Contrast Security’s Post

Transcript

Hi everyone. Thanks for joining us. Well, let's face it, we already blindly trust software with everything important in our lives. Think about it, your finances, your healthcare, utilities, military defense, even your social life. All controlled by software. But we don't know anything about the security of that software. I dare you to ask your organization about the size of your application vulnerability backlog. In most companies I talk with, it's hundreds of thousands or millions of vulnerabilities that aren't getting fixed. My name's Jeff Williams. I'm the founder and CTO at Contrast Security, and I spent decades as a professional hacker breaking into software at some of the world's largest companies. And then helping them create programs to improve security. In 2002 I helped start OWASP and I wrote the OS top ten all to help raise awareness of upset. Unfortunately, after 20 years, the situations gotten worse. But was it? The problem is that modern software is so complex. Every application now is spread across dozens of repos, hundreds of libraries, lots of APIs, back end connections, containers, cloud, etcetera. Traditional tools like scanners and firewalls, they only see one piece of the puzzle at a time. And really, really focus on the symptoms of vulnerabilities and attacks, not the root cause. That leaves us in the dark. This is how software pipelines auto work. Fast and reliable innovation that delivers value to customers quickly. But here's what happens when we introduce security to the mix. These tools like SAS, SCA, and WAF all emerged in the early 2000s, and they're highly inaccurate. They report many false positives, but even worse. They miss many real problems. And the only way to clean up this mess is by using experts. And when you introduce people into the critical path, you get bottlenecks, delays, and silos that ultimately lead to the massive vulnerability backlogs that I mentioned. So how do we cut through this complexity? We have to focus on the root cause of all application vulnerabilities and attacks. Want to know what it is? It's dangerous functions. Now look, this is a typical software stack with. Runtime platform libraries, frameworks, custom code, open source libraries, et cetera. Really, it's just a huge pile of functions. And these functions do a lot of dangerous things like querying databases, parsing XML and starting native processes and deserializing objects. Every stack has thousands of these functions, so developers are facing this minefield that's laced with thousands of dangerous functions and they get 0 guidance on how to use them securely. This makes insecure software basically inevitable. So what's the solution? We can't just rewrite all the millions of libraries, frameworks, and applications out there. That would be trillions of lines of code. Fortunately, there's a better way. We can inject security checks directly into these dangerous functions using runtime instrumentation. This is exactly the way APM tools inject performance checks. Just for security. That's how we can solve the root cause of application security problems and Contrast invented this technique and holds multiple patents in this technology. O let's take a look at SQL injection. And this is a problem that's plagued us for 20 years. It's been at the top of the OS top ten forever. Want you to imagine a developer who's writing code and testing it when their application starts, Contrast injects security checks into all the dangerous methods in that stack, then as their code runs. When the queries get sent to the database. Contrast checks that query to see if there's any untrusted data that made it into the query. If there's a problem, Contrast instantly notifies developers, usually through their IDE or through JIRA, with exactly the right fix and then extensive details that are recorded directly from the running application. Those same checks work in production to prevent attacks. Contrast. In this case, contrast checks to see if any untrusted data modified the meaning of a database query. Since no user should ever be able to do this, we know it's a real attack and we stop it. We do the same thing for all different applications security issues, and we found when you put security in exactly the right place inside the running application, it doesn't have to be complicated. This simplicity enables the runtime approach to be dramatically faster, much more accurate, and far more scalable than traditional application security tools. Now all you do to make contracts part of your. Pipeline is to add it to your standard platform. No tailoring, no tuning. This is a fully distributed approach. I want you to imagine securing all your applications and APIs in parallel instead of scanning them 1 by 1. All the results are collected in contrast SaaS dashboard. And we've made integration a priority with REST APIs for everything and a ton of automated integrations. So this allows fully automated pipelines that ensure security without experts. That's the essence of Dev Secops. Now Floor and Decor chose Contrast to replace their legacy SaaS Dash, SCA and WAF tools and to help them streamline dev SEC OPS. They used our Kubernetes operator roll contrast out across hundreds of applications and APIs without any changes to their code or pipelines. From that point forward, not only were their applications and APIs immediately safe against most attacks, they also actually started fixing vulnerabilities instead of just shepherding their backlog. Now IDC did a business value case study on florin decors experience and they found floor and decor eliminated 92% of their vulnerability backlog in the first year. That's exciting. They also found contrasts completely protected floor decor against log 4 shell and other Cbes, even ones that haven't that weren't disclosed already. And this is the best part IDC found that Florida core saved. 3/4 of $1,000,000 annually and increase their development team productivity by 13 percent. That to me is a truly successful absent program. I'll share a little bit about our company. Contrast is 9 years old. We got 250 exceptional contractors around the world. And we're already used to secure hundreds of thousands of critical APIs and apps in some of the biggest companies in the world. We're going full steam ahead to expand our runtime security capabilities. We just invented an amazing new technology to extract a security blueprint directly from running software. We call IT security observability and it automatically creates architectural blueprints that reveal an applications attack surface, all the security defenses like authentication and access control, all the dangers on each route, and all the connections that each route makes. These blueprints enable organizations to take their asset program to the next level when you start activities like security architecture, threat modeling, and secure by design with an automatically generated accurate security blueprint. These activities are much easier and you can start doing them at massive scale. So let me wrap up. You know why industrial factories instrument their machines for everything like vibrations, sound, temperature, smoke, and so on? It's because that instrumentation allows them to predict problems in a machine. Just by a change in the sound it makes. Instrumentation is how we prevent problems before they become disasters. So Contrast is using the science of runtime security to drag apps like out of the dark ages. By focusing on the root cause of all absent issues, we can consolidate tools and achieve the speed, accuracy, and scalability required for modern software. With contrast, you really can recognize the benefits of Dev Secops at a massive scale. If you'd like to talk to me about it or see it in action, please don't hesitate to reach out. Thank you very much.