The document discusses using data science and visualization techniques to connect security data sources and policies to risks and vulnerabilities in a graph database. This allows creating fact-based security decisions and risk dashboards. Workflows can then automate security incident handling and scale the approach. The approach aims to prevent crises rather than just incidents and make organizations safe rather than just secure.

1. @DinisCruz
Making Fact Based
Security Decisions
and 4x board scenarios
Oct 2019, @DinisCruz
Lightning talk (15m)

2. @DinisCruz
This is a story about making
Security Scale and giving it a
Seat at the Table

3. @DinisCruz
It is about
interconnecting all
data sources and
knowledge that we
have access to

4. @DinisCruz
It is about transforming
Spreedsheets from
sources of pain
into
sources of massive power

5. @DinisCruz
It about using Data
Science and
Visualisations to create
feedback loops

6. @DinisCruz
It about using
DevOps practices for
Security Operations
Security Data
Security Risks
Security Decisions

7. @DinisCruz
It is about Risk Dashboards
that make sense to
Management Stakeholders

8. Using OWASP Security Bot
(OSBot) to make Fact
Based Security Decisions
Sep 2019, @DinisCruz
Lightning talk (15m)

9. Serverless stack

10. CLI (Command Line Interface) to your data

11. REPL (Read Evaluate Print Loop)

12. Incident workflow automation
Real-word example

13. Workflow
Person
Credentials Application
uses
to access
conditions
generate
Alert
acknowledged in Slack by
entered in
action updates status of alert in

14. Jira as (graph) database

15. Slack as UI , Jira as Database

16. Create schema that represents the business

17. Map reality

18. Linked Security Policies
=
Fact based
Security Decisions

19. Hyperlinked policies in Jira
Policy’s pdfs
do not scale
because it is not
possible to link real-world
data to the respective policy

20. Convert policy into an graph

21. Policies Links to Facts Links to Vulns Links to Risks

22. Context specific Jira projects (for example FACTs)

23. Connecting Facts with Risks

24. Connected risk data

25. Graph project’s to outcomes and threats

26. Threat Models (in a scalable way)

27. DataScience your data

28. Risk workflows

29. Scale using Workflows
RISK Workflow VULN Workflow

30. Hyperlinked RISKs (from R1s to R4s to V1s to V3s)

31. Global Dashboards that actually are FACT based

32. Board dashboards (Delta)

33. Modern approach to managing security RISKs
https://www.soa.org/globalassets/assets/Files/Research/Projects/research-new-approach.pdf

34. JIRA Schema
Graphing Real World

36. Workflow everything

38. @DinisCruz
4x board scenarios

39. @DinisCruz
Not preventing incidents
Preventing crisis

40. @DinisCruz
Not making you secure
Making you safe

41. @DinisCruz
Creating connected
risk dashboards

42. @DinisCruz
Making the business case
for investing in legacy
applications
https://www.slideshare.net/DinisCruz/legac
ysecdevops-appsec-management-debrief

43. @DinisCruz
In conclusion

44. @DinisCruz
Thanks