Reality Checking Your Security Testing Program (Converge Detroit 2014)

Your security testing program was built with certain conceptions and biases... and a lot of them are wrong. How do we re-examine our beliefs about software development to improve our testing programs and be ready for Agile, Lean, and DevOps methodologies?

Updated slightly for Converge Detroit 2014 (cf https://speakerdeck.com/darrenpmeyer_vc/reality-checking-your-security-testing-program-source-boston-2014)

Transcript

1. Darren Meyer Senior Security Researcher Reality-checking your Security Testing Program
2. 2 @DarrenPMeyer #RealitySTP Compliance (probably) How did you justify your Security Testing Program?
3. 3 @DarrenPMeyer #RealitySTP critical = (scary * compliance-y)
4. 4 @DarrenPMeyer #RealitySTP Agility Program elasticity 3rd-party components Discovery Things you probably didn’t consider
5. 5 @DarrenPMeyer #RealitySTP Reality Check and how to do better
6. 6 @DarrenPMeyer #RealitySTP Supports development and delivery Requires developer base-level knowledge Security is not “defense” it’s Quality
7. 7 @DarrenPMeyer #RealitySTP Idea → Resource → Requirements → Build & Test → Certification → Warranty & Support Security Testing (usually) Security Testing (BETTER)
8. 8 @DarrenPMeyer #RealitySTP “We’re Lean (or Agile)!” no you aren’t If you are, then what’s your role? QA and Operations Are you Fauxgile?
9. 9 @DarrenPMeyer #RealitySTP Most of your problems are not unique Security is a community If you’re doing a good job, help people If you aren’t, ask for help Security is Quality You are not a special and unique snowflake
10. 10 @DarrenPMeyer #RealitySTP And performance, reliability, maintainability, usability, time-to-market…. No clear & testable requirements? No priority. Developers DO care about security
11. 11 @DarrenPMeyer #RealitySTP Making Changes
12. 12 @DarrenPMeyer #RealitySTP Control vs. Assurance Perfect is the enemy of Good Do QA not (just) QC
13. 13 @DarrenPMeyer #RealitySTP Go to development users’ groups Simplify security requirements Find and mentor security champions automate, automate, automate Process Agility
14. 14 @DarrenPMeyer #RealitySTP Speed up Build reduced policies Help, don’t critique automate, automate, automate Thinking small
15. 15 @DarrenPMeyer #RealitySTP Reduced/Flexible policy sets Checklists and Cheatsheets Automate, Automate, Automate Elasticity
16. 16 @DarrenPMeyer #RealitySTP Trusted, neutral verification Actually test, not just assess Must add value for them too automate, automate, automate Verifying Third Parties
17. 17 @DarrenPMeyer #RealitySTP Follow the money Be a better partner automate, automate, automate Improving discovery
18. 18 @DarrenPMeyer #RealitySTP Accountability Don’t punish: reinforce People don’t fear change they fear being changed Aligning incentives
19. KEEP TALKING tweet @DarrenPMeyer or mention #RealitySTP