Blog Post: Effective Application Security Testing in DevOps Pipelineshttp://www.denimgroup.com/blog/2016/12/effective-application-security-testing-in-devops-pipelines/

https://www.denimgroup.com/resources/effective-application-security-for-devops/


Testing Configuration

33


Testing Configuration

34


Decision Configuration

35


Decision Configuration

36


Reporting Configuration

37



38



39



40


Testing in Action

41


Testing in Action

42


Testing in Action

43


Testing in Action

44


Testing in Action

45


Testing in Action

46


Testing in Action

47


Coming Up in the 2.5 Series


Coming Soon• Support for more SAST and DAST tools

• “Easy Mode” for CI/CD plugins


Building a world where technology is trusted.

@denimgroupwww.denimgroup.com

50

www.threadfix.it

threadfix 2.5 webinar

Technology