Streamlining the Fix	Diminishing the Impact of Software Vulnerabilities with a                  Predictive Process
Today s Presenters	Tom Bain, Director, Product Marketing	Dinis Cruz, Principal Software Architect
Today s Agenda	Development and Security are looking for a better way to identify, verify, prioritize and fix software vulne...
Who We Are	Application Security Experts	• 10+ Years vulnerability research 	• Security Testing Methodology adopted bySAP, ...
Our Approach	•  Standards:     Create security policies, align dev activities with standards and compliance requirements, ...
Life is a Breach	Companies who suffered 1-10 breaches over the past 2 years, as a         result of a software app being c...
A Process is Lacking	State they either have no process (like an SDLC) at all, or an inefficient ad-          hoc process fo...
What Motivates Action?	State there is no formal state that there is no formal mandate in place               to remediate ...
Common Use Cases	•  Development  teams don t know where to go for best practices guidance on  software vulnerabilities.	• ...
Where can developers go for the            guidance they need?	Use Case 1- Security Team	•  A   software vulnerability has...
How can you share the information?	Use Case 1I - Security Team	•  You’ve        verified a software vulnerability.	•  Youne...
Integrating with what you already have	Use Case III - Development Team	•  You’ve verified a given vulnerability, and can no...
Doing more with static analysis results	Use Case IV - Development Team with Tools	•  The   tool reports findings. 	•  Youne...
Secure Development Guidance	A Real-Time In-Practice Companion Containing 4500+ Articles             of Prescriptive Guidan...
Try TeamMentor Today!	Evaluation Version:	•     OWASP Guidance Library (Creative Commons Content)	•     Install locally, o...
Upcoming SlideShare
Loading in …5
×

Streamlining the Fix: Diminishing the Impact of Software Vulnerabilities with a Predictive Process

661 views

Published on

This prezo was given on a webinar to a) educate attendees on best practices for building security into their software development process b) to demonstrate our TeamMentor product's capabilities in helping solve this challenge and c) to articulate 4 major business use cases for how one would use the TeamMentor knowledgebase along with its integration components.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
661
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
4
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Streamlining the Fix: Diminishing the Impact of Software Vulnerabilities with a Predictive Process

  1. 1. Streamlining the Fix Diminishing the Impact of Software Vulnerabilities with a Predictive Process
  2. 2. Today s Presenters Tom Bain, Director, Product Marketing Dinis Cruz, Principal Software Architect
  3. 3. Today s Agenda Development and Security are looking for a better way to identify, verify, prioritize and fix software vulnerabilities. •  Where do I start? •  What s the best approach? •  What process can I apply? •  Whattools can I use for repeatable results?
  4. 4. Who We Are Application Security Experts • 10+ Years vulnerability research • Security Testing Methodology adopted bySAP, Microsoft, Symantec • Authors of 8+ books Products and Services • Standards - Best Practices • Education - CBT & Instructor-Led • Assessment - Software and SDLC Reducing Application Security Risk • Critical Vulnerability Discovery • Secure SDLC Rollout • Internal Competency Development
  5. 5. Our Approach •  Standards: Create security policies, align dev activities with standards and compliance requirements, fix vulnerabilities. •  Education: Create internal expertise through eLearning, Instructor-led and virtual classroom training. •  Assessment: Audit software apps against policies and compliance requirements and recommend remediation techniques.
  6. 6. Life is a Breach Companies who suffered 1-10 breaches over the past 2 years, as a result of a software app being compromised.
  7. 7. A Process is Lacking State they either have no process (like an SDLC) at all, or an inefficient ad- hoc process for building security into their applications.
  8. 8. What Motivates Action? State there is no formal state that there is no formal mandate in place to remediate vulnerable application code.
  9. 9. Common Use Cases •  Development teams don t know where to go for best practices guidance on software vulnerabilities. •  There sa need to communicate and share intelligence around specific vulnerabilities with your team. •  Teams need to fix vulnerabilities and map to internal policies. •  There s a market need for making more sense of static analysis results to get full-circle remediation.
  10. 10. Where can developers go for the guidance they need? Use Case 1- Security Team •  A software vulnerability has been identified. •  You need to verify it and need more information about it. •  Whatdo you do, and where do you go for guidance?
  11. 11. How can you share the information? Use Case 1I - Security Team •  You’ve verified a software vulnerability. •  Youneed to communicate the details of that vulnerability or set of vulnerabilities to your team. •  Howis this accomplished most effectively?
  12. 12. Integrating with what you already have Use Case III - Development Team •  You’ve verified a given vulnerability, and can now prioritize it. •  Youhave knowledge internally, or security policies you need to map to. •  Howcan I do this in a streamlined way?
  13. 13. Doing more with static analysis results Use Case IV - Development Team with Tools •  The tool reports findings. •  Youneed to make more sense of the results. •  Thefindings point to guidance specific to the findings. •  Fix what you’ve found. Re-scan.
  14. 14. Secure Development Guidance A Real-Time In-Practice Companion Containing 4500+ Articles of Prescriptive Guidance and Code
  15. 15. Try TeamMentor Today! Evaluation Version: •  OWASP Guidance Library (Creative Commons Content) •  Install locally, or use web version •  Watch a video: http://bit.ly/Vra3OS •  Download it: https://docs.teammentor.net/xml/Eval Enterprise and Partner Versions: •  Full set of guidance libraries (4,500+ articles) •  Single user, cloud instance, business unit, enterprise-wide pricing •  Partner organization licensing •  Contact us: getsecure@securityinnovation.com

×