Security Enterprise Architecture for Developers

http://monctonug.net/2015/10/21/security-enterprise-architecture-for-developers/

Jamie will be sharing his thoughts on how an enterprise security architecture program can help in addressing application security issues before any code is written. We've all heard about building security into projects early and the benefits it can bring, Jamie will share the methods he has used to ingrain this mindset into project teams he has worked with. The discussion will touch on how people make decisions about security, how those decisions can be influenced and architectural solutions for common flaws.

Transcript

1. Enterprise Security Architecture
2. The Ladder of Inference Argyris, C., 'Overcoming Organizational Defenses: Facilitating Organizational Learning,' 1st Edition, © 1990 confirmation bias Observable and tangible things Adding meaning to the selected data Problem Definition
3. Change the Language About Security From Negative to Positive Security is an enabler of business Value Definition Gartner case study G00270786 Paul Proctor https://www.gartner.com/doc/3072120/new-brunswick- uses-riskadjusted-value Security is aligned with strategic objectives Security helps business by providing trustworthy advice on meeting those objectives.
5. http://blogs.gartner.com/paul-proctor/2013/08/11/no-one-cares-about-your-security-metrics-and-you-are-to-blame/
6. Architecture and Risk Management • What decision gets made/ action takes place? • Why? • When does happen? • 2 aspects • Who makes/does it? • Actors human/machine • Where?
7. RTIPPA/PIPEDA CASL PCI-DSS OSFI CIP Constraints Sales Cust Support Admins Developers Employees Buy Stuff Option s Select Pay Deliver Name Street Apt Postal Code CHD Customer info https://msdn.microsoft.com/en- us/library/ee823878(v=cs.20).aspx Spoofing Tampering Repudiation Info disclosure Denial of service Elevation of privilege Laws Regulations Contractual Obligations Safety Threats
8. Logical Interface Category 16
9. http://ec.europa.eu/energy/sites/ener/files/documents/xpert_group1_reference_architecture.pdf
11. Legal, regulatory, contractual requirements, organizational policies O u t p u t s I n p u t s Constraints Enablers Requirement s Application Security Physical & Environmenta l Portfolio Management Identity & Access Incident Handling Network Security Strategy & Policy Compliance & Exceptions Cyber Security Management Value Chain Assurance Enterprise Cyber Security Architecture Asset Classification Monitoring & Reporting Platform Security Cyber Security Management Program Human Element Data Security
12. Jamie Rees @securees ca.linkedin.com/in/jamierees