Creating a graph-based
security organisation
Dinis Cruz
dinis.cruz@photobox.com
OWASP London Chapter meeting
April / 2019

2

What are Security’s meta objectives
● Allowing the business to execute it’s mission and objectives within their ‘accepted
risk level’
● Allowing the business to make FACT and RISK based decisions
● Improving the business’ ability to deploy changes and enabling it to ‘move faster’
● Allowing the business to understand better how it behaves and what are the side
effects of it’s actions/decisions
● Increasing the cost of malicious entities to execute their objectives
● Effectively handling incidents and preventing crisis
● Making compliance easy
● Enabling the business to think in ‘Graphs’
3

Security is a major
agent of change
(just about everything we do requires a change request)
4

Security is at the
epicentre of data
(we can get data feeds from everywhere)
5

Data is not linear or tabular
Data is hyperlinked and
relational
6

Only effective solution is to:
Manage and visualise data
as a Graph …
7

…and to create a
Graph based security
organisation
8

How we did it
9

10
It all started with this RISK Workflow

11
Now refactored to

12
We use JIRA as a Graph Database

We created a serverless workflow
Graph
database
Queryable
data store
Lambda
functions
Command line /
feedback loop
Our hyperlinked
security taxonomy...
...is dumped every few
seconds into ELK...
...made queryable by
code functions...
...with the user
journey all in Slack.

14
We sync all JIRA data into Elastic Stack

15
We use a Slack bot to access the data

16
Searching Jira and rendering plantuml

17
PlantUML graphs from JIRA data

19
Mapping projects to OKRs

20
Mapping Services to Roles

2
Multiple ways to
Visualise data

22
The Universe

Work done yesterday

Work done last week

‘
The Bicycle

‘
Spot the bad mappings

27
A sail of a boat or Music Equalizer

‘
My Brain on Friday

Where is Everybody?

Funny ones

‘Wardley Maps’

Automatic generation of
Slides
3

33
Creating slides and pdfs from GS Bot

34

35

36

37

38

39

Syncing Google Sheets
with Jira
4

Meet Maeve

Demo
42

Syncing Google Sheets With Jira
OWASP Demo
Maeve Scarry 4th April 2019

1 Create ticket in Jira

2 Create tasks

3 Column view

4 Spider view

5 Graph view

6 Table view

7 Creating a Google Sheet

8 Google Sheet

9 Editing the Sheet

10 Editing the Sheet

11 Syncing Google Sheets to Jira

12 Final Jira View

Rendering Sheets and Slides
in Slack
5

Consume materials created in Slack

Empowering the
business to make
Fact based Security Decisions
5

59
Risk Dashboards (from Jira Data)
Maturity
DEMO DATA

60
Show Risk evolution
FY18
(score of 45)
FY18
(score of 55)
Maturity
DEMO DATA

61
Show Risk Delta (Risk impact of decisions)
DEMO DATA

Show me the code
62

Most of the code is on GitHub

Broken down in modules(build using AWS CodeBuild)

Please contribute
and participante in the
conversation
6

Ok, how can I learn more
about this?
And where can I try it?
66

Open Security Summit 2019
https://docs.google.com/presentation/d/1GlCvPmBHqcn_VA1ciVirgkoP1RSkSccHhd_Wx1BaG4s/edit#slide=id.p1

The place to be to collaborate
https://docs.google.com/presentation/d/1GlCvPmBHqcn_VA1ciVirgkoP1RSkSccHhd_Wx1BaG4s/edit#slide=id.p1

Last year’s action

Buy your ticket now! (we are running out of villas)
https://open-security-summit.org/

Also available at
https://z-developers.com/
Read the ‘Generation Z Developers’
https://leanpub.com/generation-z/
https://github.com/DinisCruz/Book_Generation_Z_Developer

72
Further reading
https://www.youtube.com/watch?v=xwuXz1ZEnhA https://leanpub.com/secdevops

Thanks
73