Culture of Security

This is an exclusive document to the FlevyPro community - http://flevy.com/pro
Framework Primer
Culture of Security
Presentation created by
Constant Attacks Education
Threat Modeling Peer Reviews
Security Hygiene Continuous Improvement Zero-defect Approach
Reusable Tools Unified Team Testing
1 2
3 4 5
6 7 8
9 10

2This document is an exclusive document available to FlevyPro members - http://flevy.com/pro
Contents
 Overview
 State of Security
 Culture of Security
 Case Study
 Templates
The content on this page has been partially hidden.
FlevyPro members can download the full document here:
https://flevy.com/browse/flevypro/culture-of-security-4020

Threats to information systems are becoming more advanced and harmful
—this deck deliberates on ways to create a “rugged” Culture of Security
Presentation Overview
A Rugged Culture of Security is more than just secure—as secure is a state of affairs
at a specific time—whereas Rugged means staying ahead of threats over time.
Advancement in technology, unfortunately, has helped attackers be more aggressive and capable
of inflicting more damage to IT systems and infrastructure deployed at most enterprises today.
Application security tools and techniques are also evolving continuously. However, they are not
up to the mark, as organizations still fall prey to vulnerabilities—e.g., cross-site scripting, SQL
injection, access control, and business logic errors. The primary reason is failure to focus on
establishing strong defenses against threats, merely doing patch work, and leaving the
weaknesses unguarded.
This deck provides a detailed overview of Rugged software, its development, and the guiding
principles to enable a Rugged Culture of Security. The 10 guiding principles include:
The slide deck also includes some slide templates for you to use in your own business
presentations.
1 Constant Attacks
2 Education
3 Security Hygiene
4 Continuous Improvement
5 Zero-defect Approach
6 Reusable Tools
7 Unified Team
8 Testing
9 Threat Modeling
10 Peer Reviews

Contents
 Overview
 Case Study
 Templates

With the pace of technological innovation, business applications
are getting increasingly complex and interconnected
Reactive and incompetent approaches to application security being employed at most
organizations today are largely proving unsuccessful.
State of Security – Overview
Source: Creating a Culture of Security, Schwartz, Amazon, 2018
Advancement in technology, unfortunately, has helped attackers get more aggressive and capable of inflicting more
damage to IT systems and infrastructure deployed at most enterprises today.
 Most enterprises ignore
concentrating on establishing
strong defenses against the
threats, merely do patch work,
and leave the weaknesses
unguarded.
 These tactics report risks.
However, do not integrate them
into a formal security strategy and
thus they are repeated again and
again.
 This results in gaps, duplication of
effort, and ambiguities in terms of
real value these actions generate.
 The current application security
methodologies mainly count on
unearthing weaknesses and
correcting them.
 Most organizations, primarily, rely
on utilizing penetration testing or
automated tools, at the most.
 A small fraction implement threat
modeling, security architecture,
secure coding techniques, and
security testing. However, even
they are typically unsure of these
approaches linking with their
strategic business objectives.
 Application security tools and
techniques are also evolving
continuously.
 However, they are not up to the
mark, as organizations still fall
prey to vulnerabilities, such as:
̶ Cross-site scripting
̶ SQL injection
̶ Access control
̶ Business logic errors

Security and quality are both considered free by many people
Security is not something that requires smart engineering—it warrants consistent
adherence to and incorporation of best practices into daily operations.
State of Security – Security and Quality
Security is a form of quality which refers to guaranteeing sustained functional IT capabilities as per the design under real-
life conditions—i.e., under unsuspected threats and incidents.
 A large number of security threats
can be neutralized just by taking
care of security hygiene.
 State-of-the-art technology and
best practices available today
offer effective, yet economical
methods to prevent security
breaches and threats.
 Moreover, these tools and
practices work well without
affecting the pace of delivery or
straining the users unnecessarily.
 Only a few weaknesses constitute
the vast majority of break-ins.
Examples include:
̶ SQL injections
̶ Buffer overflows
 Major security threats and
application vulnerabilities for any
information security professional
include the following:
̶ Compromised credentials
̶ Failure to patch promptly
̶ SQL injections
̶ Cross-site scripting
 Security and quality come with a
price if appropriate security tools
and practices are not
incorporated into the
organizational systems.
 Building in security is cheaper
and beneficial as compared to
adding it later in the event of
adverse attacks and damages.

Contents
 Overview
 Case Study
 Templates

The key to developing a secure code is to change the software
development culture
A Culture of Security proactively hunts for threats and forms a line of defense to prevent
the threats from occurring.
Culture of Security – Overview
Secure software development warrants analyzing the technology as well as the organization that creates
the software. This entails looking at the people, process, tools, and culture of the enterprise.
Organizations that consider security and resilience as an additional feature—an
added cost and extra work that only security people should fret about—cannot
develop a Culture of Security.
Security is a matter of concern across the organization—from top management to the
factory floor level—and should be at the center of a company’s culture. The culture
should incorporate an organization’s procedures and guidelines, and be reinforced by
the conduct and actions of all employees, and the way they perceive the behavior of
others.
Secure Software Development Culture inspires security by promoting communication,
collaboration, and competition on security topics. A Culture of Security works by
rapidly evolving the competence to create available, survivable, defensible, secure,
and resilient software. It uses competition, cooperation, and experimentation to learn
and improve rather than making the same mistakes over and over.

The key to secure and resilient software is transforming the software
development culture
Rugged software can survive current hazards as well as future challenges.
Culture of Security – Rugged Software
Rugged software, or Rugged DevOps, promotes developing secure and resilient software by embedding this practice
into the culture of an organization.
 Reflecting on the items
critical for the enterprise.

Jotting down all the
potential threats and their
untoward consequences to
the business.
 Prioritizing threats based
on the severity level.
The commencement of the
Rugged software security story
entails the following steps:
Rugged software does not fall prey to any source of vulnerability or weakness. The
rugged code aligns with the organizational objective and can cope with any challenges
and persist in spite of them. All applications developed by “Rugged” organizations are
well-secured against threats, are able to self-evaluate and distinguish ongoing attacks,
report security statuses, and take action aptly. Rugged enterprises constantly tweak
their code and their internal organization—including governance, architecture,
infrastructure, and operations—to constantly stay ahead of attacks.
Rugged software is a consequence of the efforts to rationalize and fortify security
stories. For instance, by communicating the lessons learnt from experimentation,
sharing and adopting stringent safety procedures and lines of defense across the
organization on multiple projects helps execute more applications promptly and with
enhanced security. Rugged influences overall application portfolios—e.g.,
conventional or new, web or internal, mobile or mainframe applications.
Adopting Rugged practices across the enterprise helps achieve cost savings across
the software development lifecycle, as it necessitates less human labor and time
during the requirements, design, execution, testing, iteration, and training phases.

The 10 principles of security helps build an organization that is able
to develop reliable software
These principles act as a foundation to approach and tackle security issues.
Culture of Security – 10 Principles of Security
To develop a Rugged Culture of Security, there are 10 guiding principles we can follow.
1 2
3 4 5
6 7 8
9 10
These 10 principles apply to all organizations:

An organization needs to be aware of all the potential threats it may
encounter
As part of rugged security practices, people working at the Rugged organizations do not
allow sensitive information lying on their desks when they leave their office.
10 Principles of Security – Details (1 of 3)
 A Rugged software development organization should be constantly aware of
the incessant vulnerabilities and attacks—deliberate or accidental—and
incorporate this philosophy into everything it undertakes.
Constant AttacksConstant Attacks
1
 Rugged organizations appreciate staying informed and continuously learning
about security issues and potential threats—technical or non-technical—seek
recommendations from security specialists, and identify and update security
policies and rules.
EducationEducation
 Rugged organizations take good care of their security hygiene by limiting the
sharing of user accounts, carefully guarding the passwords and sensitive
personal information. They employ secure software practices.
Security HygieneSecurity Hygiene
3
2

Whenever a problem surfaces, Rugged organizations refrain from
procrastinating and fix it straightaway
There isn’t an option of deferring decisions or actions on known security defects available
at Rugged organizations.
 In case sensitive information is left lying on somebody’s desk at night,
Rugged organizations ensure that this does not recur in future and gather
feedback from the people who happen to notice it.
Continuous
Improvement
Continuous
Improvement
4
 Rugged organizations leave no room to tolerate any known weaknesses. An
issue is resolved as soon as it is detected.Zero-defect
Approach
Zero-defect
Approach
 Rugged organizations make sure to periodically evaluate all of their IT
systems, developer tools, and procedures that are shareable—e.g., reusable
event logging and monitoring, organization-wide identity management and
rights authorization, standardized staffing, and employee departure
processes.
Reusable ToolsReusable Tools
6
5

The different units of a Rugged organization work collaboratively to
achieve the departmental and the overall organizational objectives
Rugged organizations set up protocols for peers to review the codes of other
team members.
 All functions within a Rugged organization act as a team to strengthen the
enterprise, security, and systems.Unified TeamUnified Team
7
 Rugged organizations have the required processes in place for thorough
assessment of systems—specifically automated tests—during development
and production. They analyze failure scenarios and strategize ways to
effectively respond to them.
TestingTesting
8
 Rugged teams deliberate on and model the possible ways attacker would
choose to penetrate their defenses and systems. This enables them to
strengthen their controls and overall security.
Threat ModelingThreat Modeling
9
 Rugged coders examine their code for potential flaws and possible security
lapses.Peer ReviewsPeer Reviews
10

Contents
 Overview
 Case Study
 Templates

The U.S. Citizenship and Immigration Services (USCIS) embarked on
developing a Culture of Security under the new IT leadership
Allowing known vulnerabilities in codes and systems was a business decision made
at USCIS based on a cursory risk analysis.
Case Study – USCIS
Initially at the U.S. Citizenship and Immigration Services
(USCIS), an agency in the Department of Homeland Security,
information security was not incorporated into the
organization’s day-to-day operations. The agency had some
great security engineers and penetration testers who were
really good at keeping the organizational systems protected.
The office would periodically undergo social engineering
audits and all employees were required to go through an
annual session on security awareness. And that was it.
However, a vast majority of the workforce at the agency
considered security as an additional workload. Developers
perceived it as an impediment in deploying their code.
Security of the code entailed merely meeting the compliance
obligations and getting it cleared from the security testers. All
systems deployed had known vulnerabilities, which were
merely recorded in a tracking system and labeled “to be
attended later.”

The approach to a Culture of Security helps do away with the perception
that there is a tradeoff between security and customer satisfaction
The approach to a Culture of Security isn’t costly or time consuming once deployed.
USCIS Case Study – Approach
A new CIO was appointed at the USCIS
who went through each system to ensure
it was built with enough security before
deployment. The CIO after discussion
with the CISO and the security team
established an Authority to Operate
(ATO). The earlier government ATO
process was designed to allow flexibility
for the top management to make situation
based practical security decisions and
trade-offs.
However, this traditional approach spread
wrong perceptions—that security is
distinct from organizational mission
accomplishment—and required a constant
need for making trade-offs. But, naturally,
security should be a critical element of an
organization’s mission, and should not be
compromised on.
The new CIO and his team embarked on using an alternate approach to
developing a culture that valued security. The new method entailed getting
rid of the old behaviors and adopting new ones. The approach involved the
following broad steps:
Consistently connect security to mission objectives1
Build security into everything and correct mistakes quickly2
Establish norms and high standards for security hygiene3
Adopt a zero-defect approach4
Continuously vet security in development and production5

The new CIO supported the security department in their endeavors and
made it clear to everyone that security was a priority for them
The importance of security was reinforced among the people at USCIS to the point that
anyone who didn’t believe in security was thought to have misunderstood their job.
USCIS Case Study – Approach Details (Step 1)
At USCIS, security is even more critical as it has to preserve the security
of the entire US immigration system. Thus, everyone within the USCIS
was supposed to be clearly aware of the importance of security—in terms
of protecting the integrity of its systems to deliver value to the customers—
from senior management to the lower ranks. They were asked to answer
these questions individually:
 How critical it is for us to let the data of applicants get stolen?
 The criticality of a denial of service attack to make the agency stop
providing services?
The new CIO at the agency not only met with the security people, but also
talked to all key stakeholders—i.e., sponsors, product owners, and
development teams. He ensured that everyone understood any issues
that occurred in the system and made people commit to actions required
to improve security further.
STEP 1
Consistently connect
security to mission
objectives
Maintaining the security of
systems should be prime
for all individuals in an
organization, since
shareholders entrust the
organization with financials
and customers with their
personal data.

The security team at USCIS conducted periodic security audits
Penetration testers shared their security vulnerability findings with everyone at USCIS—to
educate for everyone on how security was compromised and how to avoid future incidents.
STEP 2
Build security into
everything and correct
mistakes quickly
The USCIS team took the following actions to strengthen their security:
 Adopted Multifactor Authentication.
 Incorporated automated security tests into software development that
– Allowed immediate feedback to developers if they developed a
security vulnerability.
– Let the developers identify the vulnerability and the ways to remove it.
 Developed reusable code that incorporated security best practices
(identity and credential management, auditing and logging etc.) and was
easy to introduce to new systems.
 Installed encryption software on all laptops.
The security audits
revealed a number of
social engineering attacks
on employees, as they
were in the habit of sharing
their passwords with the
helpdesk technicians
despite regular training.
Security of the people was
being comprised by
phishing attacks.

Just as hand washing is something that everybody does for body hygiene,
validating developers’ input is just as important for security hygiene
Implementing these simple security hygiene norms do not cost anything, but are really
valuable.
There were a multitude of practices that USCIS adopted to ensure security
hygiene:
 Validating a developer’s code decreases the chances of a SQL injection
hack or a buffer overflow.
 Assigning minimum possible authority to user accounts.
 Terminating (immediately) the accounts of employees leaving the
organization.
 Shredding sensitive documents.
 Making these practices a part of employee behaviors helped USCIS
prevent a number of security attacks.
 Although this simplistic approach did not prevent complex hacks, but it
did help USCIS stay safe from the vast majority of hacks that typically
exploit negligence in ensuring these simple measures or careless
mistakes.
STEP 3
Establish norms and
high standards for
security hygiene
Just as washing hands
decreases the likelihood of
contacting pathogens,
there are some simple yet
effective everyday
practices that are quite
effective in securing
organizational systems.

Although it is considered a liability at some organizations, software codes
must qualify security tests before moving forward
This helped in making all stakeholders comprehend that known vulnerabilities would not be
tolerated in future.
A continuous delivery environment like USCIS should ensure that codes
must pass all the necessary security testing before going into production.
Automated regression test suites assist in achieving this by ensuring that
there can be defects only in the code that was just entered, and was about
to go through review.
Typically a legacy system has many outstanding security defects. At
USCIS, the new CIO carried out the following measures to implement a
zero defect tolerance policy:
 Reviewed each legacy system in consultation with all stakeholders.
 Asked about the known vulnerabilities in those systems.
 Established compensating controls or demanded plans for their
rectification.
 Set aggressive deadlines against each plan.
STEP 4
Adopt a Zero-defect
Approach
Allowing known security
vulnerabilities into
production is like leaving
the doors of your premises
unbolted for a crook. This
practice is not an
appropriate risk/cost trade-
off, rather a wastage of
security expenditure.

Security should be prioritized as a proactive matter rather than something
considered only when forced to
Continuous validation of security measures helps ensure deploying secure systems.
To establish a Culture of Security, the new CIO implemented the following:
 Started running each system through an ongoing authorization process,
where the system was continuously tested and assessed utilizing
automated tools.
 Any vulnerabilities were immediately escalated to deal with right then
and there.
 Pre-release security testing process was extended to post-release
testing.
 The issues that prevented an authority to operate upon a system’s first
launch now triggered an immediate escalation and remediation after
launch as well.
 Developed a culture which considered urgency not just when a system
was under attack, but also whenever an error was detected that had the
potential to be vulnerable to any attacks.
STEP 5
Continuously vet
security in development
and production
The security process
prevalent at USCIS
entailed evaluating each
system after 2 to 3 years to
ensure it was still secure
enough before issuing it a
new authority to operate
further.

Contents
 Overview
 Case Study
 Templates

Insert headline
Insert bumper.
Culture of Security (10 Principles of Security) – TEMPLATE
1 2
3 4 5
6 7 8
9 10

Insert headline
Insert bumper.
Culture of Security (10 Principles of Security) – TEMPLATE ALTERNATE
Continuous
Improvement
101
Constant
Attacks
Continuous
Improvement
102
Education
Continuous
Improvement
103
Security
Hygiene
Continuous
Improvement
104
Continuous
Improvement
Continuous
Improvement
105
Zero-defect
Approach
Continuous
Improvement
106
Reusable
Tools
Continuous
Improvement
107
Unified Team
Continuous
Improvement
108
Testing
Continuous
Improvement
109
Threat
Modeling
Continuous
Improvement
1010
Peer
Reviews

Insert headline
Insert bumper.
Culture of Security (10 Principles of Security) – TEMPLATE ALTERNATE
Continuous Improvement 4
Education 2
Security Hygiene3
Constant Attacks1
Zero-defect Approach5 Reusable Tools 6
Unified Team7 Testing 8
Threat Modeling9 Peer Reviews 10

Download 100s of similar frameworks from the
FlevyPro Library:
https://flevy.com/pro/library/frameworks

Need more frameworks? Download our Complete Business Frameworks
Reference Guide, a 350+ slide compilation of 50+ frameworks, on Flevy
The Complete Business Frameworks Reference
Guide is a best selling document on Flevy. It is 350+
slides--covering 50+ common management consulting
frameworks and methodologies. A summary is
provided for each business framework.
The frameworks in this deck span across Corporate
Strategy, Sales, Marketing, Operations, Organization,
Change Management, and Finance.
This reference guide is great for those who need a
refresher on common frameworks, as well as be
introduced and learn new useful frameworks.
You can find this document here:
http://flevy.com/browse/business-document/complete-
consulting-frameworks-toolkit-644

Flevy (www.flevy.com) is the marketplace
for premium documents. These
documents can range from Business
Frameworks to Financial Models to
PowerPoint Templates.
Flevy was founded under the principle that
companies waste a lot of time and money
recreating the same foundational business
documents. Our vision is for Flevy to
become a comprehensive knowledge base
of business documents. All organizations,
from startups to large enterprises, can use
Flevy— whether it's to jumpstart projects, to
find reference or comparison materials, or
just to learn.
Contact Us
Please contact us with any questions you may have
about our company.
• General Inquiries
support@flevy.com
• Media/PR
press@flevy.com
• Billing
billing@flevy.com

1
Flevy (www.flevy.com) is the marketplace
for premium documents. These
documents can range from Business
Frameworks to Financial Models to
PowerPoint Templates.
Flevy was founded under the principle that
companies waste a lot of time and money
recreating the same foundational business
documents. Our vision is for Flevy to
become a comprehensive knowledge base
of business documents. All organizations,
from startups to large enterprises, can use
Flevy— whether it's to jumpstart projects, to
find reference or comparison materials, or
just to learn.
Contact Us
Please contact us with any questions you may have
about our company.
• General Inquiries
support@flevy.com
• Media/PR
press@flevy.com
• Billing
billing@flevy.com

Culture of Security

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Culture of Security

Similar to Culture of Security (20)

More from Flevy.com Best Practices

More from Flevy.com Best Practices (20)

Recently uploaded

Recently uploaded (20)

Culture of Security