A short presentation covering the important aspects of an software security assurance effort in agile development environments. Towards the end we provide tips of how it can work in the real-world...

1. Agile software security assurance
NCC Group Technical Security Consulting
Ollie Whitehouse, Technical Director

2. Agenda
Recap on Waterfall
Introduction to Agile Software Security Assurance
Solutions and Examples

3. Waterfall

4. Agile

5. Agile Security Challenges
Shallow documentation
Shorter windows
Tighter schedules
Security requirements as stories or tasks
but should be across all stories

6. Agile Security Positives
Shorter feedback loops
Incremental changes
Security as a definition of done for stories
Integration, build & deployment agility aiding incident response

7. Agile Companions – CI & CD

8. Agile Software Security Assurance
During the test & QA phase the manual
security expertise required should be minimal

9. Agile Software Security Assurance
Software security training
Product owners
Architects
Developers
QA Leads
Devops / Integration

10. Agile Software Security Assurance
Agree security / privacy requirements
Create / agree quality gates
Risk management
Requirements / Story Development

11. Agile Software Security Assurance
Agree security & privacy
design requirements
Perform attack surface analysis / reduction
Threat modelling
Design

12. Agile Software Security Assurance
Local static code analysis
Positive / negative unit and functional
Test case development
At point of commit:
Manual code security focused code review
Static code analysis
Dynamic analysis / testing
Complexity analysis / quality
Implementation

13. Agile Software Security Assurance
Security artefact review
(SAST, DAST & manual)
Automated negative test cases (fuzzing)
Security focused new feature final verification
Test / QA

14. Agile Software Security Assurance
Licensed code security
Open source component security
Platform security
Sustainment

15. Agile Software Security Assurance Models
… post requirements and design phases
Manual resources (security QA as is done today)
Tooling (SAST / DAST)
Tooling + automation and/or manual resources
Tooling + automation + manual resources

16. Agile Software Security Assurance Example
Pre-commit: IDE based static code analysis
On commit: static code analysis, code quality and complexity
measurement
Post build: dynamic analysis, regression suite, fuzzing
End of sprint: manual code analysis and manual assessment
… using CI for a web app

17. Conclusions
Security investment throughout in agile is a path to success:
- to make a natural part of the process
- to ensure coverage
- to ensure minimal surprises
Where not possible and it has to happen at test/QA then:
- good feature documentation
- code deltas
- focused sprints
- product knowledge

18. Europe
Manchester - Head Office
Cheltenham
Edinburgh
Leatherhead
London
Milton Keynes
Amsterdam
Copenhagen
Munich
Zurich
North America
Atlanta
Austin
Chicago
Mountain View
New York
San Francisco
Seattle
Australia
Sydney