AppSec Awareness: A Blue Print for Security Culture Change

Transcript

1. Christopher Romeo CEO / Principal Consultant Security Journey @edgeroute AppSec Awareness: A Blue Print for Security Culture Change
2. About Chris Romeo • CEO / Principal Consultant @ Security Journey • 20 years security experience, CISSP, CSSLP • 10 years at Cisco, leading the Cisco Security Ninja program & CSDL • Speaker at RSA, AppSec USA, AppSec EU, & ISC2 Security Congress @edgeroute
3. Agenda • The Problem Space or why do we need an application security awareness? • Creating sustainable security culture • Application Security Awareness – Designing your own program
4. Software is eating the world
5. 5 Customers demand security in everything
7. Requirements Design Development Test Release The Source of Vulnerabilities Mistake / Bad or Uninformed Decision
8. Relative Cost to Fix 1X 5X 30X 15X 10X
9. The Mindset of the “Average” Developer
10. The Goal Developers that think like security people.
11. Security Culture “What happens {with security} when people are left to their own devices.” --Tim Ferriss
12. 1. Application security is about the people. 2. The people introduce the vulnerabilities.
13. Why change a security culture?
14. Defining Features of a Sustainable Security Culture Deliberate and disruptive Engaging and fun Rewarding Return on investment
15. How do we change a security culture?
16. Open their eyes Awareness
17. Fill their brains Knowledge
18. Fill their brains History
19. Developer Web C / C++ / C# Java Embedded Role Specific Fill their brains
20. Task their hands Activity
21. Embrace the gathering Community
23. Security Awareness Security Training The Security Learning Spectrum
24. Benefits of an #appsec awareness program 1. Everyone gains a foundational knowledge of #appsec and with minimal investment 2. Dev’s learn the detailed lessons of #appsec and avoid repeating history 3. Provides a defined mission through security activity 4. Central connection point for your new crop of security conscious
25. https://blogs.cisco.com/security/the-cisco-security-dojo
26. Building an Application Security Awareness Program 1. Program Architecture 2. Content 3. Humor / Story 4. Gamification
27. Building an Application Security Awareness Program • Design your program and record decisions in a planning document • Impact: Everyone involved in the project understands the vision and execution Program Architecture
28. Assess Security Culture 28
29. Define the problem • Our organizationlacks: – general application security knowledge – appreciation for the evolving threat landscape – experience with secure development practices and tools – motivation to improve security
30. Build a Team
31. Design Decision #1: Theme
32. Design Decision #2: Levels Learning Applying Doing Leading Leader
33. Design Decision #3: Roles Development • SW Engineer • Tester • Manager • HW Engineer Operations • IT • DevOps Internal • Sales • Marketing • Executives Everyone
34. Design Decision #4: Activities & Behaviors Build • A security tool or process • Partnerships • Security community Enrich • Mentor • Teach a course • Deliver presentations Explore • Security issue analysis • Security committee • A vulnerable web app Implement • A security feature • A security test • Security strategy
35. Recognition
36. Budget & Schedule 2016 2017, 18, 19?
37. Building an Application Security Awareness Program Content
38. Assessment
39. Resources
40. Security Fundamentals Attacks & Attackers Simple SDL Security Myths Privacy & Customer Data Protection Security Business Case Level 1 Content Map
41. Level 2 Content Map Web Dev OWASP Top 10 Secure Design Principles Secure Coding for JavaScript Attacking a Web Application Input Validation
42. Outline ID Review Rough Draft Technical review ID Review Final draft Content Creation Process
43. Building an Application Security Awareness Program Humor / Story
44. Examples • Still Cartoons • Full motion cartoons • Video
45. A word of caution…
46. Building an Application Security Awareness Program Gamification
47. User Interface Security Fundamentals Attacks & Attackers Threat Landscape Security Myths Cryptography Privacy
48. Competition
49. Key Takeaways • Vulnerabilities are real and everywhere • Changing security culture – Open their eyes (awareness) – Fill their brains (knowledge / history) – Task their hands (activity) • Building an application security awareness program – Program Architecture – Content – Humor / Story – Gamification
50. Build Your Own
51. Q+A & Contact Chris Romeo, CEO / Principal Consultant chris_romeo@securityjourney.com www.securityjourney.com @edgeroute