1. Secure Development
Steven C. Markey,MSIS,PMP,CISSP,CIPP,CISM,CISA,STS-EV,CCSK,CompTIACloud+
Principal,nControl,LLC
AdjunctProfessor

2. • Presentation Overview
– Application Security (AppSec) Driver(s)
– Textbook
–Processes (SDLC, SDL, STRIDE, DREAD)
–People (InfoSec Staff, Developer Training)
–Tools (Scanners, Policies & Standards)
–Procuring Secure Applications
– Real World
–10 Commandments for AppSec
–AppSec Use Cases
Secure Development

3. • AppSec Drivers
– Risk Management
– Compliance
– Revenue/Costs
Secure Development

4. • Risk Management
– One of Many Risks
–Operational Risk
–Financial Risk
–Reputational Risk
– Transfer from Network Security to AppSec
Secure Development

5. Source: OWASP
Secure Development

6. Source: ISC2
Secure Development

7. • Compliance
– Specific
–PCI DSS 6.6
– Vague
–SOX
–HIPAA
–FISMA/FIPS
–NERC/FERC
–FDA 21 CFRF Part 11/ERES
Secure Development

8. • Revenue/Costs
– Value-Add
– Key Differentiator
– Precursor to 3rd Party Accreditation
–ICSA Labs
Secure Development

9. Source: KLP Consulting

10. • AppSec Programs
– Architecture + Threat & Vulnerability Management (TVM)
– Enterprise Architecture (EA)
–Enterprise Security Architecture (ESA)
–Sherwood Applied Biz Security Arch (SABSA)
–The Open Group Arch Framework (TOGAF)
–Jericho Model
– AppSec Maturity Models
–Building Security In Maturity Model (BSIMM)
–OWASP’s Software Assurance Maturity Model (SAMM)
Secure Development

11. Secure Development
Source: NYSE Euronext

12. Source: NYSE Euronext

13. Source: NYSE Euronext

14. Source: NYSE Euronext

15. Source: NYSE Euronext

16. Source: NYSE Euronext

18. Source: Mountain Goat Software

20. Source: Microsoft
Secure Development

21. Source: Microsoft
Secure Development

22. Secure Development

23. Secure Development

24. Source: Microsoft

25. Source: Microsoft
Secure Development

26. Source: Microsoft

27. • Training
– Know Stakeholders
–Project Managers
–Development Managers
– Tailor to Development Team
– Use an Iterative Model
– Incorporate Train the Trainer
– Reinforce Training with Formal / Informal Incentives
Secure Development

28. • Scanners
– Static Application Security Testing (SAST)
– Dynamic Application Security Testing (DAST)
– AppSec Pen Testing
– Supplemental Tools
–Fuzzing, Tracing, Scanning, Sniffing
–IDEs
–Proxies / Gateways
–Firewalls (WAFs, DbFs / DAM, XML)
Secure Development

29. • Coding Conventions & Architectural Standards
– Development Team Specific
– Coding Enumeration
–Error / Exception Handling
–Input / Output Validation
–Comments / Documentation
–Session Management
–Memory / Thread Management
–PKI
–IAM / IdM
Secure Development

30. • Coding Conventions & Architectural Standards
– Architectural Enumeration
–Thick / Thin
–Internal / External
–Transactional
–Message / Information Delivery
–Monitoring
–SOA / Mobile / Cloud
–App / Middleware
–Database
Secure Development

31. • Coding Conventions & Architectural Standards
– Architectural Enumeration Scenario
–LAMP with Drupal
–IAM via AD-based LDAP
–Zend (PHP-based) Framework
–Imperva DAM
–Syslogd with Arcsight SIEM
–DMZ w/ Load Balancing
Secure Development

32. • Procuring Secure Applications
– Beware of Your Business Ecosystem
– Weakest Link Mentality
– Legal / SLA Verbiage
– 3rd Party Reviews
–ASP / Cloud / ISV
–Mobile
–COTS
–Subsidiaries / Customers
Secure Development

33. • 10 AppSec Commandments
1. Though Shall Execute AppSec at the Speed of Business
2. Though Shall Not Architect Security
3. Though Shall Evolve Your Testing Methodologies
4. Though Shall Not Surprise Dev Teams
5. Though Shall Test Apps in Production
6. Though Shall Not Let Frameworks Replace Intelligence
7. Though Shall Put Vulnerabilities in Proper Context
8. Though Shall Not Give Dev Teams Access to Prod Data
9. Though Shall Use a WAF/DAM with a Plan
10. Though Shall Not Blame the Dev Team
Secure Development
Source: Dark Reading

34. • AppSec Use Cases
– Strong SDLC & SDL Alignment
– Socialize & Incentivize SDL Implementation
– Embed AppSec SMEs in Dev Teams
– Start on New Projects
– Retrofit Legacy Apps / Systems as Time Permits
– Iterative Improvement & Wins
– No (Process / Tool) Silver Bullets
Secure Development

35. • Questions?
• Contact
– Email: steve@ncontrol-llc.com
– Twitter: @markes1
– LI: http://www.linkedin.com/in/smarkey