Why can't developers make it secure?

by Julia Mezher

Slide 1

Slide 1 text

Why can’t developers make it secure? Julia Potapenko

Slide 2

Slide 2 text

Security Software Engineer Julia Potapenko @julepka We help companies to protect their sensitive and valuable data.

Slide 3

Slide 3 text

If you ask developers what is the problem…

Slide 4

Slide 4 text

• Tight deadlines • Feature priorities If you ask developers what is the problem…

Slide 5

Slide 5 text

• Tight deadlines • Feature priorities • Lack of security expertise • Security controls con f lict with other features If you ask developers what is the problem…

Slide 6

Slide 6 text

• Tight deadlines • Feature priorities • Lack of security expertise • Security controls con f lict with other features • Lack of secure architecture If you ask developers what is the problem…

Slide 7

Slide 7 text

https://www.guardsquare.com/state-of-mobile-application-security-report Tight deadlines

Slide 8

Slide 8 text

https://www.guardsquare.com/state-of-mobile-application-security-report Security controls con f lict with other features Necessity of communication https://www.ptsecurity.com/ww-en/analytics/web-vulnerabilities-2020/

Slide 9

Slide 9 text

https://www.microfocus.com/en-us/assets/security/application-security-risk-report Lack of security expertise No secure coding skills https://www.ptsecurity.com/ww-en/analytics/web-vulnerabilities-2020/ https://www.ptsecurity.com/ww-en/analytics/web-vulnerabilities-2020/ https://www.veracode.com/state-of-software-security-report

Slide 10

Slide 10 text

Secure coding is a separate skill Developers can learn general best practices and platform speci f ic recommendations. • Security trainings • Online education materials • Conferences

Slide 11

Slide 11 text

Secure coding is a separate skill Examples: • Data minimisation principle (do not store what you don’t really need) • Validate any input from external sources (user input, network requests, etc) • Deny access by default

Slide 12

Slide 12 text

SDLC Requirements Design Develop Test Deploy

Slide 13

Slide 13 text

SDLC Requirements Design Develop Test Deploy Secure coding

Slide 14

Slide 14 text

Security is invisible - No direct business value. - You can’t see if it’s working, you can see when it fails.

Slide 15

Slide 15 text

The more we delay security – the more effort it takes to be added – the more chances it has to be ignored

Slide 16

Slide 16 text

The longer it takes to f ix an issue, the less chances it has to be f ixed https://www.veracode.com/state-of-software-security-report

Slide 17

Slide 17 text

SDLC Requirements Design Develop Test Deploy Secure coding Security assessment

Slide 18

Slide 18 text

Secure SDLC Requirements Design Develop Test Deploy Risk assessment Threat modelling & design review Secure coding & static analysis Code review & security testing Security assessment & secure con f iguration

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

In a fast-pacing environment… People make poor decisions under the pressure. Secure architecture is about decision making. People mess up the processes under the pressure. Secure architecture is about following the process.

Slide 22

Slide 22 text

Secure Architecture Isn’t it a typical responsibility for developers?

Slide 23

Slide 23 text

Secure architecture – is a combination of structural security decisions that ef f iciently addresses risks considering business goals.

Slide 24

Slide 24 text

Secure architecture – is a combination of structural security decisions… that ef f iciently addresses risks considering

Slide 25

Slide 25 text

Secure architecture – is a combination of structural security decisions that ef f iciently addresses risks… considering business g

Slide 26

Slide 26 text

Secure architecture – is a combination of structural security decisions that ef f iciently addresses risks considering business goals.

Slide 27

Slide 27 text

Secure Architecture - is about decision making process - is based on risks and business goals - is an abstraction Secure Coding - is about writing code - is based on industry guidelines - is platform-speci f ic

Slide 28

Slide 28 text

You operate risks and business goals, abstracting from the tools You operate tools, you don’t make business decisions Secure Architecture - is about decision making process - is based on risks and business goals - is an abstraction Secure Coding - is about writing code - is based on industry guidelines - is platform-speci f ic

Slide 29

Slide 29 text

You operate risks and business goals, abstracting from the tools You operate tools, you don’t make business decisions Creating structure Adding details Secure Architecture - is about decision making process - is based on risks and business goals - is an abstraction Secure Coding - is about writing code - is based on industry guidelines - is platform-speci f ic

Slide 30

Slide 30 text

BUSINESS GOALS BUILD THE ARCH DECISIONS & DESIGN RISKS & TRADEOFFS Building Secure Architecture

Slide 31

Slide 31 text

Building Secure Architecture BUSINESS GOALS BUILD THE ARCH DECISIONS & DESIGN RISKS & TRADEOFFS BUSINESS OWNERS DEV TEAM

Slide 32

Slide 32 text

Building Secure Architecture BUSINESS GOALS BUILD THE ARCH DECISIONS & DESIGN RISKS & TRADEOFFS BUSINESS OWNERS DEV TEAM SECURITY EXPERTS

Slide 33

Slide 33 text

Building Secure Architecture BUSINESS GOALS BUILD THE ARCH DECISIONS & DESIGN RISKS & TRADEOFFS BUSINESS OWNERS DEV TEAM SECURITY EXPERTS

Slide 34

Slide 34 text

Shared Responsibility No one can know everything Who makes decisions? Who plans the work and sets priorities? Who will address security?

Slide 35

Slide 35 text

• Business owners • Product and project managers • Software developers • UI/UX Designers • DevOps team • QA engineers • … Shared Responsibility No one can know everything Who makes decisions? Who plans the work and sets priorities? Who will address security?

Slide 36

Slide 36 text

Shared Responsibility No one can know everything Each platform is different. Secure architecture requires security expertise in each of them. Example: Force upgrade Unlike web, you can’t control when the user updates desktop or mobile app, unless you have implemented additional feature for that. It requires changes from both client and backend.

Slide 37

Slide 37 text

Shared Responsibility No one can know everything Each platform is different. Secure architecture requires security expertise in each of them. Example: Screenshot prevention You can’t prevent screenshots for web apps. Why would you want it for Android app? Because users usually automatically sync photos with Google Photos, iCloud, etc.

Slide 38

Slide 38 text

Ownership If you own, you care

Slide 39

Slide 39 text

Ownership • Understand your role • Know what you are doing are what for • Communicate The goal: each team member knows who to ask questions. If you own, you care

Slide 40

Slide 40 text

Ownership Example: Owning the features • Understand its value • Closer look at related PRs • Keep an eye on updates • Be ready to speak up If you own, you care

Slide 41

Slide 41 text

Ownership Example: Reading security docs “Have you read security policy of your compony?” “Have you read risk assessment and threat modelling docs of your project?” If you own, you care

Slide 42

Slide 42 text

Secure architecture requires security expertise processes shared responsibility ownership

Slide 43

Slide 43 text

Want to learn more? “Designing stack agnostic, modern, secure architectures” by Eugene Pilyankevich https://www.infoq.com/presentations/design-secure-architectures/ “Secure Development Lifecycle” by Jim Manico https://youtu.be/M7qMP3C5bkU https://owasp.org/www-pdf-archive/Jim_Manico_(Hamburg)_-_Securiing_the_SDLC.pdf Collections of security stats reports https://techbeacon.com/security/27-data-security-stats-matter https://techbeacon.com/security/30-app-sec-stats-matter

Slide 44

Slide 44 text

Thank you! Follow me @julepka