AppSec Awareness: A Case Study in Security Culture Change

How does an individual change the application security culture of an organization? By deploying an application security awareness program with engaging content, humor, and recognition. See the blue print for how you can build an application security awareness program based on real life experience. Change the security DNA of everyone in your organization.

Transcript

1. APPLICATION SECURITY AWARENESS: A CASE STUDY IN SECURITY CULTURE CHANGE CHRISTOPHER ROMEO CEO / PRINCIPAL CONSULTANT SECURITY JOURNEY @EDGEROUTE
2. About Chris Romeo • CEO / Principal Consultant @ Security Journey • 20 years security experience, CISSP, CSSLP • 10 years at Cisco, leading the Cisco Security Ninja program & CSDL • Speaker at RSA, AppSec USA, AppSec EU, & ISC2 Security Congress • Co-host of the #AppSec PodCast @edgeroute Copyright © Security Journey, 2016
3. Agenda ▪The Problem Space or why do we need application security? ▪Creating sustainable security culture ▪Application Security Awareness Copyright © Security Journey, 2016
4. Software is eating the world
5. 5 Customers demand security in everything
6. OWASP TOP 10 https://owasp.org/index.php/TopTen
8. Relative Cost to Fix 1X 5X 30X 15X 10X
9. The Mindset of the “Average” Developer
10. Developers are not monsters. They want to do the right thing.
11. The Goal Developers that think like security people.
12. Security Culture “What happens {with security} when people are left to their own devices.” --Tim Ferriss
13. 1. Application security is about the people. 2. The people introduce the vulnerabilities.
14. Why change a security culture?
15. Defining Features of a Sustainable Security Culture Deliberate and disruptive Engaging and fun Rewarding Return on investment
16. How do we change a security culture?
17. Open their eyes Awareness
18. Fill their brains Knowledge
19. Fill their brains History
20. Developer Web C / C++ / C# Java Embedded Role Specific Fill their brains
21. Task their hands Activity
22. Embrace the gathering Community ”Security Champions”
23. Security Awareness Security Training The Security Learning Spectrum
24. Benefits of Changing Security Culture 1.Everyone gains a foundational knowledge of #appsec and with minimal investment 2.Dev’s learn the detailed lessons of #appsec and avoid repeating history 3.Provides a defined mission through security activity 4.Central connection point for your new crop of security conscious
25. https://blogs.cisco.com/security/the-cisco-security-dojo
26. Building an Application Security Awareness Program 1. Program Architecture 2. Content 3. Humor / Story 4. Gamification
27. Assess Security Culture 27
28. Define the problem ▪ Our organizationlacks: – general application security knowledge – appreciation for the evolving threat landscape – experience with secure development practices and tools – motivation to improve security
29. Build a Team
30. Design Decision #1: Theme
31. Design Decision #2: Levels Learning Applying Doing Leading Leader
32. Design Decision #3: Roles Development ••SW Engineer ••Tester ••Manager ••HW Engineer Operations ••IT ••DevOps Internal ••Sales ••Marketing ••Executives Everyone
33. Design Decision #4: Activities & Behaviors Build ••A security tool or process ••Partnerships ••Security community Enrich ••Mentor ••Teach a course ••Deliver presentations Explore ••Security issue analysis ••Security committee ••A vulnerable web app Implement ••A security feature ••A security test ••Security strategy
34. Recognition
35. Schedule 2016 2017, 18, 19?
36. Content
37. Assessment
38. Resources
39. Security Fundamentals Attacks & Attackers Simple SDL Security Myths Privacy & Customer Data Protection Security Business Case Level 1 Content Map
40. Level 2 Content Map Web Dev OWASP Top 10 Secure Design Principles Secure Coding for JavaScript Attacking a Web Application Input Validation
41. Outline ID Review Rough Draft Technical review ID Review Final draft Content Creation Process
42. Copyright © Security Journey, 2016 Example Content: The Vulnerability Continuum 1 2 3 Vulnerability – a weakness in a system, application, or network that is subject to exploitation or misuse Exploit – a program that allows attackers to automatically break into a system Attack – An attempt to gain unauthorized access
43. Humor / Story
44. Examples ▪Still Cartoons ▪Full motion cartoons ▪Video
45. A word of caution…
46. Gamification
47. User Interface Security Fundamentals Attacks & Attackers Threat Landscape Security Myths Cryptography Privacy
48. Competition
49. Key Takeaways ▪ Vulnerabilities are real and everywhere ▪ Changing security culture… – Open their eyes (awareness) – Fill their brains (knowledge / history) – Task their hands (activity) ▪ A Programmatic Approach – Content – Humor / Story – Gamification
50. Build Your Own
51. Security White Belt Copyright © Security Journey, 2016 Fundamentals Attacks & Attackers Breached! Business Case Myths Threat Landscape: IoT, Cloud, Mobile Software Supply Chain Culture and Mindset Managing Resources Soft Skills Secure Development Lifecycle Privacy & Customer Data Protection Product Incident Response Knowledge Sources www.securityjourney.com
52. Thank you! Chris Romeo, CEO / Principal Consultant chris_romeo@securityjourney.com www.securityjourney.com @edgeroute Copyright © Security Journey, 2016