Security stories in online payment company

Transcript

1. 13 December 2018 • Raden Ardiansyah Natakusumah • FintechNite • UnionSPACE, Jakarta Security stories in online payment company
2. https://about.me/r_u_l_l_y
3. Newbie
4. 14.5 years
10. Registered Penetration Tester
11. Practitioner Security Analyst
14. The Story ….
15. Online Payment Company
16. Potential Employees
17. Minimize the Risk
18. Human Resource Department
19. Background Checks
20. Criminal Record
21. Reference Checks
22. Credit History
23. 1st Day!
24. Onboarding Process
25. Security Awareness Training
26. All New Hires
27. Information Security Policy
28. And Other Policies
29. Developer
30. Secure Coding Training
31. Incident Response Team
32. From various departments
33. Incident Response Training
34. See You Next Year!
35. Time to work!
36. Don’t forget …
37. Use Badge
38. Infra Team
39. Review the Network Diagram
40. Review the configuration
41. Review the rules
42. Update patches
43. Support Team
44. Anti Malware, Personal Firewall
45. Change default credential, default configuration
46. Asset inventory
47. Dev Team
48. Develop Secure Applications
49. Secure Coding Guidelines
50. OWASP, SANS CWE Top 25
51. Security Team
52. Security Code Review
53. Vulnerability Assessment
54. Penetration Testing
55. Examine documents changes
56. Business Justification? Tested? Approved?
57. Monitoring
58. Logs, Security Events
59. At a time ….
60. Incident occurred
61. Incident Response Plan
62. Roles, responsibilities, and communication
63. Follow the procedure
64. Post-incident investigation
65. Business Team
66. Business Needs
67. External Entity
68. Regulator
69. Need compliance!
71. ISO 27001
72. PCI DSS
73. Not that hard
74. Why?
75. Focus
76. Security
77. Not Compliance
78. Security
79. ALL responsibility
80. Security
81. Business as Usual
82. Questions?
83. Lawrence Lessig method - 2005
84. 84 LET’S GO.