Agile Software Security

1,075 views
925 views

Published on

How can security assurance (SA) be applied in agile software development? This presentation discusses reasons for misalignment between agile and SA practices, as well as compatible or even mutually reinforcing techniques. The intuitive concept of evil user stories is explored, and the more wholesome and formal approach of Microsoft, SDL/Agile, is outlined.

Published in: Business
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
1,075
On SlideShare
0
From Embeds
0
Number of Embeds
18
Actions
Shares
0
Downloads
18
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Agile Software Security

  1. 1. Agile Software Security Olli Ahonen
  2. 2. Outline <ul><li>Security assurance </li></ul><ul><li>Misaligned </li></ul><ul><li>Aligned </li></ul><ul><li>Evil user stories </li></ul><ul><li>Microsoft </li></ul>
  3. 3. Outline <ul><li>Security assurance </li></ul><ul><li>Misaligned </li></ul><ul><li>Aligned </li></ul><ul><li>Evil user stories </li></ul><ul><li>Microsoft </li></ul>
  4. 4. Security assurance <ul><li>Design principles </li></ul><ul><li>Static code analysis </li></ul><ul><li>External reviews </li></ul><ul><li>Penetration testing </li></ul><ul><li>... </li></ul>
  5. 5. <ul><li>“ Good old heavyweight assurance processes” </li></ul>K. Beznosov and P. Kruchten
  6. 6. Outline <ul><li>Security assurance </li></ul><ul><li>Misaligned </li></ul><ul><li>Aligned </li></ul><ul><li>Evil user stories </li></ul><ul><li>Microsoft </li></ul>
  7. 7. Root causes
  8. 8. Working software over comprehensive documentation
  9. 9. Big Up-Front Design
  10. 10. Deliver working software frequently
  11. 11. Deliver working software frequently Collective ownership of code
  12. 12. Deliver working software frequently Collective ownership of code Back to square one + =
  13. 13. 3rd party <ul><li>Independence </li></ul><ul><li>Objectivity </li></ul><ul><li>Credibility </li></ul>
  14. 14. Misaligned <ul><li>External reviews </li></ul><ul><li>Analysis and validation </li></ul><ul><li>Test depth analysis </li></ul><ul><li>Manual security testing </li></ul>
  15. 15. Root causes
  16. 16. Outline <ul><li>Security assurance </li></ul><ul><li>Misaligned </li></ul><ul><li>Aligned </li></ul><ul><li>Evil user stories </li></ul><ul><li>Microsoft </li></ul>
  17. 17. Natural match <ul><li>Internal reviews </li></ul><ul><li>Build security in </li></ul>
  18. 18. Works anyway <ul><li>Architecture and design principles </li></ul><ul><li>High-level languages & run-time environments </li></ul><ul><li>Change tracking </li></ul>
  19. 19. Automatic <ul><li>Static code analysis </li></ul><ul><li>Unit testing </li></ul><ul><li>System testing </li></ul>
  20. 20. Outline <ul><li>Security assurance </li></ul><ul><li>Misaligned </li></ul><ul><li>Aligned </li></ul><ul><li>Evil user stories </li></ul><ul><li>Microsoft </li></ul>
  21. 21. Evil user stories <ul><li>From user stories </li></ul><ul><li>“ How can this functionality be misused?” </li></ul><ul><li>Build security in </li></ul>As an employee, I can search for other employees by their last name As an employee, I can alter the database by inserting an SQL search string
  22. 22. Disconnected stories “ User adds “&debug=true” to URL on any page, and receives debug information that discloses system configuration details.”
  23. 23. Missing stories <ul><li>Incomplete </li></ul><ul><li>Inexpressible </li></ul>
  24. 24. Outline <ul><li>Security assurance </li></ul><ul><li>Misaligned </li></ul><ul><li>Aligned </li></ul><ul><li>Evil user stories </li></ul><ul><li>Microsoft </li></ul>
  25. 25. Security Development Lifecycle <ul><li>Attack surface analysis </li></ul><ul><li>Threat modeling </li></ul><ul><li>Cryptography review </li></ul><ul><li>Response plan </li></ul><ul><li>... </li></ul>
  26. 26. SDL/ Agile
  27. 27. SDL/ Agile
  28. 28. SDL/ Agile
  29. 29. SDL/ Agile
  30. 30. Summary <ul><li>Don’t force it </li></ul><ul><li>Nourish synergy </li></ul><ul><li>Aim for secure enough </li></ul>

×