Shane Curran - Building Security Into The Beginning Of The Development Cycle (Turing Fest 2022)

When it comes to creating, releasing, and maintaining software, startups are usually well-oiled machines. But this is not the case when it comes to securing software. Startups need to move fast but many developers still perceive security as a hindrance and a tax on progress, despite the meaningful increase in cyber risk that is created by neglecting to build secure software. Cool new features are useless if they are vulnerable to malicious exploits.

Head to www.turingfest.com to learn more about Europe's best cross-functional tech conference.

Transcript

1. Building security into the beginning of the development cycle Shane Curran @arcurn
2. Data breaches happen all the time.
3. Security is always a priority, but it’s never priority #1 🔢
4. “Improving our security is on the roadmap, we just need to ship some new features first”
5. But another feature always ends up appearing…
6. Everybody knows startups are great at shipping new features
10. Companies this early on are just focused on survival
11. But survival suddenly turns to growth…
12. Overnight, they go from selling to customers who are using their product because they got a free hoodie…
14. And they start selling to customers who ask you to fill out a security questionnaire before they even look at a demo
17. Founders rush to get SOC 2 ISO 27001 PCI DSS GDPR ASDDFGJASDDSF compliant in a hurry
19. Those six-figure deals hang in the balance when security is an afterthought
20. But then startups buy compliance automation software, find an auditor and get compliant quick… all is well, right?
21. “We’re secure now, our SOC 2 auditor said so!”
22. Compliance ≠ Security
23. Some time passes, and then you meet a Head of Security who looks a little bit less like…
25. And a little more like…
27. Hackerman doesn’t care about your standard operating controls and compliance frameworks
28. Hackerman just SSH’ed into your production database!
29. Hackerman sees no compliance frameworks
30. Hackerman just sees an open port or badly implemented authentication
31. If you’re lucky, Hackerman will be a friendly Head of Security working for a potential customer
32. But what if he’s not? What if he’s actively malicious and posts your data on the web?
33. Now, not only is Hackerman unhappy with your product — compliance teams and lawyers are too! What a mess!
34. Startups are designing security for compliance teams, not for the real enemy: hackers!
35. Q: “Maybe we should hire a security team?”
36. A: “Probably not just yet”
37. Your product team is your security team, they just don’t know it yet ⚖
38. Security in 2022: Build the wall
39. Keeping on top of security tech all day is potentially a full time job 👨💼
40. Modern security doesn’t focus on the root problem 🎯
41. Stop building walls, and start protecting your crown jewels: sensitive data
42. Normal databases: data everywhere
43. Securing data itself 💿
44. What is encryption? 🔐
46. Encryption lets you take a piece of data and “lock” it using a secret key 🔑
47. Anybody who has the encrypted data without the key can’t access the data 🙅
48. But… anybody who steals the key and encrypted data now has the original sensitive data 🥷
49. The key is just as sensitive as the data 🤫
50. Implementing encryption properly is hard You have to… 1. Pick which open source library to use 2. Store the keys yourself 3. Still handle data in plaintext before encrypting it 4. Decrypt the data every time you want to use it
51. Encryption is almost always implemented wrong 🙅
52. Data should always be encrypted ✅
54. Normal databases: data everywhere
55. Encrypted databases: the future
56. Why keys are so important… 🗝 (keys are everywhere)
57. You keep your money at the bank, why not your keys? 🏦
58. Encryption for developers
59. Collect sensitive data from the client
60. Process encrypted data securely
61. Share encrypted data with third-parties
62. Never touch sensitive data in plaintext.
63. You never store keys. Evervault never stores your data.
64. Use Case 1 PII
65. Use Case 2 PCI DSS
66. Use Case 3 Crypto
67. Encryption is a super-tool
68. Developers should be empowered to use it, and to own the security for their own software end-to-end
69. They have the tools now… just about
70. Now we need to wield them!
71. So we can go from a world where…
72. Data breaches happen all the time.
73. What’s a data breach?
74. Thank you! @arcurn shane@evervault.com