This prezo was given on a webinar to a) educate attendees on best practices for building security into their software development process b) to demonstrate our TeamMentor product's capabilities in helping solve this challenge and c) to articulate 4 major business use cases for how one would use the TeamMentor knowledgebase along with its integration components.

1. Streamlining the Fix
Diminishing the Impact of Software Vulnerabilities with a
Predictive Process

2. Today s Presenters
Tom Bain, Director, Product Marketing
Dinis Cruz, Principal Software Architect

3. Today s Agenda
Development and Security are looking for a better way to
identify, verify, prioritize and fix software vulnerabilities.
• Where do I start?
• What s the best approach?
• What process can I apply?
• Whattools can I use for
repeatable results?

4. Who We Are
Application Security Experts
• 10+ Years vulnerability research
• Security Testing Methodology adopted by
SAP, Microsoft, Symantec
• Authors of 8+ books
Products and Services
• Standards - Best Practices
• Education - CBT & Instructor-Led
• Assessment - Software and SDLC
Reducing Application Security Risk
• Critical Vulnerability Discovery
• Secure SDLC Rollout
• Internal Competency Development

5. Our Approach
• Standards: Create security
policies, align dev activities with
standards and compliance
requirements, fix vulnerabilities.
• Education: Create internal
expertise through eLearning,
Instructor-led and virtual
classroom training.
• Assessment: Audit software
apps against policies and
compliance requirements and
recommend remediation
techniques.

6. Life is a Breach
Companies who suffered 1-10 breaches over the past 2 years, as a
result of a software app being compromised.

7. A Process is Lacking
State they either have no process (like an SDLC) at all, or an inefficient ad-
hoc process for building security into their applications.

8. What Motivates Action?
State there is no formal state that there is no formal mandate in place
to remediate vulnerable application code.

9. Common Use Cases
• Development teams don t know where to go for best practices guidance on
software vulnerabilities.
• There sa need to communicate and share intelligence around specific
vulnerabilities with your team.
• Teams need to fix vulnerabilities and map to internal policies.
• There s a market need for making more sense of static analysis results to get
full-circle remediation.

10. Where can developers go for the
guidance they need?
Use Case 1- Security Team
• A
software vulnerability has
been identified.
• You
need to verify it and
need more information
about it.
• Whatdo you do, and
where do you go for
guidance?

11. How can you share the information?
Use Case 1I - Security Team
• You’ve
verified a software
vulnerability.
• Youneed to
communicate the details
of that vulnerability or set
of vulnerabilities to your
team.
• Howis this accomplished
most effectively?

12. Integrating with what you already have
Use Case III - Development Team
• You’ve verified a given
vulnerability, and can now
prioritize it.
• Youhave knowledge
internally, or security policies
you need to map to.
• Howcan I do this in a
streamlined way?

13. Doing more with static analysis results
Use Case IV - Development Team with Tools
• The tool reports findings.
• Youneed to make more
sense of the results.
• Thefindings point to
guidance specific to the
findings.
• Fix
what you’ve found.
Re-scan.

14. Secure Development Guidance
A Real-Time In-Practice Companion Containing 4500+ Articles
of Prescriptive Guidance and Code

15. Try TeamMentor Today!
Evaluation Version:
• OWASP Guidance Library (Creative Commons Content)
• Install locally, or use web version
• Watch a video: http://bit.ly/Vra3OS
• Download it: https://docs.teammentor.net/xml/Eval
Enterprise and Partner Versions:
• Full set of guidance libraries (4,500+ articles)
• Single user, cloud instance, business unit, enterprise-wide pricing
• Partner organization licensing
• Contact us: getsecure@securityinnovation.com