pagerduty/security-training

Public version of PagerDuty's employee security training courses.

PagerDuty Security Training

This is a public version of the Security Training material used internally at PagerDuty for our annual employee security training.

You can view the content directly in this repository, or rendered as a website at https://sudo.pagerduty.com.

Development

We use MkDocs to create a static site from this repository.

Native

For local development on your native device,

1. Install MkDocs. pip install mkdocs
2. Install MkDocs PyMdown Extensions. pip install pymdown-extensions
3. Install Pygments if you want syntax highlighting for any code examples. pip install pygments
4. Install the PagerDuty MkDocs Theme.
   1. git clone https://github.com/pagerduty/mkdocs-theme-pagerduty
   2. cd mkdocs-theme-pagerduty & python3 setup.py install
5. To test locally, run mkdocs serve from the project directory.
6. You can now view the website in your browser at http://127.0.0.1:8000. The site will automatically update as you edit the code.

Docker

For local development using Docker,

1. Build the docker image and load it for immediate use. docker build --load -t mkdocs .
2. Run the container and pass through your current working directory. docker run -v $(pwd):/docs -p 127.0.0.1:8000:8000 mkdocs
3. You can now view the website in your browser at http://127.0.0.1:8000. The site will automatically update as you edit the code.

Note: If you're using an Apple Silicon device, add --platform linux/arm64/v8 to the docker build command to get a native Apple Silicon image. That will work faster than translating an arm64 image.

Deploying

1. Run mkdocs build --clean to produce the static site for upload.

2. Upload the site directory to S3 (or wherever you would like it to be hosted).

    aws s3 sync ./site/ s3://[BUCKET_NAME] \
      --acl public-read \
      --exclude "*.py*" \
      --delete
   

License

Apache 2 (See LICENSE file)

Contributing

Thank you for considering contributing! If you have any questions, just ask - or submit your issue or pull request anyway. The worst that can happen is we'll politely ask you to change something. We appreciate all friendly contributions.

Here is our preferred process for submitting a pull request,

1. Fork it ( https://github.com/PagerDuty/security-training/fork )
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create a new Pull Request.

security-training's Issues

Make slide sources available

Could you make the source of the slides available as part of this repo? Perhaps a Google slides link?

Typo

Oh hi Rich. May I have access to this repo so I can create a PR for a typo?

Server Side Request Forgery

I think it would be a good idea to add some slides in the "for engineers" deck that talk about Server Side Request Forgery (SSRF). As more applications are built (or migrated) using public cloud providers like AWS, SSRF attacks on metadata APIs will become more prevalent.

These are some resources on SSRF:

• https://application.security/
• https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf
• https://blog.appsecco.com/an-ssrf-privileged-aws-keys-and-the-capital-one-breach-4c3c2cded3af

Takeaways for engineers:

• Follow the principle of least privilege to contain the blast radius.
• Don't blindly trust URLs from the client. Exercise caution when implementing URL unfurling logic or the like.
• Ensure any data retrieved from an API has the expected format before sending it to the client or clients. e.g. If an image is expected, ensure that an image was retrieved.
• For code that is meant to access public URLs, ensure it cannot access internal endpoints.
  ** Don't rely on regular expressions alone to filter out "bad IP addresses".

Missing pymdown extension

I had an issue where mkdocs serve didn't run... had to run

pip install pymdown-extensions

To get things to work. Might be nice to add to the instructions.

Also, amazing docs! The amount of work you're going to save IT Security people around the world is huge.

pagerduty_security_training_for_everyone_part_ii_public asset not usable

The pagerduty_security_training_for_everyone_part_ii_public.key Keynote presentation is not downloadable. Is it possible to update the asset again? File size is 134 bytes and seems to be either corrupt or not uploaded successfully.

Bad advice regarding mnemonics for master passphrases

Despite linking to the famous XKCD comic, this document fails to heed the basic lesson that a passwords which a human must memorize should be easy for a human to memorize while being hard for a computer to guess. Master passwords for the password manager are an example of such.

A decent password manager can generate a proper passphrase: a series of native language words spelled correctly in simplest form (such as lowercase). These mnemonic phrases allow the average person to store more random entropy with less effort, and far less chance of forgetting their password.

Complex sequences of gibberish will result in users writing down passwords, reducing their entropy, or wasting excessive and unnecessary effort memorizing less entropy than they otherwise could, with a higher chance of forgetting after a vacation or break.

For passwords which can must be mnemonic, such as a master passphrase, I would change the advise to using a mnemonic phrase instead of random individual characters.

Typo in for_everyone_part_iii

Hi,

In

security-training/docs/for_everyone_part_iii/index.md

Line 1962 in ed2437d

I won't like, it can seem like a bit of a chore at first, it might feel like you're writing lines on a chalkboard. But you'll be amazed at how quickly you're able to remember really complicated passwords this way. Soon enough muscle memory will kick in and you'll have it perfectly memorized. And remember, you only have to do this for one password, your master password. Every other password will be protected by your password manager.

I think you meant "I won't lie".

Typo in for_everyone_part_ii ?

I'm not a native English speaker but it seems there is a typo in docs/for_everyone_part_ii/index.md

What is your business continuity plan in the even of a global pandemic?

I think event is more appropriate here.