Reality Checking Your Security Testing Program (Converge Detroit 2014)

Your security testing program was built with certain conceptions and biases... and a lot of them are wrong. How do we re-examine our beliefs about software development to improve our testing programs and be ready for Agile, Lean, and DevOps methodologies?

Updated slightly for Converge Detroit 2014 (cf https://speakerdeck.com/darrenpmeyer_vc/reality-checking-your-security-testing-program-source-boston-2014)

Transcript

1. Darren Meyer
   Senior Security Researcher
   Reality-checking your
   Security Testing Program
   

   View Slide

2. 2
   @DarrenPMeyer #RealitySTP
   Compliance
   (probably)
   How did you justify your
   Security Testing Program?
   

   View Slide

3. 3
   @DarrenPMeyer #RealitySTP
   critical = (scary * compliance-y)
   

   View Slide

4. 4
   @DarrenPMeyer #RealitySTP
   Agility
   Program elasticity
   3rd-party components
   Discovery
   Things you probably didn’t consider
   

   View Slide

5. 5
   @DarrenPMeyer #RealitySTP
   Reality Check
   and how to do better
   

   View Slide

6. 6
   @DarrenPMeyer #RealitySTP
   Supports development and delivery
   Requires developer base-level knowledge
   Security is not “defense”
   it’s Quality
   

   View Slide

7. 7
   @DarrenPMeyer #RealitySTP
   Idea
   → Resource
   → Requirements
   → Build & Test
   → Certification
   → Warranty & Support
   Security Testing
   (usually)
   Security Testing
   (BETTER)
   

   View Slide

8. 8
   @DarrenPMeyer #RealitySTP
   “We’re Lean (or Agile)!”
   no you aren’t
   If you are, then what’s your role?
   QA and Operations
   Are you Fauxgile?
   

   View Slide

9. 9
   @DarrenPMeyer #RealitySTP
   Most of your problems are not unique
   Security is a community
   If you’re doing a good job, help people
   If you aren’t, ask for help
   Security is Quality
   You are not a
   special and unique snowflake
   

   View Slide

10. 10
    @DarrenPMeyer #RealitySTP
    And performance, reliability, maintainability,
    usability, time-to-market….
    No clear & testable requirements?
    No priority.
    Developers DO care about security
    

    View Slide

11. 11
    @DarrenPMeyer #RealitySTP
    Making Changes
    

    View Slide

12. 12
    @DarrenPMeyer #RealitySTP
    Control vs. Assurance
    Perfect is the enemy of Good
    Do QA not (just) QC
    

    View Slide

13. 13
    @DarrenPMeyer #RealitySTP
    Go to development users’ groups
    Simplify security requirements
    Find and mentor security champions
    automate, automate, automate
    Process Agility
    

    View Slide

14. 14
    @DarrenPMeyer #RealitySTP
    Speed up
    Build reduced policies
    Help, don’t critique
    automate, automate, automate
    Thinking small
    

    View Slide

15. 15
    @DarrenPMeyer #RealitySTP
    Reduced/Flexible policy sets
    Checklists and Cheatsheets
    Automate, Automate, Automate
    Elasticity
    

    View Slide

16. 16
    @DarrenPMeyer #RealitySTP
    Trusted, neutral verification
    Actually test, not just assess
    Must add value for them too
    automate, automate, automate
    Verifying Third Parties
    

    View Slide

17. 17
    @DarrenPMeyer #RealitySTP
    Follow the money
    Be a better partner
    automate, automate, automate
    Improving discovery
    

    View Slide

18. 18
    @DarrenPMeyer #RealitySTP
    Accountability
    Don’t punish: reinforce
    People don’t fear change
    they fear being changed
    Aligning incentives
    

    View Slide

19. KEEP TALKING
    tweet @DarrenPMeyer or mention #RealitySTP
    

    View Slide