Це буде огляд підходів до побудови програми безпеки програмного забезпечення в команді розробки або кампанії загалом, доповнений висновками з мого власного досвіду виконання практичних та консультаційних проектів в сфері Application Security.

1. Тема доклада
Тема доклада
Тема доклада
KYIV 2019
The sooner the better but never too late
Vlad Styran, Berezha Security
QA CONFERENCE #1 IN UKRAINE

2. The sooner the better but never too late
or Why software security starts with testing
Who is this guy?
Why security?
What exactly is security?
Why software security sucks?
Who cares about security and when?
How to do as little as possible and stay safe?

3. Who is this guy?
Vlad Styran, OSCP CISSP CISA
Co-founder & VP, Berezha Security
15+ years of security experience
10+ years in offensive security (AKA hacking)
#OWASPKyiv, #NoNameCon, #NoNamePodcast
Long distance runs, marathon finisher
Formally trained as a “Programmer”, 0 days of related experience
¯_( )_/¯

5. Why security?

6. Constant challenge
Well paid
1,800,000 unfilled jobs
Kind of fun

7. - Why security?
- Seriously? No idea!

12. What exactly is
security?

21. Why software
security sucks?

22. It’s all in our head

23. Han Solo & Sheev Palpatine, circa 1969

24. Daniel Kahneman & Amos Tversky, late 1970’

27. Usual Development Lifecycle

28. Agile Security

29. Who cares about
security and when?

32. Outsourcing companies

33. Product companies

34. Startups

36. How to do as
little as
possible and
stay safe?

38. Core Security Practices
Threat Modeling
Secure
Architecture
Supply Chain
Security
Secure Coding
Security Code
Review
Security Testing
Incident
Response
Annual Third
Party
Penetration Test

40. “Give a man a fish, and you'll feed him for a day.
Give a fish a man, and you’ve fed it for the lifetime.”
– Sun Tzu

41. "Give a man a fish, and you'll feed him for a day.
Teach a man to fish, and you've fed him for a lifetime.”
– Confucius

42. Zero to Hero
Web Application Hacker’s Handbook PortSwigger Web Security Academy

43. Meetups and Conferences
OWASP Ukraine ! applica1on security conference (Oct 4-5, 2019)
OWASP chapters: Kyiv, Lviv, Dnipro, Kharkiv, Zhytomyr… (JGI)
DefCon groups, local security communi1es (ask around)
Security BSides conferences and meetups (call you dealer)
NoNameCon ♥ prac1cal cybersecurity conference (3rd week of May)

44. Bug Bounties

46. How you find me
@arunninghacker
fb.me/vstyran
berezhasecurity.com

47. “Thank You” Slide