Leveling up a global application security program

In this talk, David will relay lessons learned from his first year working in the application security program at Riot Games.

David will explain how he assessed the level of the program when he joined, and what gaps he identified. He will give an overview of how Riot approaches application security in a fast paced, agile environment. This will include how Riot implements controls which do not negatively impact product development or player experience. David will explain how Riot provides secure coding guidance to software engineers, works with QA, and maintains an application security community of practice.

There are many options when it comes to understanding and improving an application security program. This talk will address Riot's efforts in this regard.

Transcript

1. Leveling up an application security program David Rook
2. Agenda Riot App Sec Recommendations Intro
3. INTRO Intro
4. David Rook Security Engineer, Riot Games 9 years of application security experience Gamer (not a good one)
5. RIOT GAMES Developer & publisher of League of Legends Focused on player experiences first Gamers who take play seriously
6. 1500+ RIOTERS 15 OFFICES SANTA MONICA ST. LOUIS NEW YORK SAO PAULO SANTIAGO MEXICO CITY DUBLIN MOSCOW COLOGNE SEOUL ISTANBUL TAIPEI SYDNEY HONG KONG TOKYO
8. Launched in 2009
9. LEAGUE OF LEGENDS STATS 7.5MILLION PEAK CONCURRENT PLAYERS STATS  RELEASED  JANUARY  2014   67MILLION MONTHLY ACTIVE PLAYERS MORE THAN 27MILLION DAILY ACTIVE PLAYERS MORE THAN MORE THAN
10. League of Legends eSports
11. RIOT APP SEC Riot App Sec
12. Riot App Sec
13. Placing App Sec Wards
14. Riot App Sec 2014 RFCs Goals Community Guidance Training Vulnerabilities Rewards
15. Riot App Sec - Goals
16. ‣  Work  with  engineers  to  develop  applicaCon  security  standards  that  make  it  easier  to  write   secure  code   ‣  Help  Rioters  understand  the  principles  of  secure  development  and  what  libraries  and  tools   you  can  use  to  implement  the  principles   ‣  Develop  and  implement  an  applicaCon  security  training  program  delivered  by  internal  staff   and  leading  industry  experts   ‣  Engage  with  the  worldwide  applicaCon  security  community  and  share  our  success  stories   whilst  learning  from  others   ‣  Ensure  that  every  engineer  in  Riot  Games  has  the  knowledge,  standards,  libraries  and  tools   they  need  to  write  secure  code   Riot App Sec - Goals
17. Riot App Sec - Community
18. Riot App Sec - Community
19. Sharing App Sec Knowledge RADICALLY DISCONNECTED SHARE NOTHING SHARE EVERYTHING RADICALLY CONNECTED
20. ‣  The  community  of  pracCce  meeCngs  allowed  us  to  understand  what  guidance  our  engineers   need     ‣  Where  do  your  engineers  usually  go  for  guidance  and  informaCon  sharing?   Riot App Sec - Guidance
21. Riot App Sec - Guidance
22. Security Testing Security Reviews Vulnerabilities Secure Code Secure Design
23. Security Testing Security Reviews Vulnerabilities Secure Design Secure Code
24. Security Testing Security Reviews Vulnerabilities Secure Design Secure Code
25. Security Testing Security Reviews Vulnerabilities Secure Design Secure Code
26. Security Testing Security Reviews Vulnerabilities Secure Design Secure Code
27. Riot App Sec - Guidance
28. Riot App Sec - Guidance
29. Riot App Sec - Vulnerabilities
30. Riot App Sec - Data Source:  hPp://www.nyCmes.com/interacCve/2014/10/10/technology/league-­‐of-­‐legends-­‐graphic.html  
31. Riot App Sec - Training
32. Riot App Sec - RFCs
33. Riot App Sec - Rewards
34. Riot App Sec - Rewards
35. 2015 Data Community Guidance Automation Training
36. RECOMMENDATIONS Recommendations
37. Recommendations •  Set clear goals for your application security program •  Focus on enabling rather than disabling and blocking •  Try to provide continual, high quality knowledge sharing •  Speak to your engineers and find out what they want from you •  Always remember to KISS app sec!
38. Riot InfoSec – Building Our Team
39. Questions?