Security Culture: Here be Hackers

Slide 1

Slide 1 text

Security Culture: Here be Hackers Taras Ivashchenko

Slide 2

Slide 2 text

2 /about ● 10+ years in security ● Top Internet companies in Russia ● Product security team lead in OZON ● OWASP Russia chapter leader ● @oxdef

Slide 3

Slide 3 text

3 Who are hackers?

Slide 4

Slide 4 text

4 «a person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular» RFC 1983

Slide 5

Slide 5 text

5 We want to ● Avoid questions about typical vulnerabilities ● Make developers aware of security processes and controls ● Make developers read security guides ● Make it possible for developers to improve security in the products ● Developers to become security hackers

Slide 6

Slide 6 text

6 Do developers even know if the security team exists?

Slide 7

Slide 7 text

7 Security in developer’s life ● Interview ● Bootcamp ● The first day at work ● ... cup of coffee ● ... lines of code ● … product meeting ● ... security audit and security issues

Slide 8

Slide 8 text

8 The communication

Slide 9

Slide 9 text

9 The first day at work ● Welcome meeting and small introduction talk about security processes ● Internal staff portal with API ● Use this API to monitor for new developers ● Automatically send them welcome letter from security team

Slide 10

Slide 10 text

10 How to write secure code at our company Dear Mike, Welcome to our team! Here at our company we make beautiful, functional, fast AND secure services! Security team had prepared security guides for you: https://internal-security-portal/guides. Please, find some time to read them as soon as possible. If you have any questions feel free to contact us. -- Your Product Security Team

Slide 11

Slide 11 text

11 Corporate messenger ● #help-security for asking questions ● #news-security for IT security news and awareness posts from security team ● @security for calling security team ● @security-bot for security alerts ● Loading screen messages

Slide 12

Slide 12 text

Slide 13

Slide 13 text

13 Communication channels ● Welcome letter ● Tickets about security issues in bug tracking system ● Small channels in dev tools like banners ● Internal security portal with active blog ● Channels and chats in messenger ● Internal tech meetups ● Security mailing list

Slide 14

Slide 14 text

14 Internal security portal ● Security guides ● Quick links to security self-checking services ● «Ask Security» contact form ● Latest posts from internal security blog ● Current projects

Slide 15

Slide 15 text

15 The guide

Slide 16

Slide 16 text

16 Structure ● Separate guides for web, mobile and C/C++ developers ● From common topics and practices to typical issues and specific cases ● Use cards as a format for publicating complex issues ● Developers Humans don’t want to read “long read” articles ● Content should be easily searchable ● Integrated self-assessment quiz and feedback form

Slide 17

Slide 17 text

17 Content ● High-level best practices: authentication/authorization, input validation, output encoding, error handling ● Security team internal processes, services and controls ● Typical threats and mitigations ● Specific internal topics and processes

Slide 18

Slide 18 text

18 Do not write yet another security guide from scratch!

Slide 19

Slide 19 text

19 Combine ● OWASP Proactive Controls ● OWASP Top 10 ● Specific for your case topics Base

Slide 20

Slide 20 text

20 Test yourself

Slide 21

Slide 21 text

21 Quizzes and courses ● To measure how well developers read the guides ● Should not take a lot of time ● Should not be boring! ● Use FOSS, e.g. learning management system like Moodle ● Other interesting tools: OWASP Security Knowledge Framework, Hacksplaining, Codebashing

Slide 22

Slide 22 text

22 Developer’s profile ● Badges for various security activities ● Special flags, e.g. for reading our guides ● Security “karma” ● Use this information to make more accurate threat analysis of new releases

Slide 23

Slide 23 text

23 Blueprint and metrics ● OWASP SAMM: Education & Guidance ● 60% developers briefed on security guides within the past year ● No more less questions about security issues ● More followers in internal security channels

Slide 24

Slide 24 text

24 Next steps ● CTFs ● Security months ● Gamification ● Security Champions and Ninjas

Slide 25

Slide 25 text

25 Takeaways ● Application security should be closer to developers ● Help developers to make secure applications ● Make possible for developers to help you in your duties ● Let developers be security champions ● It should be fun ☺

Slide 26

Slide 26 text

26 Movies for weekend ● Mr.Robot series ● Hackers ● 23 ● WarGames ● The IT crowd ● Kung Fury :)

Slide 27

Slide 27 text

27 Thank you!