Too many organizations have an incomplete picture of their application portfolios. Because you are unable to protect attack surfaces that you don’t know about, this leaves them vulnerable. In this webinar, we will cover the capabilities that ThreadFix has to allows security teams to manage their application asset portfolios. We will also take a deeper dive into several tools such as nmap and OWASP Amass that can help security analysts better enumerate all of the applications in their organization’s portfolio.

1. © 2020 Denim Group – All Rights Reserved
Building a world where technology is trusted.
Dan Cornell | CTO
Application Asset Management
with ThreadFix
October 28, 2020

2. © 2020 Denim Group – All Rights Reserved
1
Advisory
Services
Assessment
Services
Remediation
Services
Vulnerability Resolution
Platform
Building a world where technology is trusted
How we can help:
Denim Group is solely focused on helping build
resilient software that will withstand attacks.
• Since 2001, helping secure software
• Development background
• Tools + services model

3. © 2020 Denim Group – All Rights Reserved
Agenda
• Need for Application Asset Management
• ThreadFix Overview
• ThreadFix Application Asset Management
• Automating the Process
• nmap
• OWASP Amass
• Questions
2

4. © 2020 Denim Group – All Rights Reserved
Need for Application Asset Management

5. © 2020 Denim Group – All Rights Reserved
Attack Surface
4

6. © 2020 Denim Group – All Rights Reserved
Attack Surface?
5

7. © 2020 Denim Group – All Rights Reserved
Attack Surface
• For the purposes of this presentation…talking
about application attack surface
• Web applications
• Web services
• Mobile applications
• And so on…
6

8. © 2020 Denim Group – All Rights Reserved
Other Materials
7
https://www.slideshare.net/denimgroup/monitoring-application-attack-surface-to-integrate-security-into-devops-pipelines
Application Attack Surface
https://www.slideshare.net/denimgroup/reducing-attack-surface-in-budget-constrained-environments
Reducing Attack Surface

9. © 2020 Denim Group – All Rights Reserved
Challenges Rolling Out Software
Security Programs
• Resources
• Raw budget and cost issues
• Level of effort issues
• Resistance: requires organizational change
• Apparently people hate this
• Open source tools
• Can help with raw budget issues
• May exacerbate problems with level of effort
• View the rollout as a multi-stage process
• Not one magical effort
• Use short-term successes and gains to fuel further change
8

10. © 2020 Denim Group – All Rights Reserved
But for many organizations, the
first challenge they need to
overcome is the reality that…
9

11. © 2020 Denim Group – All Rights Reserved 10
You can’t defend unknown
attack surface
If everything is important
then nothing is important

12. © 2020 Denim Group – All Rights Reserved
[Translation]
Find out what applications you have in your
organization
Decide the relative importance of
applications and treat them differently
based on this
11

13. © 2020 Denim Group – All Rights Reserved
What Is Your Software Attack
Surface?
12
Software You
Currently Know
About
Why?
• Lots of value flows through it
• Auditors hassle you about it
• Formal SLAs with customers mention it
• Bad guys found it and caused an
incident (oops)
What?
• Critical legacy systems
• Notable web applications

14. © 2020 Denim Group – All Rights Reserved
What Is Your Software Attack
Surface?
13
Add In the Rest
of the Web
Applications You
Actually Develop
and Maintain
Why Did You Miss Them?
• Forgot it was there
• Line of business procured through non-
standard channels
• Picked it up through a merger /
acquisition
What?
• Line of business applications
• Event-specific applications

15. © 2020 Denim Group – All Rights Reserved
What Is Your Software Attack
Surface?
14
Add In the
Software You
Bought from
Somewhere
Why Did You Miss Them?
• Most scanner only really work on web
applications so no vendors pester you
about your non-web applications
• Assume the application vendor is
handling security
What?
• More line of business applications
• Support applications
• Infrastructure applications

16. © 2020 Denim Group – All Rights Reserved
What Is Your Software Attack
Surface?
15
MOBILE!
THE CLOUD!
Why Did You Miss Them?
• Any jerk with a credit card and the ability
to submit an expense report is now runs
their own private procurement office
What?
• Support for line of business functions
• Marketing and promotion

17. © 2020 Denim Group – All Rights Reserved
First Decision
• What is considered to be in scope?
• Depends on how you want to manage
vulnerabilities and manage risk
16

18. © 2020 Denim Group – All Rights Reserved
Process
• Identify Application “Homes”
• Enumerate Applications
• Collect Metadata
• Repeat as Needed
17

19. © 2020 Denim Group – All Rights Reserved
So Where Are These Applications?
• Your Datacenters
• 3rd Party Datacenters
• Cloud Providers
18

20. © 2020 Denim Group – All Rights Reserved
ThreadFix Overview

21. © 2020 Denim Group – All Rights Reserved
ThreadFix Origin Story

22. © 2020 Denim Group – All Rights Reserved
ThreadFix Overview
• Create a consolidated view of your applications and
vulnerabilities
• Prioritize application risk decisions based on data
• Translate vulnerabilities to developers in the tools they are
already using
• Provide access to powerful analytics
• Drive efficiency with automation and orchestration
21
44% Reduction
in Time-To-Fix
Vulnerabilities
Up To 5x Increase in
AppSec Assessment
Productivity

23. © 2020 Denim Group – All Rights Reserved
ThreadFix Data Flow
22

24. © 2020 Denim Group – All Rights Reserved
ThreadFix Pipeline
23
i.o.
SecurityCenter
De-Dupe
Merge
Correlate
History
Settings
Policy
False Positives
Risk Triage
Consolidate
Remediation
Profiles
Templates
Actionable
Tracked
Insights
Verification
HotSpots
Alerting
Findings & Vulnerability Management Pipeline
Automated/Orchestrated
Pre-Processing
Reduce Vulns to Manage
Manage by Policy & Settings
Single Portal
for:
ITAO’s
Dev’s
SME’s
SecChamps
Dev’s &
SME’s
Work in daily
tools, and
existing
workflows
Security
Program &
Policy
Managemen
t and
reporting
Tableau
Business
Object
Power BI
Archer
Custom
Reporting
External
System
Integration
Manua
l

25. © 2020 Denim Group – All Rights Reserved
Who Benefits and How?
• Security Team
• Run more efficient and effective application security programs
(200-500% increase in testing throughput, up to 35% reduction in
findings that require triage)
• Development Teams
• Direct testing and receive results via tools and platforms already in use
(Jenkins, JIRA, etc)
• Risk-management (GRC) Team
• Faster resolution of key vulnerabilities (up to 44% reduction in mean-
time-to-fix)
24

26. © 2020 Denim Group – All Rights Reserved
Blog Posts on ThreadFix and Metrics
• Value of secure coding training for your organization
• https://threadfix.it/resources/applied-threadfix-fire-bullets-then-cannonballs-
appsec-edition/
• xAST scanner rollouts
• https://threadfix.it/resources/applied-threadfix-fire-bullets-then-cannonballs-part-2/
• Optimizing training investments
• https://threadfix.it/resources/applied-threadfix-getting-the-most-out-of-your-training-investment/
• Automating vulnerability exception reporting
• https://threadfix.it/resources/applied-threadfix-automated-vulnerability-exception-reporting/
25

27. © 2020 Denim Group – All Rights Reserved
ThreadFix Application Asset Management

28. © 2020 Denim Group – All Rights Reserved
ThreadFix Asset Management
• Licensing
• Building Your Asset Portfolio
• Structure – ThreadFix Teams
• Collecting Application Metadata
• Linking
• Risk Characterization
27

29. © 2020 Denim Group – All Rights Reserved
ThreadFix Licensing
• Based on application asset
count
• BUT only those managing
scan/test data
• So you can load up as many
application assets as you
want
• Only pay for those where you
are tracking data
28

30. © 2020 Denim Group – All Rights Reserved
ThreadFix Teams
• Arbitrary container for application assets
• Linked to permissions system
• How to structure?
• Line-of-business
• Geography
• Etc
29

31. © 2020 Denim Group – All Rights Reserved
Application Metadata
• Linking Fields
• Unique ID
• Source Code Information
• IP Address Details
• Risk Characterization
• Criticality
• Tag
• Metadata Values
30

32. © 2020 Denim Group – All Rights Reserved
Linking – Unique ID
• Unique name for an application (within a
Team)
• Intended as a key to external systems
31

33. © 2020 Denim Group – All Rights Reserved
Linking – Source Code
• Link to application asset source code
• Supports git and subversion
• Used by Hybrid Analysis Mapping (HAM)
• Can specify credentials, branch, revision
32

34. © 2020 Denim Group – All Rights Reserved
Linking – IP Addresses
• Linked to fixed infrastructure supporting
the application asset
• Can be linked to multiple IPs, ranges
• Source for joint infrastructure/application
asset reporting
33

35. © 2020 Denim Group – All Rights Reserved
Characterization - Criticality
• Raw score of how critical the application
asset is
• Critical, High, Medium, Low
• Used by Relative Risks Portfolio view
34

36. © 2020 Denim Group – All Rights Reserved
Characterization - Tags
• Free-form way to tag applications
• Environment, hosting arrangement,
language/platform
• Can attach risk ratings to tags
• Used by Relative Risks Portfolio view
35

37. © 2020 Denim Group – All Rights Reserved
Tagging Video Resources
36
https://threadfix.it/resources/introduction-to-tagging/
https://threadfix.it/resources/introduction-to-tagging-part-2/

38. © 2020 Denim Group – All Rights Reserved
Characterization - Metadata
• Key/value pairs stored for an application
• Acceptable key values are managed by a
ThreadFix administrator
37

39. © 2020 Denim Group – All Rights Reserved
Blog on Application Portfolio Tracking
38
https://threadfix.it/resources/applied-
threadfix-application-portfolio-tracking/

40. © 2020 Denim Group – All Rights Reserved
Automating the Process

41. © 2020 Denim Group – All Rights Reserved
Automation - nmap
• nmap: https://nmap.org/
• Look for common web server ports:
• 80, 443, 8000, 8008, 8080, 8443
• Others depending on your environment
• nmap -sS -p 80,443,8000,8008,8080,8443 x.y.z.0/24
• Great for dense environments you control
• Largely datacenters
https://www.denimgroup.com/resources/blog/2016/03/threadfix-in-action-discovering-your-organizations-software-attack-surface-web-app-edition/
40

42. © 2020 Denim Group – All Rights Reserved
Automation – OWASP Amass
• OWASP Amass is a powerful tool for finding
hosts associated with your organization
• Home page:
https://github.com/OWASP/Amass
41

43. © 2020 Denim Group – All Rights Reserved
ThreadFix / Amass Automation
42
https://threadfix.it/resources/applied-threadfix-seeding-
your-application-portfolio-with-owasp-amass/

44. © 2020 Denim Group – All Rights Reserved
Questions

45. © 2020 Denim Group – All Rights Reserved
Building a world where technology is trusted.
Building a world where technology is trusted.
@denimgroup
www.denimgroup.com