Reality-Checking Your Security Testing Program (2.0)

Most software security testing programs are built to satisfy a compliance requirement or address a pain point. But they're built with misconceptions about what's important, what software quality means, and how software development works in practice.

This presentation explores approaches to improving a security testing practice in an Agile environment, informed by work in and conversations with organizations around the world.

Transcript

1. Reality-Checking
   Your Security Testing Program
   Darren P Meyer
   Senior Security Researcher
   2.0
   

   View Slide

2. Who am I?
   Senior Security Researcher
   Certified Scrum Master
   Senior Security Instructor
   Senior Technical Architect, IT Security
   Security Analyst
   Software Developer/Consultant
   

   View Slide

3. Justification: Compliance
   Photo © mlcastle, CC BY 2.0
   

   View Slide

4. You’re not testing
   Gather
   Requirements
   Build & Test
   Certify
   Deploy
   Warranty
   & Support
   Public Domain Photo provided by Peterrhyslewis via Wikimedia Commons
   Security “Testing”
   

   View Slide

5. Do Assurance not Control
   Gather
   Requirements
   Build & Test
   Certify
   Deploy
   Warranty
   & Support
   Public Domain Photo provided by Peterrhyslewis via Wikimedia Commons
   Quality Control
   

   View Slide

6. Security is an Assurance Activity
   Gather
   Requirements
   Build & Test
   Certify
   Deploy
   Warranty
   & Support
   Public Domain Photo provided by Peterrhyslewis via Wikimedia Commons
   Security Testing
   Security Testing
   Security Testing
   

   View Slide

7. Understand your real process
   Photo © visualpun.ch CC BY SA 2.0
   

   View Slide

8. We are Agile!
   Signs you’re actually “Fauxgile”:
   •  Zero product documentation
   •  Lots of project documentation
   •  Teams bigger than about 9 people
   •  Testing is only done by “QA”
   •  Lack of key Agile metrics
   

   View Slide

9. You are not special
   Public Domain Photo produced by USDA
   

   View Slide

10. Making Changes
    Photo © 2008 Mynameisben123 CC BY 2.0
    

    View Slide

11. Agility
    Photo © Laura Bittner CC BY 2.0
    

    View Slide

12. Elasticity
    Photo © Who-is-me CC BY SA 2.5
    

    View Slide

13. Discovery
    Photo © Sebastian Ritter CC BY SA 2.5
    

    View Slide

14. Culture
    Photo © Esv CC BY SA 2.5
    

    View Slide

15. Developers do care about security
    Photo © 2001 HackNY.org by @matylda CC BY SA 2.0
    

    View Slide

16. Align incentives
    Photo © Pat David CC BY SA 2.0
    

    View Slide

17. People don’t fear change
    Photo © Felix Burton CC BY 2.0
    

    View Slide

18. Yep. This.
    Photo © Daniel X. O’Neil CC BY 2.0
    

    View Slide

19. Keep Talking
    Photo © Chiltepinster CC BY SA 3.0
    @DarrenPMeyer / #RealitySTP
    

    View Slide