Development of secure and qualitative applications delivered by improved and automated software development life cycle
•Download as PPTX, PDF•
2 likes•244 views
This is the presentation that our Senior Security Engineers presented in front of the QuBit Conference Sofia 2019 attendees. Take a look and find out how to protect your Enterprise from Cyber Criminals implementing automated security solutions. Contact us from here: https://www.scalefocus.com
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Development of secure and qualitative applications delivered by improved and automated software development life cycle
Similar to Development of secure and qualitative applications delivered by improved and automated software development life cycle (20)
More from ScaleFocus
More from ScaleFocus (17)
Recently uploaded
Recently uploaded (20)
Development of secure and qualitative applications delivered by improved and automated software development life cycle
- 1. Radostina Kondakova & Stoyan Iliev ScaleFocus Development of secure and qualitative applications delivered by improved and automated software development life cycle
- 2. Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 2 • Senior Security Operations Engineers in ScaleFocus Information Security team • Passionate Cyber Security Enthusiasts • Dedicated to the team About us
- 3. Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 3 1. The "What", the "Why" and the "Where" of Cyber Security 2. Implementation of Security in the Software development life cycle (SSDLC) 3. Security Benefits of Infrastructure as a code (IaaC) 4. Q&A Agenda
- 4. The "What" Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 4 The "Why" The "Where" Protects data and integrity of computing assets Civilization moving towards the Digital world From the start of negotiating, requirements and passing through all the steps in development
- 5. Implementing of Security in SDLC(SSDLC) Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 5 Software Development Cycle REQUIREMENTS & PLANNING Security Requirements Assurance Methodologies Standards & Frameworks 1 ANALYSIS Risk Analysis Building Checklists Security Baseline 2 Secure Design Principles Security Controls Threat Modeling DESIGN 3 IMPLEMENTATION Secure Coding Practices Static & Dynamic Code Analysis Secure Code Reviews 4 TESTING & INTEGRATION Security Testing Tools Review & Response Process Security Bug Handling 5 Patch Management 3rd Party Library Upgrades Disposal Policy MAINTENANCE 6
- 6. Threat Modeling Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 6 Define Diagram Identify Mitigate Validate
- 7. Benefits of Threat Modeling • Identifies Threats • Prioritization of threats • Applicable for all phases of SDLC • All team members are involved • Provides knowledge Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 7
- 8. Demo Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 8
- 10. Infrastructure as code (IaaC) Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 10
- 11. • Motivations • Security Challenges Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 11 • Key Practices • Security Stages to address • Conclusion Security benefits of infrastructure as code
- 12. Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 12 Increase Agility and Speed Increase Security Reduce and Control Cost Secure Motivations
- 13. Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 13 Configuration Drift Human ErrorsServer Sprawl Security Challenges Service Provider Reliability Vendor lock-inCost
- 14. IaC Key Practices • Codify everything • Document as little as possible • Maintain version control • Continuously test, integrate, and deploy • Make your infrastructure code modular • Make your infrastructure immutable (when possible) Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 14
- 15. Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 15 Security Stages to address Security Design Manual security assessment Continuous monitoring of live environments Deploying and testing in sandbox environments Static (infrastructure) code analysis prior to deployment
- 16. Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 16 Conclusion
- 17. Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 17
- 18. Thank you Stoyan Iliev stoyan.iliev@scalefocus.com LinkedIn Radostina Kondakova & Stoyan Iliev QuBit Conference Sofia 2019| 18 Radostina Kondakova radostina.kondakova@scalefocus.com LinkedIn
Editor's Notes
- WHAT - Cyber security protects the data and integrity of computing assets belonging to or connecting to an organization's network. Its purpose is to defend those assets against all threat actors throughout the entire life cycle of a cyber attack. Cyber security demands focus and dedication Or Cat and mouse game, played between the business/government and the hackers. WHY - Civilization moving towards the Digital world.; The cost of data breaches is rising.; Tighter regulations.; Increasingly sophisticated hackers.; Hacking tools are becoming widely available.; A proliferation of IoT devices. WHERE - Security could not be and should not be implemented in the last steps of development.; Cyber Security should take place from the beginning, starting from negotiating and requirements and passing through all the steps in development.; It does not come by default, it takes extra effort and time.; All team members get involved in the process.
- 1. Planning Security Requirements Requirements for your requirements. What kinds of vulnerabilities are you looking to prevent? Assurance Methodologies Define ways for preventing mistakes and defects Standards & Frameworks Define Coding Standards, Frameworks, libraries and other tools which will be used. 2. Analysis Risk Analysis Identify and assess factors that may jeopardize the success of your project and achieving your goal. Building Checklists Starting point to review information security related to the systems and services. Security Baseline Set of basic security objectives which must be met. 3. Design Secure Design Principles Various combinations technics to achieve previously defined aspects of security architectural models. Security Controls Safeguards or countermeasures to avoid, detect, counteract, or minimize security risks. Threat Modeling Process in which potential threats, can be identified, enumerated, and mitigations can be prioritized. 4. Implementation Secure Coding Practices Focus is on secure coding requirements, rather then on vulnerabilities and exploits. Secure Code Reviews Defects, bugs and logic flaws are consistently the primary cause of commonly exploited software vulnerabilities. Static & Dynamic Code Analysist Detection of vulnerabilities and functional errors in deployed or soon-to-be deployed software. 5. Testing and Integration Security Testing ToolS Define needed tools and infrastructures in order to perform proper security testing. Review & Response of Process & Security Bug Handling Processes used to identify security-related issues, level of risk associated with those issues, and make informed decisions about risk mitigation or acceptance. 6. Maintenance Patch Management By promptly installing the necessary patches, system crashes and security breaches can be significantly reduced. 3rd Party Library Upgrades Maintaining not updated 3rd party recourses is one of the main reason for breaches Disposal Policy Secure disposal of equipment owned by the organization but no longer required.
- Speed – Get something to market quickly Iterate it Continuously improve it Danger – Security Performance Stability Compliance Maintainability The goal is to make changes rapidly, frequently and responsibly High quality services rely on the ability to make changes quickly and securely
- Speed – Get something to market quickly Iterate it Continuously improve it Danger – Security Performance Stability Compliance Maintainability The goal is to make changes rapidly, frequently and responsibly High quality services rely on the ability to make changes quickly and securely