Fortifying the Code: Application Security with Secure Application and Splunk AppDynamics

Alright, thanks everyone for, for joining today this morning or this afternoon wherever you were maybe.00:10I'm honored to be presenting this EIS session for you around Splunk AppDynamics secure application or Cisco secure app if you're familiar with it from our other product suites.00:18My presentation is gonna be a little more bit more informal. We've only got a very short period of time, so I want to jump straight through a few slides and then get into a brief demo. And really it's just an opportunity to showcase.00:37This valuable tool set that we've got within AppDynamics and also we've also started implementing this in our new product which is Splunk Ollie or observability cloud.00:54So let's jump straight to the slides. So today's agenda, as I said, it's gonna be very, very, very brief hopefully a lot more showcasing of the actual tool and and hopefully we can must rob some questions.01:10Okay, so in a typical organization, security and app teams are sometimes worlds apart. So secure app was designed to bridge the gap enabling faster detection and remediation. Obviously while building better interconnected teams.01:37Modern architectures are becoming increasingly more complex and thus attack services are also increasing. So we're having to look at trying to secure all these different attack services and.01:59It can become quite cumbersome, but in the today's presentation, we're looking at how to secure a very important, attack surface, which is around our application.02:18So previously this slide contained our full stack observability technologies which is business transactions user experience.02:36Application infrastructure and network, and as you can see here, we've added, a new layer to this technology stack called security. It's tied in with our application APM.02:53So what we're actually seeing seeing today is how we're securing applications and the related business transactions that are being monitored within those applications.03:12The tool is going to allow us to have some valuable actions which are being able to prioritize the different vulnerabilities and and then also be able to, apply some remediate.03:28Remediation actions against those detected vulnerabilities.03:47And and and also see how those actions are managed through some policies. So just a quick question here.03:52Sorry, my screen has got a couple of things in front of it. I'll just go back there in that slide. Sorry about that so why is secure application needed now more than ever?04:11Oh so I wouldn't make you guess but let's go through them anyway. Static vulnerability testing will not find issues introduced at runtime modern architecture massively increase the attack surface as we covered before. We require a solution that.04:27Can monitor vulnerabilities real time in production.04:46So actually, Cisco secure app covers all of the above. So as I said very very very brief slides and we'll jump straight into our demo. But before then, do we have any que.04:50Questions so far?05:10Paul, we do have a question here, I mean maybe a little bit too early to ask that, but is Cisco secure application a standalone product? Ah, very good question. So secure app is built into our controller.05:13So it is a an added feature that's available to you once you have that enabled, and the metric or the information being gathered for secure app is already built into your application.05:32Agents.05:52So there's NO extra agent that needs to be installed. The telemetry will come straight out of, the existing agents that you have, and then you will have some some new user interfaces to interact with the data being collected.05:53Sounds good Paul. Thanks for that. No worries. I'm just gonna drag this over to the screen, but is that is the control screen showing now? Yeah. Why don't see it? Okay fantastic.06:13So for those who aren't familiar with our AppDynamics controller screen, this is typically the landing page that you get on the controller, probably more so, this page here.06:29So we use this controller to to demonstrate some of the features that have been released in, in appdynamics. I find that this screen is forever changing because we're introducing so many new features all the time. So hopefully I'll.06:47I'll still be able to use the the current screens in front of me. The application that we're going to, investigate today is this AD commerce application. It's showing that there's a some type of critical issues around it. Obviously it's a demo site, so you'll.07:06Provide us through the issues detected.07:26In relation to secure app. So having a look at our AD e commerce application page, a controller page, we've got a new section here, on the right hand.07:30Inside called security health.07:50So everything else here is is pretty much the same. We have our events, our business transaction health, and then as you can see here, there is a new section called security health. It's showing a business risk of eight 70 and we'll go.07:54We'll go through what this business risk score is actually what it's actually about. But at the same time you can quickly see there is a vulnerabilities real time health score showing here as well. So if this was a live production.08:13Database. You can actually see that it's quite quick to see any critical vulnerabilities that may need your investigation.08:33Before we leave this screen, if we have a look at business transactions, now this is the the same old business transaction screen that you're used to, but there is an added column here called business risk. So each.08:48Business transaction is now has been categorized or correlated with our secure app and and secure app is actually providing a business risk score for each of these business transactions that we're monitoring.09:02So majority of it is showing quite a low business risk score, and obviously indicated with a traffic light coloring indicator here green, meaning that this business transaction is at low vulnerability risk, but some of these.09:22Business transaction are actually showing quite a high business risk score. If we drill down into one of these business transactions again, everything will be there under the business the checkout business transaction now and.09:42And same as the screen before, we've got a, security health section for this business transaction.10:02Any questions before we move into the secure app screens? Paul, there is one interesting one. In fact, that could probably be on most of our minds. It asks us that whether Cisco secure app is more suited for.10:11For the cloud native applications or do we also see some sort of support for our traditional Java and.net environments as well?10:31Yeah, fantastic. So actually it's it's suited to to both. So at the moment, everything in app dynamics and the secure app feature within AppDynamics is also constantly monitoring for vulnerability.10:39Abilities for your java, traditional Java and.net applications. Now with more cloud native applications, if you're, you're utilizing app dynamics or more so our new product Splunk observability cloud secure app.10:59Is also being implemented in those spaces as well. So, so definitely more mature in, in appdynamics, but in Splunk observability cloud where where we're monitoring more cloud native products, it is a feature that is coming as available.11:19What is, is becoming more and more mature as releases are are are ga'd.11:39Sounds good. Let me steal one more question. Quite an interesting one. Since Cisco Secure app is a part of your monitoring suite, is C Cisco Secure app just monitoring or alerting us about the vulnerability or is it also helpful in blocking some kind of a threat?11:46Or attack? Yes, fantastic fantastic question. So it it is based on a rast technology, so vulnerabilities are blocked in, in real time using the configured policies that we we can put in place.12:06And, and that actually allows us to block specific calls, which then renders those calls unavailable to users, but then the the.12:25The great thing about that is that the rest of the application that aren't is not affected by that vulnerability is still available to the users. Sounds good Paul. I guess we are good for now. Okay, that's good. So there's there's a couple of options that we can.12:40Use to click and drill down to more detailed information around the health status of this business transaction. But let's see if we can click on the business risk hyperlink here.13:00Now, as you can see, it's opening up a new page, so in in essence, this secure application page now has has moved us to a new set of user interfaces.13:19You can see.13:39That the the menu items on the left hand side here have changed. We have business transactions, libraries, vulnerabilities, attacks and whereas, as before, these menu options weren't available. It's quite.13:41Easy to go back to the main appdynamic screens. It's just a matter of going back or selecting one of these.14:01Menu items and it will return us back to the AD application. Okay, so what are we actually looking at here? So there's definitely, a lot of new pieces of information that has been presented to us in regards to this checkout business.14:11Transaction. I'm just looking at my slides here. So starting on the top left panel, you can see the business risk factors that are leading to the top line score. This score is produced from our APM and CSA security insights coupled with our business risk observability, Cisco integrations.14:30And Cisco vulnerability management platform.14:50Performs, which was formerly Kenna. So these scores are actually a derivative of real time feeds that are coming in from from the wild. So we're we're able to assess the libraries that are being used by this.14:53Business transaction and this score is actually indicating whether those libraries are actually causing some type of business impact in the real world. So, we have a CVS score which probably everyone is more accustomed to, and this is a score that's coming from.15:13From a global database to the vulnerability of this library, but our Cisco risk score gives more business context to that CVS score. So in cases where.15:36CVS scores maybe high. The, the Cisco security risk score may deem that vulnerability as being a little lower than what the CVS score may portray.15:54Portray it. So that gives you an opportunity to prioritize which vulnerabilities that need addressing 1st and and perhaps some other vulnerabilities may not be impacting business business usage.16:14Compared to others in the real world. Questions around that because I know sometimes that that can get a little bit confusing. Paul, this sounds like we have already covered this question, but possibly the participant might have dialed in a bit later.16:34Again it's dials back to the point do we need to install a new agent for using Cisco secure application? Not a problem. So, NO, we don't need to install a new agent. It already built into our, our existing agents. There is a minimum.16:53Version of agent that is needed, I think I've got a slide deck with that coming. I can't remember off the top of my head what the version number is but but when we get to the slide then we'll we'll know what the minimum version is. So NO, as, as long as you've got the most recent agents, you're ready to go. Lovely. Sounds like we can avoid the agent fatigue.17:12Part of definitely.17:32Okay, there is another one which again quite a interesting one. Is there some sort of a performance impact while enabling Cisco secure application? So I like every type of analysis that's done by our agents. There is some some resource.17:35A usage that's required, but there's also a slide that will will indicate the the performance impact as well. Just learn last one and one of the most interesting ones, and I think everybody might want to.17:54Probably get their hands on this part. Is there any way like data sensitive information like passwords can be handled safely while using Cisco secure application? Okay so the secure app isn't.18:09Looking through.18:29Data it's specifically looking at libraries being used and malicious type of code. So in terms of PII or sensitive information, we're not actually bringing any of that info.18:32Information into the into the secure app, feature or application.18:51So if we get that correctly, so data collection is still more on the side of the customer more of the app layer or node layer. Yeah, that's correct. We do get into the the the code layer, but we're not looking at any data being passed.18:58Into the code. Lovely board. Thanks for that. We have NO more question for now.19:18No problem. So the middle, the top middle shows the trends of security risk over last seven days or last number of days to understand if the risks are actually increasing or decreasing.19:24The top right pane provides action actionable data around remediation that the customer can prioritize to immediately reduce their risk, their security risk. So, you know, as.19:42Tuning them, you know, these vulnerabilities, we're also providing some remediation actions that can be taken to to remove this vulnerability. The bottom pane displays three tabs of summarized security events.19:57It says three tabs, but I don't see three tabs here sorry so you can see each vulnerability that was detected for this for this business transactions, there's definitely a number of different ones here, remote.20:15Code execution, arbitrary code execution, denial of service. So it's quite a good demo. It's showing us a quite a, a good list of different type of vulnerabilities, but basically what it's what we're trying to display here, is when these vulnerabilities do are detected after.20:34Is able to show you in detail information about each one of those vulnerabilities.20:54You can see we do have hyperlinks also for each one of these vulnerabilities and the appropriate CV IDs for them. If we click on one of these, it should take us to the vulnerabilities page.21:03And in the vulnerabilities page, as you can see, there's definitely a lot more information that we can use to triage this issue. So we're looking at the specific vulnerability type and the information around that gathered from.21:24A global database, some more info from more detailed information around that again coming.21:45From a global database and reference to this information are also available. We can see here the.21:52Blast radius of this vulnerability. So straight away it's showing the different tiers that are also affected and also some of the, some of the nodes that are are also affected by this vulnerability. So you you don't have to go around and hunting for this.22:08The specific vulner vulnerability within your monitored applications. As long as you're monitoring them through secure app, we will see the different.22:27The different applications tiers and nodes that are being affected by this vulnerability. So we were looking at AD commerce here. That's where we started our investigation, but as you can see, there's also another application that is being affected by this vulnerability.22:41Let's have a look at libraries. So again, providing a wealth of information for you in, and, you know, quite minimal clicks, we can see the exact libraries here that were.23:05We're actually.23:24Showing severity risk scores four. It's showing the, the remediation versions for each one of these libraries as well. So e.g. here we've got a spring framework, webm.23:27AC version that has quite a high vulnerability score and then AppDynamics is all already giving us information on the remediation version that will remove this vulnerability from our list.23:46So having looked at this library, again, it's diving deeper into more information. It's looking not only of the blast radius but specifically where these.24:05Libraries maybe located. So, you know, the developer here has got enough information for, for, for quickly actioning these issues.24:24Let's have a look at the attacks page. I don't think there is any attacks but oh here we go, ok, great. Here we can see that an exploit attempt to targeting the vulnerability method in the, I think this should be a log four J attacker. I, I know we have.24:44Okay so we do have a few. The more typical one that I wanted to show off was a log four J.25:09Let's have a look if I can get one of those up There's been a few a few more added to this to this demo since so.25:20Here we go. Sorry. Hey Paul, just a quick quick question before we move on to the other slides possibly that still stands relevant. It is a question which asks what's the difference between the highest CVSS score?25:43And the Cisco security risk score, I believe that's something that we saw on a slide of two back on the demo bit. Oh yeah, definitely. So if we go back, let's see if there is a slide for that.25:59No, not that one. I think it was just on the UI. I'll go back to the UI, sorry. Hang on a second. Okay, here we go. Yeah.26:23All right, so you can see here, e.g., we have a CVS score of 8.1. So out of ten and this may have, you know, been, been higher if.26:35If the CVS score, database deemed deemed it as being higher or critical, but it's actually only scoring a high. But the business risk score is showing at a, at a 100, so it's highest its highest available score. This score here is.26:53Is being supplemented by, by data feeds coming from vulnerability databases that that Cisco utilize.27:14The information coming from those databases is actually indicating that in in the real world or wherever these libraries are actually being used, it's it's showing a high impact to the business. So not only does it have somewhat of a high score in.27:30Terms of the CVS score that's been rated and and stored in global database. Appdynamic or Cisco itself is actually rating this vulnerability as being higher than what CVSSS score is.27:50By Deeming it to be. And that's, that's coming from purely the.28:10The real world, business impact that this library is actually causing. Sounds good Paul, I believe this is definitely a point that should stand out that we are able to provide more context than just the very standard database.28:16Which is a CVSSS.28:34All right. Another quick one but just a point in the feature but can I export this list to Jira for my development team? I can't remember where this was exportable. I know everything is shareable, but I just can't remember off.28:36It's the top of my head where the, where the feature was to actually export this stuff. How about the one which is right above the title tab export all.28:56Where is that one? Yeah, let's have a look. Oh, there we go. It's actually produced a CSV file for me. Hopefully that answers the question. Yeah. Lovely. Sounds good. Yeah.29:08No more questions for now. Okay, so if we go back to, this, this attack here, this, this example was actually a log.29:23Log J attack log four J attack. It's showing obviously this is an attack rather than a vulnerability. So it's actually giving us a lot more information around the actually affected node, which is the, you know, giving us like the, the.29:41IP address of this node, the exact time of the attack.30:01And then a lot more information here that we can utilize to limit the the issue and and perhaps get a, a developer or a service engineer to look at mitigating either.30:06From a network perspective or actually.30:26Removing this this node altogether. You can see here it gives you the stack Trace so exactly what code was was executed again this this is a demo environment so you.30:30Will be I guess it will be well defined. This might not necessarily be as a clear cut in in real world scenarios.30:50Okay, let's have a look at policies let's see sorry I'm just trying to.31:08See where.31:29How policy screen was.31:31I thought I had a configuration tab actually about here, but I don't know why it's not showing on the.31:50On the screen where I can set my my show policy. I wonder I I wonder if my wonder if my permission has actually changed.31:59That's going to limit our demo actually and I might not be able to show you the the actual configuration of the policy. That's, that thought would be great.32:19That's all I'm just seeing if I can get to it a different way. No, yeah encore, do you, do you know whether I can access the policy?32:36Configuration a different way, not the best on top of my head. Well unfortunately Kevin since you're there on the call, any quick help? It seems like this controller.32:54Does not give you that permission at the moment. We might I thought it was here and then it we should have been in this list here. Yeah. And, and being able to edit the policy. Yeah. So what, what I'll do instead, I I I've I do have.33:11Some screens that I can quickly share just so that, so that there's a little bit of context sorry that one here.33:32Okay, so you you hopefully you notice there's a there's a, a policy state status that is being applied here. So e.g., this log four J vulnerability that was detected actually triggered.33:54A policy which is a blocking policy. Blocking meaning that now this bit of code is actually going to be stopped from executing by the, by the agent monitoring that application.34:14This was the widget and menu option that I was actually looking for to, to hopefully have demoed to you but unfortunately it's not available to me right now. But if we look at a couple of these screens.34:34So we're in the policy list screen here, and one of the policies that has been created here is this network or socket access. So, if that trace contains this log four J library.34:47Then actually, we want to block.35:08This this bit of code. So these are just an example of the different type of policies that, that actually can can be created and the tool itself can apply these policies for the detected vulnerabilities and attacks.35:12So there's a there's another example there, e.g., this command execution, so if process equals cat etc password, which is a, you know, pretty interesting command obviously phishing for passwords here, then again, that code execution will be blocked by by the.35:31Yeah, sadly I can't go into more detail on that. Let's have a look if it actually has, ok, here we go. There's there's another screen here that's just depicting in more detail around what what setting up a policy would effectively look like. I wish I could have done one with you today, but, but.35:56I just don't have the access right now.36:16But questions on on policy creation? None None so for that specifically around policy. Oh, that's a good sign, that means it's pretty straightforward. Yep.36:18There has been just one earlier, I believe I just missed on that. Sorry about that. It's talks about transitive dependency library that other library use. Is that something that we cover under Cisco secure app? I'm not too sure about that question actually. That might be just a little bit over my head.36:36No worries.36:57Yep. I have taken a note of that and get back on that. Okay, NO problem. So yeah, so the, so the configuration of the policy and applying, applying it to the detected attacks and vulnerabilities is pretty straightforward here.36:58And you know, there's not actually too many areas where configuration is is is needed. The secure app tool itself is quite intuitive to work straight out of the box in terms of detecting vulnerabilities in the.37:18Attacks, and, and as I said, this policy is is just able to then customize what action is done when ah detection occurs.37:38I think that's it for that one. Okay, let's move this off. Alrighty, that's pretty much it in terms of.37:56The showcasing of of the tool, as I, as I said, this information is, is available in these new user interfaces and and getting back to.38:16The original appdynamics home screen is pretty straightforward, it's just clicking on one of these links or moving back and it'll bring you straight back to the AppDynamics controller screens.38:34Now in terms of licensing, you th there there is a separate licensing component around that it's per application. So, you know, there's, if you contact your sales representatives, they'll be able to walk you through.38:53In more detail around how you can supplement your your application monitoring with secure app.39:12Right now, and as I said, there's NO NO, nothing else extra needed once you do have the set of licensing enabled, click of the switch on the back end there, your, your.39:23Applications are actually we're actually already collecting that, that information from the agents as we speak, you just don't have access to the screens to analyze and and use secure apps, features. So once you have that licensing.39:39A flickable switch will enable those new screens to be available for you and then it's just a matter of selecting which applications you want to actually analyze with secureapp.40:00All right, let's go back to our slides so this is probably gonna answer some of those questions that we had earlier, as I said, it's bundled already with your existing agents. You get the new set of secure app dash.40:18Dashboards and the vulnerability and threat feeds.40:38They're already coming into the controller. It's just that you will have access to those feeds to build those business risk scores.40:45So these are the minimum agents that you we do require you have. So Java 20 APM 21 eleven.net 2112, and then obviously the controller itself, which will have the new screens need to be at least on 2014.41:05It's now the impact to the host system where your agents are, you will need it's quite small, so you know it will take up a few megabytes of memory.41:23We're only looking at less than 1 % of CPU usage, now in terms of whether the tool requires more, then you might see a, a spike of up to 5 %.41:43There's not much oh sorry there's not much latency that's that's impacted by the tool itself and majority of classes are are are instrumented based on the implementation of some of the interface rules.42:03So yeah, so depending on the the amount of policies that you actually create, the the performance of secure app is is pretty negli negligible impact to your host.42:25Yeah, just going back to, you know, the ease of actually enabling the secure app, it's it's really just a matter of selecting the the application that you want to enable secure app to start, to start.42:49Monitoring.43:08Oh, and this is just going back to our policies configuration screen.43:16We are also now integrating with, with Splunk, so if you do, if you are an existing Splunk customer, we are able to send the secure app events to Splunk platform as well.43:33So so if you're wanting to.43:53Supplement your existing dashboards or your secure security monitoring dashboards in, in, in Splunk then we're, you know, we're, we're able to send that across to to Splunk as well. So you've got a.43:56A a clear view from an application security perspective of what's going on and and potentially correlate that with, with other security postures that you're monitoring with your Spark platform.44:16So another quick question, what is needed to use Cisco secure app dynamics? The APM agent needs to be deployed.44:36A Cisco secure app license is required. Secure app needs to be enabled on the target application, obviously, all of the above. But once again, there is NO complex configurations that's needed it's just a matter of these three simple steps.44:45So that's about it. This is just a supplementary slide on where you can get more information around secure app. So our Cisco university, or this used to be at the university, it's not moved over to Cisco university, but all the same con content will.45:05Be available over in Cisco University where yeah you can dig deeper into secure app and explore other related content around AppDynamics.45:25That concludes our, slides. We're open to questions. We've got, I think about 10 min that you know where where the floor is open. So please, any questions that you may have.45:44Thanks Paul. Thanks for such an interesting walkthrough talking about Cisco secure application. I believe we have exhausted the list of questions that came through over to us with one which is in my bucket for, as a follow up I might need to get back on the transitive dependency on the libraries.46:01So if you may allow we should wrap up this session of expert insight series.46:21We're good to go with? Yeah, we're we're we're done. But I just wanted to thank everyone for joining thanks very much for being a lovely host as always. Kevin, thanks for your support there. I did get stuck a little bit so yeah so thanks thanks for for your support around that policy.46:30Policy creation. Look, I I I as I said in the beginning of our presentation, you know, quite quite humbled to be able to present this to you today. It's definitely been one of, more favor favorable features by many of our customers, especially those ones that have.46:51Require real time security of their their applications. You know, this is one of the very few tools out in the market that is able to assist you with real time vulnerabilities and act on those vulnerabilities in real time.47:11Without impacting your entire application. We've shown you how easy it is to implement, and utilize. So hopefully, you know, we can can get some of you to try it out. There are some trial licenses that you can.47:30Request to to have enabled and then play around with this tool to see the value that you maybe able to get from it. But as I said, the customers that are utilizing this tool, are finding it quite valuable and and more so now a necessity.47:50And their tool belt.48:10So once again, thanks everyone for, for joining. Please reach out to us if you need any more information, we're here to continue this engagement moving forward. So not only around secure app, but all, all the other wonderful features that appdynamics.48:12Does provide. So please reach out to myself, Ankur or Kevin at any time. We're definitely looking forward to continuing this engagement with you.48:33Thank you Paul, especially for the fantastic demo and you know for hosting us hosting the session with us today. At last like not taking much of your time more here, I would say stay secure, stay observant, and we'll see you at your next expert insight.48:46Next session with Kevin definitely being around. So thank you once again, everybody.49:05