What is security? Why security is so important for web applications? What are the benefits of having focus on security aspects of web applications? What is information security? How to keep security at pace with innovation?

1. SECURITY AT THE SPEED OF
INNOVATION
Marudhamaran Gunasekaran
Scrum Gurgoan, Gurgoan, 15 July 2017

2. WEB BASED SOFTWARE?

3. BENEFITS OF SECURITY?

9. SECURITY MYTHS

10. What the PII?
Do you
process?
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf
First name? Last name?

11. Who is going to
hack me?Do hackers always carefully select a target
and hit them with a zero day attack?

12. Who is going to
hack me?
They might get lucky

13. Developers think their applications are intrinsically secure
Nobody is going to hack my website
Who is going to
hack me?

17. Network Security
Patch management, Network segregation, System level security,
Software and Hardware Asset management, …

18. Software Security is about defensive
programming

19. Extortion and Ransom? But we have antivirus

20. Someone wants to help you

21. Do they really want to help?

22. All they want is ransom

23. Let’s buy an
Application
Security Scanner

24. Developers don’t understand the reports and
scanner output, how to manage the
vulnerabilities?

26. False alarms aren’t the only issue, real
vulnerabilities may get missed as well
True? / False?
A Vulnerability Management Nightmare

27. Every Software is different and complex
in its own way

28. Security Bug vs Security flaw?
Technical errors vs Logical flaws

29. Can automation
solve Software Security problems?
Or
How much software security problems does
automation solve?

30. Increase in pace of delivery 4 weeks to 2 weeks
to 1 week to 300 pushes to Production a day

31. DevOps, Infrastructure as Code, Virtualization
& Containers  More automation can be good

32. Faster pace of delivery calls for a Practical Risk
Management for Software Development

33. Continuous Software Security Platform
Continuous Security at SDLC and Delivery *
Practice and Knowledge Assessment *
Hack Yourself First Training *
Coach the Coders to Secure on the job *
Secure Code
Review *
Penetration
Testing *
Environment
Scans *Biweekly
reporting *
Automation
and Tuning *
People Practices Tools

34. Software Security Focus Areas

35. Continuous Software Security Maturity
Model

36. All of us have a part to play
- Program Managers
- Developers
- Security Professionals
- Executives
- Quality Assurance Professionals
Takeaway #1

37. Automation and tools do help, use it where it matters
Only humans can:
- Integrate security automation in to the Software Development
process
- Can sift through automation results and prioritize accordingly
- Understand the limits of automation tools and employ
intelligence
- Help you develop correct software security program based on
experience and context of business
Takeaway #2

38. Build Security-In the software itself rather than bolting on after the
software is done
Takeaway #3

39. Vraagen?
Dankje wel!
Screen recording of this presentation at
https://vimeo.com/gmaran23/securityatthespeedofinnovation