Talk about application security in an agile world. How can security be integrated into agile and how can DevSecOps be leveraged to achieve security at scale at speed.

1. Application Security in an
Agile World
Null SG Meetup – 14.12.2016
www.vantagepoint.sg | office@vantagepoint.sg

2. 1
Stefan Streichsbier
CTO at Vantage Point
Twitter: @s_streichsbier
Founder DevSecOps SG
Intro

3. 2
A brief history of
AppSec

4. 3
What is Application Security?
Let’s start with what it is not:
• Firewalls, secure network protocols,
• Antivirus and Phishing attacks
• Intrusion Detection
• SoCs, ...

5. 4
Firewall is locked tight,...only 443 is open…

6. 5
What is Application Security?
Application Security is:
• A quality aspect of your application
• And contributes to the business success
the same way UX Design, Usability and
Performance do.
• In other words, is my application used the
way it is intended to.

7. 6
Why is AppSec associated with pain?
• Poor communication of sec requirements
• Results in lots of re-work
• Security feedback provided at the end
• Results in stress and missed deadlines
• Audit-like properties
• Results in a false sense of security

8. 7

9. 8
Security from
a dev team
point of view

10. 9
How PT changed in the last decade
• PT around 2005
• AppSec, what do you mean?
• Here is our network range – hack it
• PT around 2010
• More focus on business critical apps
• Hacking an app once a year
• PT now
• We have made changes to our app, please hack them

11. 10
Securit
y

12. 11
The frequency increased
0
20
40
60
80
100
120
140
2005 2010 2015 2020
The frequency of releases over time
Releases per app per year
Towards CD
From Waterfall

13. 12
So many releases?!

14. 13
Securit
y

15. 14
Security
Continuous AppSec
Development

16. 15
Agile + DevOps + Security = DevSecOps

17. 16
Step 1: Security as
part of Agile

18. 17
1-4
Weeks
24 hours
Develop
Test
Design
Plan
Output
Shippable Increment
Product Backlog Sprint Backlog
Start with understanding the process
Let’s look at SCRUM

19. 18
Some general hygiene
• Security intrinsically understands dev cycle
• and uses the same language as the dev team.
• Security as part of existing
environments/workflows.
• No more pdf/doc/xls!
• Security work is completed in-cycle.
• Not all apps have the same security requirements.

20. 19
Relative cost to fix
0x
5x
10x
15x
20x
25x
30x
35x
Requirements/Design Coding Integration Testing Acceptance Testing Production
Relative Cost to fix, based on time of…
Penetration Testing
Source: NIST

21. 20
1-4
Weeks
24 hours
Develop
Test
Design
Plan
Output
Shippable Increment
Product Backlog Sprint Backlog
Secure SCRUM
Security Training
Security Requirements
Security Activities
Threat Modelling
Arch & Design Review
Pairing
Manual Security Tests
Automatic Security Tests
Security Feature Demo
Security Acceptance Criteria

22. 21
Security Training

23. 22
99% of unit tests
passed

24. 23
(Security) Tests
Unit Testing - Code coverage is key aspect of quality
• Achieving 100% is just the beginning
Security related acceptance criteria makes a difference
• Unit tests will be created containing the abuse cases
• Manual test suits will consider security relevant test cases
• Collaboration between security experts and QA
Goal is to continuously increase the coverage through automation

25. 24
BDD-Security
Demo

26. 25
Step 2: DevSecOps

27. 26

28. 27
AppSec Pipeline
Vulnerability
Repository
• Security Unit
Tests
• SAST
• SCA
• DAST
• IAST
• VA
• Infra as Code
• Security as Code
• RASP
• NG WAF
• Red Team
• GOPT
• Actual Attackers
• Crowd Sourcing
• Sec Requirements
• Design Review
• Threat Modelling

29. 28
Instead of this ...

30. 29
Let’s do this

31. 30
Announcement
DevSecCon Asia 2017

32. 31
Summary
• Security in Agile and DevOps requires a different mindset
• Security becomes the enabler for the business
• Collaboration between Sec & Dev & Ops
• Start by supporting the development process
• Empathy is key
• Continue with automation
• 80/20 rule
• Continuous improvement through iterative approach
• No blame culture, fail often

33. 32
stefan@vantagepoint.sg
@s_streichsbier
Stefan Streichsbier
https://devsecopssg.herokuapp.com
Questions?
We are hiring!

34. 33
• https://www.infoq.com/presentations/Facebook-Moving-Fast-at-Scale
• Jeff Williams: 2013 Appsec USA:
https://www.youtube.com/watch?v=cIvOth0fxmI&t=377
• http://blog.diniscruz.com
• https://www.owasp.org/index.php/OWASP_AppSec_Pipeline
• http://www.slideshare.net/SeniorStoryteller/amy-demartine-7-habits-of-
rugged-devops
References