Project Springfield https microsoft comspringfield From Research to

Project Springfield https: //microsoft. com/springfield

From Research to Customers “Million dollar” bugs Patrice Godefroid William Blum 2007 : Patrice Godefroid and team invent “whitebox fuzzing” research for finding “million dollar bugs” 2009 : Whitebox fuzzing finds 1/3 of security input validation bugs in Windows 7 development 2013 : Whitebox fuzzing run at scale on multiple Microsoft products in on-premise machine labs 2015 : William Blum joins, leads engineering team for Azure cloud service “Project Springfield” May 2015 : Cloud service live and first customer finds serious bugs with “Project Springfield” 2015 – 2016 : Continuous improvement working closely with under NDA customers and partners September 2016 : “Project Springfield” opens for preview https: //aka. ms/springfield

Customer Obsession • Working with customers and partners from the beginning • Hear who they are and hear their stories now • Demo and tech explanation after

Mike Lemley, Senior Cyber Security Developer Westin Kurlancheek, Sr. Software Engineer in Reliability

Chad Thunberg, Chief Operating Officer Chad Larsen, Director of Technical Services

Leviathan • 10 Year Old Company • Specialize in Risk Management and Information Security • Fortune 10 to Boutique Leviathan clears the path to limitless innovation. We security as extraordinary opportunity; seeing the unforeseen. 9

Our Passion • Mature practices not books of bugs • Leave behind enablement 10

Customer Challenges • Lack specialized resources and scale • Security is a cost center • How do we operationalize security? * https: //www. leviathansecurity. com/cloudsecurity/ 11

Partnership Integration of powerful framework • Solves part of ‘Scarcity’ • Distributes workload 12

Results Enablement (2 assessments) • 9 of 30 (30%) • 3 of 24 (12. 5%) Continuous security (case study) • 464 bugs in 18 months • 21% effort savings 13

OSIsoft and Deschutes Brewery Perfect example of benefits: • Ease of use • Speed • Coverage 14

Leviathan Security Group, Inc. 3223 3 rd Ave S, Suite 100 Seattle, WA 98134 p: 866. 452. 6997 f: 206. 260. 1464 e: contact@leviathansecurity. com www. leviathansecurity. com

Chad A. Holmes Principal, Cybersecurity Ernst & Young LLP Rishi Pande Sr. Manager, Cybersecurity Ernst & Young LLP Email: chad. holmes 1@ey. com Email: rishi. pande@ey. com

Demo

Deeper dive

Springfield includes whitebox fuzzing void top(char input[4]) input = “good” { int cnt = 0; Path constraint: if (input[0] == ‘b’) cnt++; I 0!=‘b’ I 0=‘b’ bood if (input[1] == ‘a’) cnt++; I 1!=‘a’ I 1=‘a’ gaod if (input[2] == ‘d’) cnt++; I 2!=‘d’ I 2=‘d’ godd if (input[3] == ‘!’) cnt++; I 3!=‘!’ I 3=‘!’ goo! if (cnt >= 4) crash(); } Gen 1 Microsoft constraint solver Create new constraints to cover new paths Solve new constraints new inputs good

Springfield includes whitebox fuzzing void top(char input[4]) input = “bad!” “bood” “badd” { int cnt = 0; Gen 1 Gen 2 Gen 3 Gen 4 Path constraint: if (input[0] == ‘b’) cnt++; I 0!=‘b’ I 0=‘b’ bood … if (input[1] == ‘a’) cnt++; I 1!=‘a’ I 1=‘a’ gaod baod … if (input[2] == ‘d’) cnt++; I 2!=‘d’ I 2=‘d’ godd … badd … if (input[3] == ‘!’) cnt++; I 3!=‘!’ I 3=‘!’ goo! … bad! if (cnt >= 4) crash(); } Create new constraints to cover new paths Solve new constraints new inputs Whitebox fuzzing finds the crash!

Thank you! What’s next? • Meet the speakers! • Visit Springfield booth in Expo and meet the team! • Attend more Security sessions BRK 2239 BRK 2130 BRK 3138 BRK 3293 BRK 2132 BRK 4021 Delight users and IT with modern identity experiences on Windows 10 Protect your business data using Windows Information Protection Monitor actor groups and detect targeted attacks with Microsoft’s Hunter Team Look under the hood: bypassing antimalware tactics and infrastructure response Methods End the game for credential theft with Microsoft Windows 10 Discover Microsoft Windows 10 Internals • Sign up for Project Springfield Preview at https: //microsoft. com/springfield

www. microsoft. com/itprocareercenter www. microsoft. com/itprocloudessentials www. microsoft. com/mechanics https: //techcommunity. microsoft. com

http: //myignite. microsoft. com https: //aka. ms/ignite. mobileapp