Tracking the Progress of an SDL Program: Lessons from the Gym
Report
OWASPFollow
OWASPJul. 5, 2009•0 likes•672 views
Tracking the Progress of an SDL Program: Lessons from the Gym
Jul. 5, 2009•0 likes•672 views
Download to read offline
Report
Education
Technology
Health & Medicine
This presentation is from the 29 June 2009 OWASP Minneapolis-St. Paul (MSP) chapter meeting. Cassio Goldschmidt of Symantec talked about defining consistent metrics for tracking security vulnerabilities throughout the security development lifecycle.
OWASPFollow
OWASPRecommended
DNS Advanced Attacks and AnalysisCSCJournals
The bare minimum that you should know about web application security testing ...Ken DeSouza
Static RoutingSachii Dosti
Route 53 Latency Based RoutingAmazon Web Services
Routing table and routing algorithmslavanyapathy
Understanding the Routing Table StructureMakram Ghazzaoui
More Related Content
Similar to Tracking the Progress of an SDL Program: Lessons from the Gym
FUNDAMENTALS OF TESTING (Fundamental of testing what) CindyYuristie
Bcc exceed ste_certSusan L.
Fundamental of testing (what is testing)helfa safitri
Fundamentals of testing 2seli purnianda
AFITC 2018 - Using Process Maturity and Agile to Strengthen Cyber SecurityDjindo Lee
fundamentals of testing (Fundamental of testing what)diana fitri, S.Kom
Recently uploaded
PUSAT BAHASA UINSA.pdfLBB. Mr. Q
CSCI_1001_Intro_Class1.pptxmcardonalebron
GDSC Info Session KMIT20BD1A053LShujaKMIT
Pre-Departure Guidelines for Studying in the UK.pdfAHZ Associates
Desktop Support Engineer Roles Vignesh kumar
BÀI TẬP BỔ TRỢ TIẾNG ANH LỚP 8 CẢ NĂM - GLOBAL SUCCESS - NĂM 2024 - CÓ FILE N...Nguyen Thanh Tu Collection
Tracking the Progress of an SDL Program: Lessons from the Gym
- Same workout metrics do not apply
- Quality of your intake affects overall performance
- Programming languages in use
- Supported platforms
- QA: Security Testing, Tools
- Approximately 3 hours long
- Metrics
- Class content
- Instructor knowledge
- Quantify results in a meaningful way to “C” executives
- Past results can be used to explain impact of new findings
- Can be simplified to a number from 1-10 or semaphore (green, yellow and red).
- Can be used for competitive analysis
- Harder to game CVSS
Editor's Notes
- Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this pragmatic presentation we’ll discuss metrics used at Symantec, the world’s largest security ISV, to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally and how the numbers compare with the competition.
- Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 13 years of technical and managerial experience in the software industry. During the seven years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. Cassio is also internationally known for leading the OWASP chapter in Los Angeles.Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from PontificiaUniversidadeCatolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California.