Securing 100 products - How hard can it be?

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Nir Valtman, CISSP, CSSLP
Securing 100 Products - How Hard Can It Be?
ASD-W10F
Head of Applic...

#RSAC
Why Does This Talk Matter?
2
You Like Expensive Stuff!
Someone Will Pay You Lots Of $$$ To Do It
You May Need To Sec...

#RSAC
Meet Dave!
3
Accountable for Product Security
Cloud-based, self-hosted or installed on
customers’ premise
Part of th...

#RSAC
Legal Internal Audit
The Daily Challenges
4
IT Services
CISO
Solution
Management
Hardware
Solutions
Professional
Ser...

#RSAC
Mapping The Business Owners
5
Product #1
 Software R&D
 CISO
 Legal
 Product
Management
 Internal Audit
Product...

#RSAC
Will I Finish This Mapping Soon?
6
Will I Finish
This Mapping
Soon?

#RSAC
Scoping The Accountability

#RSAC
Core vs. Extensions
8
Customer #1
Extensions
Customer #N
Extensions
Core/Vanilla
Customer #2
Extensions
?

#RSAC
Difficult To Control All Engineering Parties
9
Security
requirements are
documented!
APIs are
documented!
Who cares?...

#RSAC
Resource Diversity & Limitations

#RSAC
Distinct Technologies
The trademarks specified above are trademarks or registered trademarks of their respective own...

#RSAC
Diverse Application Security Tools
12
Static Application
Security Testing (SAST)
Dynamic Application
Security Testin...

#RSAC
Labor Limitations
13
1%-2%
of engineering org size

#RSAC
Application Security Maturity
Program
So Simple To Follow Guidelines, Isn’t It?

#RSAC
Governance – Easy To Say, Difficult To Control
15
Develop an S-SDLC Enforce the S-SDLC
Provide Technology-Specific T...

#RSAC
Construction – Relatively Difficult
16
ThreatAssessment
Documenting
risks in agile
development
lifecycle
consumes
re...

#RSAC
Verification – Roadblocks Ahead!
17
•Get the/a design diagram from engineering teams… lots of teams!!!
•Working with...

#RSAC
Deployment – Only Sounds Easy
18
”Shadow”-operated IRT IT-operated IRT
Work w/ every engineering
team to QA hardenin...

#RSAC
Perspective On 1 Of 100 Products
19
1.60
2.60
3.00
1.00
2.601.35
1.70
2.10
1.67
1.68
2.35
1.70
0.00
0.50
1.00
1.50
2...

#RSAC
Perspective On 1 Of 100 Products
20
Additional Considerations
Number of items per
development lifecycle stage
E.g. p...

#RSAC
Perspective On 100 Products
21

#RSAC
Perspective On 100 Products
22
Product names are sanitized

#RSAC
Don’t Reinvent The Wheel,
Just Realign It!
(Anthony J. D’Angelo)

#RSAC
NCR’s App Sec Team’s Specialties
24
Application
Security Architect
Application
Security Engineer
Application
Securit...

#RSAC
NCR’s App Sec Team’s Specialties Mapping
25
OpenSAMM Speciality
Domain Activity Security
Architecture
Program
Manage...

#RSAC
Prioritizing Security
26
Internet-
Facing &
Regulated
Internet-
Facing
Internal
Internal
Regulated
>$5M
$500K-
$1M
<...

#RSAC
Budgeting Labor Correctly – The Formula
27
Product Type % Of R&D
Internet-Facing & Regulated 2%
Internet-Facing 1%
I...

#RSAC
A Lesson Learned
28
Even with an aggressive strategy, hiring
app sec people is a REAL bottleneck!
(Nir Valtman, RSA ...

#RSAC
Measuring Effectiveness!
29
Ongoing
Escalations asking for security resources by the
engineering teams are good!
Sta...

#RSAC
Measuring Effectiveness!
30
Year Over Year
Overall Application Security Maturity rank increases
Decreased number of ...

#RSAC
Scaling Out Team’s Capabilities
31
Security Questionnaire For Engaging An App Sec Architect
10 Yes/No Questions

#RSAC
Scaling Out Team’s Capabilities
32
Security Questionnaire For Engaging An App Sec Architect
10 Yes/No Questions
Is D...

#RSAC
10 Yes/No Questions
Scaling Out Team’s Capabilities
33
Security Questionnaire For Engaging An App Sec Architect
Work...

#RSAC
Scaling Up Security
34
Application Security Must Fit Into Any Pipeline
Plan Code Build Test Release Deploy Operate
D...

#RSAC
Scaling Up Security Using Release Automation
35
Static App Sec Testing
Interactive App Sec
Testing (IAST)
Binary Sig...

#RSAC
Scaling Up Security When Lacking Automation
36
Identify Quick Wins
Static App Sec Testing Binary Signing
Code Obfusc...

#RSAC
Finding The Partnerships – Use Cases
37
Partnerships
Customer Needs
Industry Trends
Regulations
Security

#RSAC
Additional Tips
38
Securing 100 products takes years.
Start by investing 80% of the resources in 20% of the products...

#RSAC
39

#RSAC
Apply What You Have Learned Today
40
Next week you should:
Generate security engagement questionnaire (10 Yes/No Qs)...

#RSAC
41
QUESTIONS
QUESTIONS
QUESTIONS
QUESTIONS
QUESTIONS
QUESTIONS
Nir Valtman
Nir.Valtman@ncr.com
@ValtmaNir

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 41 Ad

View on Slideshare

1 of 41 Ad