Improving Software Security in an Agile Environment: A Case Study
Security often isn’t the top priority for many developers, who already are juggling multiple projects and deadlines. In fact, security seems to get in the way of keeping up with the pace of business. However, developers control a critical piece of the security puzzle and need to be engaged in the security cause—no longer can they stand by and say the responsibility for security lies in the hands of the security team. Rather, security must be built-in from the start. In this webinar, Secure Code Warrior CTO Matias Madou will look at what we as security professionals have been doing wrong and how agile, DevSecOps and DevOps are changing the role of the developer. Madou will discuss current best practices and ways in which they often fall short of the goal of building in security from the start, and will share new methodologies being deployed at multiple global organizations that make developers want to be part of the solution. Madou will be joined by Alexandre Pluvinage, head of Cybersecurity and Fraud Awareness at ING Belgium and ING BD Netherlands, who will discuss how his team engaged developers to think with a security mindset and how they rolled out a security program for developers, and share the results of the program to date.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Improving Software Security in an Agile Environment: A Case Study
Similar to Improving Software Security in an Agile Environment: A Case Study (20)
More from DevOps.com
More from DevOps.com (20)
Recently uploaded
Recently uploaded (20)
Improving Software Security in an Agile Environment: A Case Study
- 1. Improving Software Security in an agile environment Matias Madou CTO, Secure Code Warrior Alexander Pluvinage Head of Cybersecurity and Fraud awareness, ING Belgium and ING BD Netherlands
- 2. Software developers around the world ~ Evans Data 23M Source: https://evansdata.com/reports/viewRelease.php?reportID=9
- 3. Lines of code written by developers every year ~ CSO Online 111BN Source: https://www.csoonline.com/article/3151003/application-development/world-will-need-to-secure-111-billion-lines-of-new-software-code-in-2017.html
- 4. Security incidents result from defects in the design or code ~ DHS 90% Source: https://www.us-cert.gov/sites/default/files/publications/infosheet_SoftwareAssurance.pdf
- 5. Of data breaches caused by software vulnerability ~ Verizon 21% Source: Verizon, Data Breach Report, 2018 (but in there the last 10 years)
- 6. passed OWASP Top 10 out of 400k application scans ~ Cisco 30% Source: Cybersecurity as a Growth Advantage, Cisco, 2016
- 7. of newly scanned applications had SQL injections over the past 5 yrs ~ Cisco 1 in 3 Source: Cybersecurity as a Growth Advantage, Cisco, 2016
- 8. Of hacks caused by SQL injections ~ Trustwave 24% Source: 2018 Trustwave Global Security Report, 2018
- 9. Statistics can prove anything? Yes, but they can’t all be THAT wrong
- 10. #1 Right to Left is Backwards
- 11. “We want to provide a service that transports stuff from A to B” A B
- 14. Customers
- 15. Security Experts
- 16. Secure Dev
- 17. #2 Security vs Development is an unfair game
- 18. Software Developers (Agile) A BA B A B A B A B A B Application Security Experts 100 1
- 19. BUILDERS Know their code Do not speak security BREAKERS Always points out problems Not Developers SQL Injections XSS Object Deserialization IDOR Constructors JAVA Spring SWIFT Angular.JS
- 20. Empowering developers requires a positive approach
- 22. Alexandre Pluvinage – Head of Fraud and Cybersecurity Awareness Secure Code Warrior @ ING All images: www.unsplach.com
- 23. DevOps vs. Secure development • Classroom training : FAILED • Online training : BORING • Gamification: SECURE CODE WARRIOR The issue 23
- 24. 24 We did a pilot with
- 25. Results 25 100 97 88 100 100 22 100 100 100 100 11 78 0% 20% 40% 60% 80% 100% Liked the format of the… Improvement feeling after… Learn enough vs. the effort? Gained knowledge in your… Improved your secure… Feedback to incorrect… Relevant for your daily job? Challenging enough? Had enough… Easy to use? Excellent to good Room for improvement Improved in collaboration with SCW
- 26. 26 Wave 1 started playing/training/learning during 6 weeks • 10 teams with a total of 88 developers subscribed. • Total hours played: 219 • Top 5 players have played 9+ hours each • Number 1 player has played 41 hours We have learned from the first waves • Free participation is not enough • Not everyone will play • Needs to be officially part of the training plan
- 27. • Force all devops to use it • Everyone needs to do it • Let them play whenever they want • Put it in their training program • Ask one or two to be the experts for the others Approach 27 Someone needs to follow-up regularly on the participants
- 28. 28 Who can use SCW @ ING ? Dev Engineer Chapter leadHuman ressources
- 29. Questions?
- 30. New whitepaper