Prioritizing Trust while Creating Applications

Managing risk needs to scale as your product grows in popularity and complexity. In traditional software development, often security was treated as a last gating factor at best and post-incident concern at worst. How do we shift our security processes left - in other words, earlier in the development lifecycle? The cost of applying security practices too late can be catastrophic to a company, leading to the loss of customer trust and affecting the bottom line.

In this session learn how to leverage security tools and recommended practices to enable everyone to play a part in securing your application from discovery to operation of your application.

Transcript

1. Prioritizing Trust while Creating Applications Jennifer Davis, Cloud Advocate she/her  @sigje 1/40
2. 2/40
3. Trust 3/40
4. 4/40
5. https://haveibeenpwned.com/ 5/40
6. 6/40
7. 7/40
8. 8/40
9. Agenda Establish
   Common
   Context Build
   Foundations Advancing
   Principles 9/40
10. 10/40
11. 11/40
12. Bug versus Flaw 12/40
13. Motivations Financial
    Gain Espionage/Strategic
    Gain Fun/Ideology/Grudge 13/40
14. Build Foundations 14/40
15. Defense in Depth 15/40
16. Snyk State of Open Source Security Report 2019 78%
    vulnerabilities
    in
    indirect
    dependencies 37%
    of
    open
    source
    developers
    no
    security testing
    in
    CI 54%
    docker
    image
    no
    security
    testing Top
    10
    docker
    images
    contain
    >
    30
    vulnerable system
    libraries Source:
    https://snyk.io/opensourcesecurity- 2019/ 16/40
17. #WOCinTech
    Chat
    Attribution
    2.0
    Generic
    (CC
    BY 2.0) 17/40
18. What
    can
    a
    user
    see?
    do? What
    information
    is
    logged? Approach
    for
    failed
    logins OWASP:
    Application
    Security
    Verification
    Standard Project 18/40
19. Threat Modeling 19/40
20. Architectural Trade-offs 20/40
21. 21/40
22. 22/40
23. Testing Code 23/40
24. Static Code Analysis 24/40
25. Source: https://www.imperialviolet.org/2014/02/22/applebug.htm 25/40
26. Coding Standards 26/40
27. Secure Code Reviews 27/40
28. Planning for Security Escalations Identify Assess Remediate 28/40
29. Incident Response Resource Building
    a
    Minimum
    Viable
    Response
    Plan: jhand.co/CreateResponsePlan 29/40
30. 30/40
31. Leverage your platform's services Recognize your platform's limits 31/40
32. 32/40
33. 33/40
34. Advancing Principles 34/40
35. Bug Bounty Programs 35/40
36. Capture the Flag (CTF)
    -
    CTF
    distributed
    team
    for
    Nonbinary Folks
    and
    Women CTF
    Circle 36/40
37. Red Team Exercise 
    Fundamentally,
    if
    somebody wants
    to
    get
    in,
    they’re
    getting in accept
    that.
    What
    we
    tell clients
    is:
    Number
    one,
    you’re
    in the
    fight,
    whether
    you
    thought you
    were
    or
    not.
    Number
    two,
    you almost
    certainly
    are
    penetrated.
    -
    Michael
    Hayden,
    Former
    Director
    of
    NSA
    &
    CIA 37/40
38. What's Next? Identify
    your
    security
    maturity Assess
    valuable
    practices Encourage
    learning
    security
    skills Incorporate
    feedback Update
    threat
    models 38/40
39. 39/40
40. Thank you Email: jennifer@modernoperations.org  @sigje Open
    Spaces
    CoffeeOps
    September
    27,
    8:30am Ongoing
    -
    Abby
    Bangser,
     :
    @a_bangser https://tinyurl.com/DODLON19OSF 40/40