Loading...
Share this Job

Internship: Attack patterns and code anomalies as an Active Defense mechanisms F/M

Apply now »

Date: May 9, 2021

City: Mougins Cedex, FR, 06254

Company: SAP

 

 

Requisition ID: 280538
Work Area: Information Technology
Expected Travel: 0 - 10%
Career Status: Student
Employment Type: Limited Full Time

 

COMPANY DESCRIPTION


SAP started in 1972 as a team of five colleagues with a desire to do something new. Together, they changed enterprise software and reinvented how business was done. Today, as a market leader in enterprise application software, we remain true to our roots. That’s why we engineer solutions to fuel innovation, foster equality and spread opportunity for our employees and customers across borders and cultures.

SAP values the entrepreneurial spirit, fostering creativity and building lasting relationships with our employees. We know that a diverse and inclusive workforce keeps us competitive and provides opportunities for all. We believe that together we can transform industries, grow economics, lift up societies and sustain our environment. Because it’s the best-run businesses that make the world run better and improve people’s lives.

 

ABOUT US (TEAM)

Maintaining security is a constantly shifting task, and we need to respond with continuous learning and research. The portfolio of SAP Security Research contains those topics that we believe are most important for SAP’s security future. 


SAP’s vision to secure business is built on 3 ideals: Zero-Vulnerability, to harden the software by eliminating vulnerabilities, Defensible Application, to enable the software to identify and prevent attacks, and Zero-Knowledge, to make any theft of data useless through encryption.


Considering these aspects, SAP Security Research covers the following focal areas: Anonymization for Big Data, Secure Internet of Things, Software security analysis, Open-source analysis, Active Defense, Applied cryptography, Quantum technology, and Machine Learning as enabler for the next generation of security.


PURPOSE AND OBJECTIVES

This internship is based in the SAP Labs France Research Lab, in Sophia-Antipolis. The work will be performed in the context of the Research Program “Security & Trust”, under the “Active Defense” topic. This topic aims at confusing and misdirecting adversaries, undermining their exploitation capabilities.


The goal of the internship is to explore two types of deception and address how these could be added to an application in a way which does not hamper the normal application usage.


An adversary will try to attack following two angles: she will try to recognize patterns she knows from experience that could lead to exploitation, as well as explore out-of-the-ordinary elements as these non-standard parts could come with all sorts of vulnerabilities.


As defenders, we can exploit this behavior by creating artificial patterns and by simulating anomalies. Artificial patterns may be constructed by analyzing known vulnerabilities and mimicking their behavior with specific code. And code anomalies may be constructed by imitating a previously constructed list of observed strange behaviors, such as bugs getting closed without being fixed because they cannot be reproduced.

 

EXPECTATIONS AND TASKS

The expected work is to explore these two topics and to develop a proof-of-concept implementing these types of deceptive traps.
Some of the tasks to be addressed shall include:

  • For attack patterns:
    • Getting familiar with the literature on the topic of honey-patches
    • Exploring vulnerabilities related to cloud applications and infer suitable categories of vulnerability classes for implementation as a pattern
  •  For code anomalies:
    • Building a list of ‘non-reproduceable bugs’ from sources such as Github
    • Classifying them by interest and easiness to be simulated
  • Extend an existing demo application with implementations of such traps

We expect that 40% of time will be dedicated to development and 60% to research activities.

 

PROFILE/EDUCATION/SKILLS AND COMPETENCIES

  • University Level: Last year of MSc in Computer Science or beyond
  • Good command of the java language (Spring boot)
  • Good knowledge of REST APIs / OpenAPI
  • Some experience with blackbox testing (information gathering, fuzzing)
  • Some experience with multi-threading and memory management
  • Ability to read and summarize research papers / write-ups / reports
  • Fluency in English (working language)
  • Abilities in organizing meeting and contacting people
  • Good oral and written communication skills
  • Capacity to write documents in English, ability to synthesize

PROFESSIONAL EXPERIENCE

  • None required
     

WHAT YOU GET FROM US

Success is what you make it. At SAP, we help you make it your own. A career at SAP can open many doors for you. If you’re searching for a company that’s dedicated to your ideas and individual growth, recognizes you for your unique contributions, fills you with a strong sense of purpose, and provides a fun, flexible and inclusive work environment – apply now.

SAP'S DIVERSITY COMMITMENT
To harness the power of innovation, SAP invests in the development of its diverse employees. We aspire to leverage the qualities and appreciate the unique competencies that each person brings to the company.

SAP is committed to the principles of Equal Employment Opportunity and to providing reasonable accommodations to applicants with physical and/or mental disabilities. If you are in need of accommodation or special assistance to navigate our website or to complete your application, please send an e-mail with your request to Recruiting Operations Team (Americas: Careers.NorthAmerica@sap.com or Careers.LatinAmerica@sap.com, APJ: Careers.APJ@sap.com, EMEA: Careers@sap.com).

Successful candidates might be required to undergo a background verification with an external vendor.

Additional Locations


Job Segment: ERP, Developer, Intern, Computer Science, SAP, Technology, Entry Level