Reality-Checking Your Security Testing Program (2.0)

Most software security testing programs are built to satisfy a compliance requirement or address a pain point. But they're built with misconceptions about what's important, what software quality means, and how software development works in practice.

This presentation explores approaches to improving a security testing practice in an Agile environment, informed by work in and conversations with organizations around the world.

Transcript

1. Reality-Checking Your Security Testing Program Darren P Meyer Senior Security Researcher 2.0
2. Who am I? Senior Security Researcher Certified Scrum Master Senior Security Instructor Senior Technical Architect, IT Security Security Analyst Software Developer/Consultant
3. Justification: Compliance Photo © mlcastle, CC BY 2.0
4. You’re not testing Gather Requirements Build & Test Certify Deploy Warranty & Support Public Domain Photo provided by Peterrhyslewis via Wikimedia Commons Security “Testing”
5. Do Assurance not Control Gather Requirements Build & Test Certify Deploy Warranty & Support Public Domain Photo provided by Peterrhyslewis via Wikimedia Commons Quality Control
6. Security is an Assurance Activity Gather Requirements Build & Test Certify Deploy Warranty & Support Public Domain Photo provided by Peterrhyslewis via Wikimedia Commons Security Testing Security Testing Security Testing
7. Understand your real process Photo © visualpun.ch CC BY SA 2.0
8. We are Agile! Signs you’re actually “Fauxgile”: •  Zero product documentation •  Lots of project documentation •  Teams bigger than about 9 people •  Testing is only done by “QA” •  Lack of key Agile metrics
9. You are not special Public Domain Photo produced by USDA
10. Making Changes Photo © 2008 Mynameisben123 CC BY 2.0
11. Agility Photo © Laura Bittner CC BY 2.0
12. Elasticity Photo © Who-is-me CC BY SA 2.5
13. Discovery Photo © Sebastian Ritter CC BY SA 2.5
14. Culture Photo © Esv CC BY SA 2.5
15. Developers do care about security Photo © 2001 HackNY.org by @matylda CC BY SA 2.0
16. Align incentives Photo © Pat David CC BY SA 2.0
17. People don’t fear change Photo © Felix Burton CC BY 2.0
18. Yep. This. Photo © Daniel X. O’Neil CC BY 2.0
19. Keep Talking Photo © Chiltepinster CC BY SA 3.0 @DarrenPMeyer / #RealitySTP