Treating Security Like a Product

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1
SpringOne 2021
Treating Security like a Product
Hannah Hunt, Chief of Product, Army Software Factory
Alex Barbato, Solut...

2
Reference to products or services of any commercial company does not imply
official endorsement by the Department of Def...

3
Hannah and Alex
Chief of Staff - Kessel Run USAF
Chief Product Officer - Army Software Factory USA
Application developer...

4
How we got here, a satire
Alex: “Hey Hannah, we’ve got guidance we need to write up a few compliance documents and go
th...

5
How we got here, the real story
5

6
MySquad got to
production and we
started talking about how
things work well in
cybersecurity generally
(and also not so ...

7
Organizations struggle with prioritizing
cybersecurity and compliance needs

8
A Brief History of the Risk Management Framework in
the U.S.Government
● Built originally within the Department of
Defen...

9
It’s not quite that simple
Before 1992
Formative years
1992 - 2006
DITSCAP
2006 - 2016
DIACAP
2010 - Present
RMF
9

10
The U.S. Government often over rotates
on compliance at the detriment to real
cybersecurity standards

11
Government Cybersecurity Teams often...
have more knowledge in on-premise hardware versus cloud-based
technologies.
rel...

12
It’s not their fault!
12

13
“Many officials fail to perform the necessary risk framing activities that
inform the execution of RMF activities. Two ...

14
Cybersecurity and compliance also
struggle in industry
14

15
15
Small organizations
Fighting to survive Belief that
cybersecurity risk is
not insurmountable
or overly large
Lacking...

16
16
The facts for small organizations
*Research by Varonis and CSIS
$3.86
million
The average cost of
a data breach -
wo...

17
Enterprise doesn’t fare any better
17

18
18
The facts for enterprise
Increase in the
number of
ransomware attacks
on enterprises
The potential cost of
a mega br...

19
Employers today are in critical need for more cybersecurity
professionals, but they do not want more compliance officer...

20
What is lacked in cybersecurity
talent and efforts can be insured
for… right?
20

21
In addition to more effective
attacks and larger demands,
cyber insurance rates are
increasing to cover added costs.
Fo...

22
So how do we change that?
22

23
By treating security like a product
23

24
How does one treat security as a product?
The answer is a consistent view into the things that matter.

25
It is not trivial to see the entirety of the
iceberg
25

26
Many product teams focus on story velocity, usage, and revenue, but

27
These dashboards
fail to capture
underlying risk to
operations from a
cybersecurity risk
The bad news is
visualizing ri...

28
- Colin Bryar, Working Backwards: Insights, Stories, and Secrets from Inside Amazon
“Our emphasis is on what we call co...

29
Controllable input for security - control insights
Hear us out for a second...

30
Where the Federal government has it wrong...

31
31
There is plenty of good in there as well!
Controls exist! Measured based on
some measure of
risk
Automatable with
ef...

32
How might this look at a tactical level?
32

33
Small Organizations

34
34
All hands are on deck
Threat
modeling
A quick and dirty path to follow
Establish
relevant
controls
Determine
path to...

35
35
Threat modeling
Security without a threat model
GitHub has dependabot, right?
It’ll keep my dependencies up to
date ...

36
Establish relevant controls
There are oodles of frameworks and tools that exist to help in this domain.
Our primary goa...

37
Determine path to -- and measures for -- success
One anti-pattern we believe to be true is trying to separate security ...

38
Default to automation
While “automation” is the term used here, we really mean scalable systems that aren’t reliant on
...

39
Take feedback and iterate
39
* Check content definitely helps here.

40
Large Organizations

41
Product teams focused on certain cybersecurity aspects may emerge
- Penetration testers, detection
alerting, security a...

42
How does this manifest for us?

43
The question is less about why, but more about how
- Centralized management of security controls with
decentralized exe...

44
100 percent of respondents considered
soft skills to be important when hiring for
a security team, and 21 percent even
...

45
How these organizations traditionally align
45
“Cybersecurity /
Compliance”
Team
“Platform”
Product Team
Line of busine...

46
How it manifests on a project for us
46
“Cybersecurity /
Compliance”
Product Team
“Platform”
Product Team
“Application ...

47
Rallying Point

48
Treating security
like a product
garners user buy-in
into a
security-focused
outcomes while
making security
tangible.
O...

49
Thanks.

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

ChatGPT and the Future of Work - Cl... by Clark Boyd 7712 views
Getting into the tech field. what n... by Tessa Mero 1565 views
Google's Just Not That Into You: Un... by Lily Ray 3481 views
How to have difficult conversations by Rajiv Jayarajah, ... 2033 views
Introduction to Data Science by Christy Abraham Joy 81655 views
Time Management & Productivity - B... by Vit Horky 169409 views

Top clipped slide

1 of 49 Ad

1 of 49 Ad