Slides from my SAASy SPLC Talk at AppSec EU 2016. Subject was Scaling a Secure Engineering Program.

1. Julia Knecht | Adobe Systems
@juliaamarieee
SAASy SPLC

2. About Adobe
SAASy SPLC - @juliaamarieee 2
CONTENT DATA
Creative Cloud Document Cloud Marketing Cloud
Community Marketplace Partners Developers

4. Now
SAASy SPLC - @juliaamarieee 4
Analytics Audience
Manager
Campaign Experience
Manager
Media
Optimizer
Primetime Social Target

5. Goals
SAASy SPLC - @juliaamarieee 5

6. How
• Get Buy In
• Set a Baseline
• Measure & Automate
• Leverage Existing Process
• Build a Community
• Create Opportunities for Learning
• Be a Service Organization
• Add Value
SAASy SPLC - @juliaamarieee 6

7. People will do things for 1 of 2 reasons:
7SAASy SPLC - @juliaamarieee

8. Security as a Service
SAASy SPLC - @juliaamarieee 8

9. Product Engineering Team Buy-In
9
Product
SAASy SPLC - @juliaamarieee

10. Our Security Champions are…
10SAASy SPLC - @juliaamarieee

11. It has to be the product team –
get champions
11SAASy SPLC - @juliaamarieee

12. Map: Security Certification Program
12SAASy SPLC - @juliaamarieee

13. Tactic: Competition: Before
13
A B C D E F G H I
White Belt 99 95 99 100 92 100 96 93 96
Green Belt 98 95 94 93 88 84 70 54 41
0
10
20
30
40
50
60
70
80
90
100
White Belt
Green Belt
SAASy SPLC - @juliaamarieee

14. Tactic: Competition: After (2 days later)
14
A B C D E F G H I
White Belt 100 95 100 100 92 100 96 100 96
Green Belt 100 95 100 100 88 100 96 100 68
0
10
20
30
40
50
60
70
80
90
100
White Belt
Green Belt
SAASy SPLC - @juliaamarieee

15. Set a Baseline
15SAASy SPLC - @juliaamarieee

16. Measure & Automate
16SAASy SPLC - @juliaamarieee

17. Provide Incentives
17SAASy SPLC - @juliaamarieee

18. 18
"I know that well
enough, Mr. Frodo.
Of course you are.
And I'm coming with
you.”
"But I am
going to
Mordor."
SAASy SPLC - @juliaamarieee

19. PLC à SPLC
19SAASy SPLC - @juliaamarieee

20. Leverage Existing Process
20SAASy SPLC - @juliaamarieee

21. Security Team
21
training, threat
modeling, hacking skills,
security automation,
checklists, sign-off,
coordination, security
monitoring team,
talking to customers
about security…
You have my bow
SAASy SPLC - @juliaamarieee

22. Services
• Threat Modeling
• Testing Automation
• Security
• Pen Testing Coordination
• Best Practices/Training
• Security Testing
• Security Architecture Reviews
• Customer Security Engagement
22SAASy SPLC - @juliaamarieee

23. Be a Service Organization
23SAASy SPLC - @juliaamarieee

24. Provide opportunities for learning & a
Secure-Engineering Community
24SAASy SPLC - @juliaamarieee

25. Add Value
25SAASy SPLC - @juliaamarieee

26. Results
26SAASy SPLC - @juliaamarieee

27. LL Summary
• Champions
• Training
• Existing Process
• Measure
• Automate
• Recognize
• Add Value
27SAASy SPLC - @juliaamarieee

28. Adobe Resources
28
Security portal
https://adobe.com/security
Security @ Adobe blog
https://blogs.adobe.com/security/
Advisories and updates
https://www.adobe.com/support/security
Twitter: @AdobeSecurity
SAASy SPLC - @juliaamarieee