A successful application security program - Envision build and scale

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

LAB3R12 A Successful Application Security
Program ‐ Envision Build and Scale
Post Conference Summary
...

A successful application security program: Envision, build and scale
Table of Contents

INTRODUCTION ...................

A successful application security program: Envision, build and scale
Introduction
Thank you for attending our Learning...

A successful application security program: Envision, build and scale
Lab Summary
Key Takeaways

HERE ARE THE TOP 3 C...

Advertisement

A successful application security program: Envision, build and scale

Activities:

A successful application security program: Envision, build and scale

A successful application security program: Envision, build and scale

A successful application security program: Envision, build and scale

A successful application security program: Envision, build and scale

Thank you again!
Best regards,
Jyothi Char...

Advertisement

SESSION ID:SESSION ID:
#RSAC
Jyothi Charyulu
A Successful Application Security
Program: Envision, Build and Scale
LAB3-R12...

#RSAC
Agenda

#RSAC
40% of attacks via public facing web apps
Point-of-sale attacks continue Insider threat remains strong
Malware autom...

#RSAC
Web applications – front door
of corporations1
Apps are top attack vector2
Breaches are VERY expensive3
Why applicat...

#RSAC
Application security program – top 3 questions to ask
5
What is your
current status?
What is your
application
securi...

Advertisement

#RSAC
Application security – current state
6
• Have ‘maturing’ app sec programs38%
• Have partially integrated app sec int...

#RSAC
How do you solve the top 3 challenges in security?
7
Alignment of
organizational
measures and
incentives
Prioritizat...

#RSAC
By integrating security across organization…
Portfolio management
Security checkpoints in product lifecycle from ide...

#RSAC
Application security program – top five maxims
9
Maxim 1:
Application
security program
roadmap

#RSAC
Application security program – top five maxims
10
Maxim 2:
Leadership
mandate

Advertisement

#RSAC
Application security program – top five maxims
11
Maxim 3:
Team
empowerment

#RSAC
Application security program – top five maxims
12
Maxim 4:
Secure SDLC

#RSAC
Application security program – top five maxims
13
Maxim 5:
Governance

#RSAC
Application security program – top five maxims
14
Program
roadmap
Leadership
mandate
Team
empowerment
Secure SDLC Go...

#RSAC
Application security program roadmap
15
Application
security program
roadmap

Advertisement

#RSAC
Envision your P E R F E C T application security program
Application security program components
Things to consider ...

#RSAC
Application security program - activity
17
In & out of the frame
exercise
Define YOUR security
program definition in...

#RSAC
Application security program definition
Help teams create secure code and reduce the number of vulnerabilities by
bu...

#RSAC
Application security program vision
SDLC integration
Security integrated in design/architecture phase
Threat modeled...

#RSAC
Application security program vision
Multiple testing techniques:
Static Testing (SAST)
Dynamic Testing (DAST)
Manual...

Advertisement

#RSAC
Envision
Application security program roadmap
Know what you need to
protect – define scope
Strategic roadmap - align...

#RSAC
Application security program – leadership mandate
22
Leadership
mandate

#RSAC
Leadership mandate
Find innovators and early adopters
Start small – pilot groups
Establish success in pilots

#RSAC
Leadership mandate
Top down + bottom up collaboration
Technical + cultural strategy + leadership
15-word program def...

#RSAC
Application security program - activity
25
Why app sec?
Payoff matrix
Low/High High/High
Low/Low High/Low
Cost
Benef...

Advertisement

#RSAC
Leadership mandate
Techies Pragmatists
Conservatives
Skeptics
Early
majority
Late majority
Adapted from The adoption...

#RSAC
Crossing the Chasm
Leadership mandate
Between early adopters and early majority – there is a large chasm
Most innova...

#RSAC
How do you cross the chasm?
Team empowerment Secure SDLC Governance

#RSAC
Team empowerment
29
Team
empowerment

#RSAC
Build Value Proposition
Team empowerment
Build matrix of champions
Change culture not just technology
Empower develo...

Advertisement

#RSAC
Security is everyone’s job
Empowerment Culture
Collaboration – generalists, no specialists
Autonomous teams and lead...

#RSAC
Key players
Technology
Executive
Product
Owner
Development
Risk and
Security
QA
Release
Manager

#RSAC
Application security program - activity
33
Roles and
responsibilities
Role play
Upon successful implementation:
Beha...

#RSAC
SSDLC – Secure Software Development Lifecycle
34
Secure SDLC

#RSAC
Security that is I N V I S I B L E
Secure SDLC
Security checklists at SDLC gates
Architecture and code reviews
Autom...

Advertisement

#RSAC
Secure SDLC Key Takeaways
Security, operations and development teams share accountability
Create a comprehensive set...

#RSAC
Security that is I N V I S I B L E
Secure SDLC – recommendations
Download and read OWASP ASVS Standard
Utilize secur...

#RSAC
Governance
38
Governance

#RSAC
You are what you measure
Governance
Implement Governance Framework
Policy definition
Education
Metrics
Feedback
Set ...

#RSAC
Governance
Create standards and policies based on
Cross-functional requirements
Industry Standards: OWASP Top 10/PCI...

Advertisement

#RSAC
Grow to new heights of success
Secure
Applications

#RSAC
Application security program - activity
42
Socialize YOUR app sec program:
What is your program about?
Why is it imp...

#RSAC
S E C U R I T Y t h a t i s I N V I S I B L E
Apply the maxims
Short term goals:
15-word project definition
Collabor...

#RSAC
Parting wisdom
44
“Change is hardest at the beginning, messiest in the middle and best at the
end“ - Robin Sharma
No...

#RSAC
Thank you!
Questions?
Jyothi Charyulu: Jyothi.Charyulu@sabre.com
Jaya Chilakamarri: Jaya.Chilakamarri@sabre.com

#RSAC
Secure design principles
Plan the application architecture, technology stack, and investigate
requirements including...

#RSAC
Secure design principles
Plan security requirements based on:
Authentication and session management
Access control
I...

#RSAC
NIST 500-269
For more information, visit https://samate.nist.gov/docs/webapp_scanner_spec_sp500-269.pdf

#RSAC
Additional resources for secure code
49
PCI SSC (Payment Card Industry Security Standards Council)
OWASP (Open Web A...

#RSAC
Additional resources for secure code
50
OpenSAMM
WASC (Web Application Security Consortium)
SANS institute
CWE/SANS ...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 59 Ad

View on Slideshare

1 of 59 Ad