Okay, pretty full house here, yeah, it makes me happy that so many of you are interested
into security topics and I hope I can meet your expectations and maybe tell you something
new or interesting in this talk.
Before I start, maybe I should note that on my name is Sebastian and I work for the
company Lamentry and we are pretty small team and contractor of the Center for Digital
Server Unity in Germany, so I'm a bit biased maybe because I work together with the
colleagues and a lot of the things I will present to you so maybe just for transparency
at that point.
I would guess a lot of you guys have heard about one of the recent attacks on the surface
supply chain in the last weeks, month, yes, whatever and maybe you noticed that it's also
getting noticed in media that it's not focused on IT anymore, so even in the evening
news or something, this can be a topic nowadays and one of the last big things for those
of you that write or view the movie June, movies June, you will be familiar with the name
Shai Hullud, so the San Wams from this story and there was an attack where initially
an MPM package was compromised and a Wam that replicated itself, so it's still credentials
from the machines where it got installed and tried to replicate in another package and
another package and so on, pretty net these things that made it pretty clear and accelerated
with that whole topic and unfortunately it's not a single shopping, it seems to be a pattern,
so if you look on the lower right headline, it's from 2021, so it's not a really new thing
I would say, but yeah, it's getting more extreme I would say and if you look for example,
the open message F has the malicious package database repository where they list packages
from that we know that are really just malicious, so there's more way inside and so on,
so really malicious packages and around, yeah, summer 2025, we had this plot here about
the numbers and it was like a linear increase I would say, so every year there were more
packages that we know that are malicious and then Shahulud hit it and we now have this massive
increase here in 2025 and that makes a bit of a rainy day when you look outside of the window
as a developer looking at 2026 and the question is what can we do about that, so what can we
do about that and what is public administration doing about that and typically public administrations
are not that progressive in every part I would say or the ones that lead technical development,
but I would say there are some good initiatives. I also would say that a lot of you guys will
have heard the nice bus words, deaf cyclops and shift left, so next to that they are great bus
words, there are some pretty good concepts behind that, so the basic ideas that we try to
automate stuff and that we try to do things early and that we don't want to do security in the end
or as an additional thing we want to integrate it in our development process and we also want
to do it pretty early so when we plan a new feature when we design something we want to keep
security and mind and as said we want to try to automate things so we can do stuff like secret scanning
looking for leaked secrets and our get history it happens the best developer some hopefully
development token gets committed or something you can check that pretty easily and automate it
or you can look for yeah obvious bad practices inside your code using static application security
testing and so on and one big thing is dependency analysis so you all maybe know the number from
the Linux Foundation 80 to 90% of the typical software project are based on open source dependencies
so it's a huge huge thing we have to look at that and have to check there are known
known vulnerabilities for those dependency dependencies what can we do about it and if we recap
how vulnerability management usually works we have to answer several questions so that example
we initially have identified oh using some scanner or whatever we have a critical CVE in one of
our libraries and our dependency tree that we are using and then we have to answer the question
okay if Lypy there's this known vulnerability is a effected of that and if so is our direct dependency
reactress effected of that and if so are we are we using the vulnerable parts of reactress and that
example so several several questions we have to answer and I would say the last one so for our
direct dependencies is often yeah kind of easy so you have decided to use the dependency and
started and you're using it on everyday basis you know what you are doing with that dependency so
it's more easy to find out or to answer this question then for things hidden inside your dependency
tree so the further it gets down in your dependency I would say it's harder to answer that questions
and it would be pretty great if we could share this workload so if that would be a way that if
somebody did that part for the subtree or something or a project is doing it for that part and I'm
using that project inside the chain if we could share this workload and this information assessment
that we're already done and fortunately there is a way to do that it's a so-called vulnerability
exploitability exchange format so machine readable format that allows to share this assessment
resides somebody has has hopefully done and in combination with the S-bomb so the software
bill of materials that answers what's inside the software we can combine that with the
Vex to share to our customers and users and yeah consumers of our software what are the
the resides of our assessment so we can share what's inside which dependencies we are using
and combine also the answers for known vulnerabilities of that package what's the result
are we affected or not and yeah now I want to switch over to the public administration part
because there this was identified or tried to to do in parts so as other speakers today in this
this steproom told the public administration in Germany relies in many parts on container
applications and an operation through container images and there are also some
like policies like cloud strategy and things like that that you put this even further to
to rely more on containerized workloads and therefore the the tenders and identified
or the public sector identified it would be pretty cool if we have a collection of images where
this assessment we're already done and where we can share this information and take a bit of the
burden for the users for the dependency management vulnerability management and of course and
fortunately was also said that has to be transparent and open source and therefore it's not restricted
in ways of reuse to public sectors so everybody can can reuse it but it's it's an initiative made
from from the public sector and needs of the public sector and the working title I would say I
don't know is the container.gov.de website where you can find these images so there are images
provided minimize hardened base images and application images that you can use all open source
license and this is an interesting part they come attested with as bombs and winability
explorability exchanges so all this information what's inside and what's about vulnerabilities
for this components inside are maintained and attested to the images and also there's
requirement you have to to comply with to get listed on this page that you have to be or your
image has to be free of unhandled high or critical known vulnerabilities unhandled in that case means
it's okay if there's a high CVE remaining in your image but you have to state something about that
inside your vex there must be a justification why it's there or you have to have to have handled it
and yeah in addition all images are signed and so on as it's an open source initiative
contributions are very welcome so if you look at it and have ideas feedback want to contribute
something it's very welcomed and you can find all that on the open code platform what's open code
open code is another interesting thing from the public sector it's basically a good lab with
services around it so the send us is providing a space where the public sector can develop
open source software together and also provide services around it's like runa infrastructures
that you can run your CICD pipelines so pot services discussion rooms and so on and so everything
that you need for collaborative and open source development and it's yeah I would say the the
building block below because it's bid on there the runa infrastructures use to bid these images
and so on and another thing we need to look at is the vulnerability management so as stated all these
images have to be free or have to have handled vulnerabilities classified high or critical
and we need to do vulnerability management for that and need tool for that and this is where
the Devcut project comes into place and the mission or vision of the Devcut project is to make
security or develop yeah secure development more easy for everybody and Shannon leads the founder
of the Devx up the second option once said everyone is responsible for security and that is totally
right but we have to enable that because developers and engineers maybe are not that deep into
security topics because they have to do and focus on other things have to do their development work
and in many computer science studies and so on you can go around that topic pretty good
unfortunately and therefore you try to make it easy to get these things done and how we do that
in the first step we need to know what do we have so we have to have a look on our project
and do some scans or even a best case you already know what's inside you already have a
good knowledge of your or of your project and maybe already have an S1 for example to
to start and check for vulnerabilities inside your dependencies but there are also these other
typical Devx setup steps you may want to consider like secret scanning and so on and the Devx project
does not develop skin as itself it just creates a list and pre-configures them
and yeah make them usable and reuse it is your eye components get up actions and so on
that you can easily integrate that into your project and after we have identified what's inside
we can start with management part so one central central thing of that is that you have
possibility for vulnerability management and that you get listed with things or known
vulnerabilities for packages that you are using and of course get more details on these findings like
the official descriptions I think it's unfortunately not that good readable and you also get
details on where's located inside your dependency graph and so on so what's the path to the
vulnerable components and also get supported with prioritization so up here you see a risk score
and typically a CVE so a known vulnerability is assigned with the so-called CVS as a common
vulnerability scoring system so an indication is this something really bad or not not so important at
the moment and so on yeah to help you where to to start and the CVS standard itself says you
have to refit it to your your situation your security requirements you have to enrich it with
current timely information like are there an exploit POCs available things like that and you have to
refit this yeah this critical it criticality score to help you to prioritize and next to and then you
can do the the typical handling options like maybe it's a false positive unfortunately maybe you
have to accept the risk you can fix the risk and so on you can do your normal vulnerability management
next to the dependency part there's also the part with code risk so everything that's inside your
direct code so that that that resides from secret scanning and last analysis and so on yeah
you know and one really important thing we try to consider to base that all on open standards and
open exchange formats so as stated several times they are basically the two yeah would say most
important or of most used formats is a so-called s-bomb so what's inside your project and the
vx and also for static analysis resides the reform up and um or that you can ingest into
devgot and also get out of devgot so it's really based on these open open exchange formats
so that you can use your scan as as long as they provide these these formats
so back to the connection with open code and the hardening of these container images
open code as a platform service has deployed devgot so every user of open code can freely use
a devgot instance and do their vulnerability management there so you don't have the
the need to set up tools yourself and so on so it's just provided as a security service platform
service to you you can just use your existing account to log in there and it even synchronizes all
your repository directly so that you find yourself you find your repository directly and you
don't have this the setup burdens and the most interesting part is that when you're doing your
vulnerability management there and you do all that I've shown before you have like an
without an extra step you get this vx format in the end so you're just ingest your information
you do your vulnerability management and without an extra step you are compatible with the
vx format and also the seesaw format is another exchange way basically also building on the
the vx format to share your assessment resides with your users and this is where it's connected
to this container initiative so all container images are managed or the vulnerabilities of these
container images are managed by devgot and also the attestation in the end is connected there so
the pipeline that bits these images in in the last step fetches your assessment resides from
the open code devgot instance and attest them to the image also with this link connection there
what's pretty interesting because you don't want to have a snapshot you don't want to have this
thing that you build to this image one week ago and there you had three assessment resides inside
and maybe inside or during the week there's also happening something and you have continued
providing information or for example marked another vulnerability that was found later
as was positive you can get the most recent or most latest information by just carrying this link
yeah now but at least I want to do some advertisement for other cool features we just implemented
inside there inside of god is a dependency proxy feature so in that case nothing special and at
first look but the pretty cool thing is that all these known malicious package packages we have seen
in the start like yeah especially it's during a shayhulu to the hex and so on are connected or
your installs are checked against that so if you have JavaScript or go a Python project
you can simply download your packages sorry through this proxy and packages that are known
malicious packages are just blocked from installed before something could happen and you also
are provided with some interesting details about your dependencies so even if there is no vulnerability
inside one of your dependencies it's maybe also interesting to have an overview like when was it last
time published where it's located in my in my dependencies what's about the repository we had it
not the talk to us earlier about the batch program off of senders it's a bit connected to the
scorecard approach of open message f so you maybe want to have some insights about the repositories
behind this dependencies you are using and some other interesting stats yeah and there's even more
inside I don't want to go in detail about that but there are pretty interesting talks around here
today and tomorrow about things like in total size and at the name of the station then so on
and all that are concepts we try to to base this whole approach on and to use and make them
more easy and accessible and yeah you can find dev card as stated it's an open source project
so you can check it out it's an overspe incubation project and yeah I would finish here and we
would love to hear your feedback get impressions try to contribute even with ideas make some issues
and so on and yeah I'm open for some questions now
so you have a proxy one on directly into the individual tool where you get more brief because
it seems like it's on a proxy the one over for a individual user
um I would say yeah yeah so the question was regarding the dependency proxy of it and it's
a lot of work for individual users and I would say yes as an individual would be pretty annoying to
set it up itself but using it it's pretty easy you just can say in your touch NPMRC config I want to
use it and that's it so it's a one-on-line command and a stated there's a public instance
several other public instances maybe your company corporation organization whatever wants to set
up that and then it's a yeah it has a high impact for a central central thing I would say
I've been maybe I got your question not that right yeah that would be great it would be great if
the registries they're self would do that but unfortunately at the moment we don't have that
situation so we have to to help out right and I think open SSF is reporting their findings to
the registries like saying okay we know this is a malicious package maybe we want to block it
or remove it from the registry but take some times not not always working yeah
okay no more questions I take it as a good sign would say thank you and have a nice
day tomorrow