Security Champions: Pushing Security Expertise to the Edges of Your Organization

© 2020 Denim Group – All Rights Reserved
Building a world where technology is trusted.
Dan Cornell | CTO, Denim Group
Security Champions
Pushing Security Expertise to the
Edges of Your Organization
April 2020

Dan Cornell
• Founder and CTO of Denim
Group
• Software developer by
background
• OWASP San Antonio co-leader
• Over 20 years experience in
software architecture,
development, and security

Pandemic Haircuts
2

3
Advisory
Services
Assessment
Services
Remediation
Services
Vulnerability Resolution
Platform
Building a world where technology is trusted
How we can help:
Denim Group is solely focused on helping build
resilient software that will withstand attacks.
• Since 2001, helping secure software
• Development background
• Tools + services model

Agenda
• Background
• Evolution of Software Security Assurance
Programs
• Program Development
• Additional Resources
• Questions
4

Evolution of Software
Security Assurance Programs
5

Evolution of SSA Programs
• Random Pen Tests
• Central Software
Security Group
• Security Champions
6

Random Pen Tests
• Scope
• “High-value” applications
• As required by compliance
• Frequency
• Ad hoc
• Quarterly/annual
• Staffed by
• Additional duty for network vulnerability management
7

Central Software Security Group
• Scope
• More comprehensive
• Risk-ranking and metadata
• Frequency
• Quarterly/annual
• Targeted by risk
• Staffed by
• Dedicated software security
professionals
• Teams growing over time and adding
specialization
8

Security Champions
• Scope
• Comprehensive
• Risk-ranking and metadata
• Frequency
• Add CI/CD integration
• Staffed by
• Existing central Software
Security Group
• Security champions drawn
from development teams or
hired specifically for the role
9

What Are Security Champions?
Security expertise
embedded or attached
to development teams
10

Program Development
11

Program Development
• Mandate
• Defining Roles and Standards
• Launch
• Optimize
12

Mandate
• What do want your Security Champions
program to do?
• And what do you not want it to do?
• There are a lot of aspects to an application
security program
• What do you want your security champions to
accomplish?
13

Mandate
• BSIMM
• https://www.bsimm.com/
• OWASP SAMM
• https://owasp.org/www-project-samm/
14

Example Models
• Improve vulnerability remediation process
• Accelerate testing and threat modeling
• Train developers on security
• Integrate testing into CI/CD pipelines
15

Defining Roles and Standards
• Roles
• Standards
16

Roles
• Naming
• Responsibilities
• Capabilities
• Make these formal roles
with responsibilities and
advancement paths
• Explicitly set expectations
on time commitment
17

Example Roles and Capabilities
18

Example Roles and Capabilities
19

Standards
• “The key is
enablement”
• Standardize (to the
degree possible)
• Terminology
• Knowledge base
• Training
20

Standards
• Vulnerability severity standards
• Scanning and testing workflows
• Vulnerability remediation workflows
21

Standards
• Secure coding guidelines
• Focus on checklists/lightweight materials
• https://owasp.org/www-project-cheat-sheets/
• Vet for recency/applicability
• Training curriculum
• What topics
22

Launch
• Build the team
• Begin the
rollout
23

Team Process
• Recruitment
• Training
• Growth
24

Recruiting Security Champions
• Selecting and training from within
development teams
• Bringing in new team members with
security-specific duties
25

Select and Train
• Familiar with team, tools, processes
• Typically limited security knowledge
• Requires training and time
• Security is an additional duty on top of development
tasks
• How to identify?
• Volunteers, students with aptitude and interest identified
via training classes, hackathons
26

Bringing In New
• Must become familiar with teams, tools,
and processes
• Can hire for specific skills
• Security is typically their duty
• May serve as security “overlay” for
multiple teams
27

So Which Is Better?
• Unsurprisingly, it depends
• Go back to Mandate and Roles
• If you want to accelerate
the vulnerability
remediation process Select
and Train may be more
appropriate
• If you want to provide more
testing and threat
modeling, Bringing In New
may be more appropriate
28

Training Security Champions
• Should have required skills and capability
levels – refer to your Doctrine
• Options
• Instructor-led training (outside) <- COVID-19!
• Instructor-led training (inside) <- COVID-19!
• E-Learning
• Self-study (OWASP materials, etc)
29

Career Growth
• Must be seen as a viable
career path
• Refer back to skills and
capability levels
• Ongoing technical training
• Conferences <- COVID-19!
• Vulnerability research
• Leadership training
30

Periodic Reviews
• Are you achieving your
desired outcome?
• What has it cost?
• Is that the best use of
resources?
31

Some Thoughts
• People like the idea of Security Champions
programs
• They are harder and cost more than
expected
• If managed well, they can provide speed and
scale
• As DevOps becomes DevSecOps Security
Champions will become the norm
32

Success Factors
• Have a solid mandate
• Allocate sufficient resources
• Focus on enablement
• Start small and evolve
33

Security Champions Playbook
https://github.com/c0rdis/security-champions-playbook
35

@DinisCruz
SVP of Engineering and
CISO at Glasswall
Twitter thread on their
Security Champions
program
https://twitter.com/DinisCruz/status/1252973586131881985
36

Questions

@denimgroup
www.denimgroup.com

Security Champions: Pushing Security Expertise to the Edges of Your Organization

More Related Content

What's hot

Similar to Security Champions: Pushing Security Expertise to the Edges of Your Organization

More from Denim Group

Recently uploaded

Security Champions: Pushing Security Expertise to the Edges of Your Organization