Lean and (Prepared for) Mean: Application Security Program Essentials

Lean and (Prepared for) Mean:Application Security Program Essentials
Philip J. Beyer - Texas Education Agency
philip.beyer@tea.state.tx.us
John B. Dickson - Denim Group
john@denimgroup.com
1
TASSCC 2011 Annual Conference
Copyright 2011 by Texas Education Agency. All rights reserved.

Overview
Background
Trends
Essentials
Roadmap
2

About
Phil Beyer
Information Security Officer
Consulting background
John Dickson
Application security industry leader
TEA
~700 employees
~1200 school districts
~5 million students
3

Application Security – What? Why?
In Brief
Web applications can be attacked
Attacks are different from network or OS levels
Becoming a significant attack vector
Impact
Attackers bypass traditional infrastructure security controls
Users are a target as well as data
4

Trends
At TEA
Applications created regularly and retired slowly
Ability to outsource remediation decreased due to funding limitations
In the Industry
Attacks are increasingly sophisticated and automated
Remediation costs increase in later phases of the development cycle
5

EssentialsWhere Did TEA Start
Application Security Program established
Some policy and procedure
Initial training and exposure to concepts
Historically siloed approach
Outsourcing for subject matter expertise
Veracode
Denim Group
6

EssentialsThe Premise
Some things you Don’t Need
Some things you Do Need
Some things you Just Don’t Need Yet
7

EssentialsWhat You Don’t Need
An Expensive Scanner
A Security Process for scanning is more important
Simple (free) scanners will get you started
Buy the software later
8

A Complicated Scoring/Tracking Tool
A Security Process for profiling is more important
Risk ranking doesn’t have to be hard
Keeping track of your applications can be simple
Buy the software later
9

A Dedicated Application Security Team
A Security Process for testing is more important
Leverage your existing QA and Testing team
Simple security testing will get you started
Build and train your testing capability gradually
10

A Perfect SDLC
Get started with what you have now
Update your policies and procedures as you go
Don’t try to drop in “The Secure SDLC” all at once
11

EssentialsWhat You Do Need
A Champion
That’s You!
Understand the problem
Communicate the risk
Work with the business
12

A Team that Gets It
Managers
Developers
Testers
Security
13

Good Training
Resources exist, some are free
The trainer is important
Attacks evolve, so should your training
14

Expert Help
Technical questions will arise
Some vendors will dispute vulnerabilities
Be sure your team can consult with experts
15

A Roadmap to Maturity
Use an established maturity model
OpenSAMM
BSIMM
Design a roadmap to get to maturity
Don’t try to do it all at once
16

RoadmapUse a Maturity Model
OpenSAMM - Software Assurance Maturity Model
Maturity levels 1 thru 4
Governance
Strategy & Metrics (2), Policy & Compliance (3), Education & Guidance (3)
Construction
Threat Assessment (3), Security Requirements (3), Secure Architecture (3)
Verification
Design Review (2), Code Review (2), Security Testing (3)
Deployment
Vulnerability Management (3), Environment Hardening (3), Operational Enablement (3)
17

Roadmap – Phase 1Governance
Estimate overall business risk profile
Build and maintain an application security program roadmap
Build and maintain compliance guidelines
Conduct technical security awareness training
Build and maintain technical guidelines
18

Roadmap – Phase 1Construction
Derive security requirements based on business functionality
Evaluate security and compliance guidance for requirements
19

Roadmap – Phase 1Verification
Derive test cases from known security requirements
Conduct penetration testing on software releases
20

Roadmap – Phase 1Deployment
Identify point of contact for security issues
Create informal security response team(s)
21

Resources
OWASP – Open Web Application Security Project
http://www.owasp.org/
OpenSAMM - Software Assurance Maturity Model
http://www.opensamm.org/
Denim Group – Remediation Resource Center
http://www.denimgroup.com/remediation/
22

Questions?
23

Lean and (Prepared for) Mean: Application Security Program Essentials

by Philip Beyer on Aug 15, 2011

Accessibility

Categories

Upload Details

Usage Rights

1 Embed 27

Statistics

Lean and (Prepared for) Mean: Application Security Program Essentials Presentation Transcript