A worldwide journey to build a secure development environment

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Dawn Cappelli
A Worldwide Journey to Build a Secure
Development Environment
EXP-R02F
VP and ...

#RSAC
Why do we need a Secure Development
Environment (SDE)?
2

#RSAC
Rockwell Automation
3

#RSAC
Why do we need a Secure Development
Environment (SDE)?
4

#RSAC
Why do we need a Secure Development
Environment (SDE)?
5

#RSAC
Why do we need a Secure Development
Environment (SDE)?
6

#RSAC
Introduction – Dawn Cappelli
7

#RSAC
Introduction – Geof Storms
8
Manufacturing engineer, 1985-1990
Program manager, 1992-1994
VP Operations & business d...

#RSAC
What is a Secure Development Environment?
The SDE is intended to protect our most
important Intellectual Property f...

#RSAC
Where to start?
10
1. Determined highest risk locations
where we do development
2. Identified high risk development...

#RSAC
The Right Way and the Wrong Way
Source: https://en.wikipedia.org/wiki/Gilligan's_Island Source: http://www.businessi...

#RSAC
The Right Way: Plan carefully
12

#RSAC
The Wrong Way: Jump right in!
X
X X
X13

#RSAC
How does this compare to creation
of a Secure Development
Environment (SDE)?

#RSAC
Initial SDE Pilot: A Success!
The SDE in high-risk locations
for high-value assets is
equivalent to a vault – prim...

#RSAC
But then things went off track…
16
Source: RC Boat Magazine

#RSAC
Issue #1: Cost to scale
17

#RSAC
Issue #2: Impact to productivity
18

#RSAC
Issue #3: Erosion of controls
19

#RSAC
Issue #4: Lack of ownership
20

#RSAC
Course Correction Leads to Long-Term Success
21

#RSAC
What’s Next: Apply course correction to future SDEs
Source: markedsforing.dk/artikler/kampagner/vestas-race-we-must-...

#RSAC
New Discovery: One size does not fit all
23

#RSAC
Without proper planning it can be difficult to adjust
24

#RSAC
How does this compare to creation
of our second Secure Development
Environment (SDE)?

#RSAC
With proper planning it is much easier
26

#RSAC
Issue #1: A Different Threat Environment
27

#RSAC
Issue #2: Aging Infrastructure
28

#RSAC
Issue #3: Change Management and Training
Source: Brian Carlin – Team Vestas Wind
29

#RSAC
Issue #4: Collaboration Requirements
30

#RSAC
The Solution: Three Tiers of SDEs
The SDE in lower threat location
for high value assets is
equivalent to a fence ...

#RSAC
Final Lesson Learned: Use a phased approach
http://www.b2bnn.com/2016/04/death-of-the-minimum-viable-product/
Use th...

#RSAC
Current State: Rolling out SDEs globally
33

#RSAC
Apply: Action Plan
34
Step 1 • Identify your most critical assets
• Where are they? Who needs access?
• How do tho...

#RSAC
Additional Questions?
Please join us for our Focus On session from 9:15 – 10:00 am in
Moscone West 2024
35

#RSAC
Contact Information
36
Dawn Cappelli
Vice President and Chief Information Security
Officer
Rockwell Automation
+1 4...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 36 Ad

View on Slideshare

1 of 36 Ad