Agile development is a powerful tool for the creation of high-quality software products. It has however scared the life out of many security managers and risk leaders. Once the job of a dedicated security team, security is now the responsibility of all members of our Agile teams. So how do we bring continuous security to our lifecycles without compromising velocity and innovation? What tools and techniques do we need and when should we apply them? In this talk, we will examine why security is the new key skills for successful Agile development teams and what you can do to bring it to your teams. This is a talk of war stories from the SCRUM team trenches and real world tools, techniques and processes that are less about 'managing' security than they are about building amazing(secure) things, fast.

1. Founder and Lead Consultant - SafeStack
@lady_nerd laura@safestack.io
http://safestack.io
Continuous
Security

2. https://dfend.io

4. once upon a time*…
* Sometime in the last week for some of you

6. and the whole world
went to hell

8. lets do that again!
faster this time!

12. common misconceptions

13. it’s not my job
(that’s whywe have a security team)

14. border devices will save us

15. it’s impossible so why try

16. we’ve always done this…
nobody’s hacked us yet
awwww cute <3

17. we’re too little to fail
(at security)

18. we are compliant

19. compliance has us racing to the bottom

20. what is continuous security?

21. design code stuffidea test deploy

22. design code stuffidea test deploy
Initial Risk
Assessment
Design
Review
Code and
Implementation
Review
Penetration
Testing

24. continuous

25. principles of continuous security

26. automated
autonomous
integrated
repeatable
scalable

27. automated
“the best technical people I know work
really hard to make themselves redundant”

28. Deployment
Provisioning
Testing
Static analysis
Vulnerability mgmt

29. autonomous
“no bottlenecks, breakdowns or ripples”

31. Skills
Authority
Accountability
every team

32. integrated
“bite-sized security that works with every step
of your lifecycle”

33. Woven in to keep you going
Respected enough to stop you

34. repeatable
“security fails when it’s a special event”

35. It’s time for the age of collaborative defense

36. scalable
“more than just
a single team
experiment”

37. Business as usual
Managed
Measured
Controlled
Universal
Special
Proof of concept
Blue sky
Experiment
Innovation

38. How to:
Continuous Security

39. Design
Security Grooming, Security Personas
and Threat Assessment

40. Key Concept
40
Security Persona
Security personas identify the user motivations, expectations
and goals responsible for driving bad behaviour, and bring
users to life.

41. Three elements of security personas
Resources
Access to
essentials
including money,
expertise and
access
Skill
Ability to achieve
their objective
Motivation
What drives this
individual or group
to act

42. Financial Egotistical
Personal Political

43. Motivations give clues to attacker objectives
Financial
Steal money
Steal things to sell for money
Corporate espionage
Extortion
Insider trading

44. Name
Narrative
Motivation and objectives
Skill Level
Resources
Attack plan

45. Threat Assessment
S.T.R.I.D.E
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Escalation of Privilege

46. ▪ https://msdn.microsoft.com/en-
us/library/ee823878(v=cs.20).aspx
▪ https://www.microsoft.com/en-us/sdl/

47. Code
Peer Review, Linters, Static Analysis

48. verify and validate with OWASP ASVS
“if you don’t validate it’s a fairy story”

49. Every story
Every sprint
Every developer
Every time

50. Standard Security Stories
http://safecode.org/publication/SAFECode_A
gile_Dev_Security0712.pdf

51. ▪ https://www.owasp.org/index.php/Category:OWASP_
Application_Security_Verification_Standard_Project
▪ http://safecode.org/publication/SAFECode_Agile_Dev
_Security0712.pdf

52. Test
BDD Security, Security Unit Tests

53. Security Testing
“you created this … you are responsible for
checking the basics”

54. ▪ http://katrinatester.blogspot.com.au/2015/09/security-
testing-pathway.html
▪ http://gauntlt.org/ &
https://www.continuumsecurity.net/bdd-security/
▪ https://www.owasp.org/index.php/OWASP_Testing_G
uide_v4_Table_of_Contents

55. Build
Dependency Checkers,
VulnerabilityAssessment

56. Build Time Checks
“Pre-flight checks…finding security issues before
the internet since [insert date you start doing
this]”

57. Warning
Balancing you build time with security checks
and assessments is hard.
You will make people angry

58. ▪ https://libraries.io/
▪ https://www.owasp.org/index.php/OWASP_Dependen
cy_Check

59. Deploy
Configuration Review

60. Validate Regularly and Measure
Welcome to the DevSecOps jungle
Learn from those who came before you
DevOps Defense Toolkit

61. ▪ https://www.ssllabs.com/
▪ https://github.com/docker/docker-bench-security
▪ https://s3-us-west-
2.amazonaws.com/images.itrevolution.com/documen
ts/DevOps_Audit_Defense_Toolkit_v1.0.pdf

62. Maintain/Monitor
Incident Response, Responsible Disclosure,

63. Dear <your company>
I have discovered a critical vulnerability in your
application.
Do you pay rewards?

64. ▪ http://standards.iso.org/ittf/PubliclyAvailableStandards
/c045170_ISO_IEC_29147_2014.zip
▪ https://github.com/Netflix/SimianArmy/wiki/Chaos-
Monkey
▪ https://hackerone.com/
▪ https://bugcrowd.com/

66. Founder and Lead Consultant - SafeStack
@lady_nerd laura@safestack.io
http://safestack.io
Questions?