HOW TO EMBED SECURITY INTO AGILE? - InfoSecBC...HOW TO EMBED SECURITY INTO AGILE? VanSecSIG Oct 12,...
Transcript of HOW TO EMBED SECURITY INTO AGILE? - InfoSecBC...HOW TO EMBED SECURITY INTO AGILE? VanSecSIG Oct 12,...
1
HOW TO EMBED SECURITY INTO AGILE?
VanSecSIG
Oct 12, 2018
Momchil Karov
Best Buy Canada
PRESENTED BY: (A.K.A. THE “WHO AM I” SLIDE)
Momchil Karov, MSc., CISSP
Principal Security Architect
Enterprise Risk and Compliance
Best Buy Canada Ltd. (100% owned subsidiary of Best Buy Co., Inc.)
2
3
WHY DO WE NEED IT, WHAT DO WE NEED AND HOW TO
IMPLEMENT IT SUCCESSFULLY?
A SIMPLIFIED APPROACH ALIGNED WITH AGILE’S PHILOSOPHY.
4
WHY CHANGE? REASON #1 – THE ENEMY
Our enemy is already Agile and has been for a long time!
•It’s highly flexible and adapting quickly to change.
•It adopts new skills and technologies extremely fast.
•It’s very focused and determined following its goals.
So why can’t we be like our enemy?
5
TRADITIONAL SECURITY – THE ENFORCEMENT WAY
Enforcing security policies, standards and requirements, usually working in silos has been the traditional way of security for a long time.
This approach creates waste in the business processes, sometimes even bad cross-team relationships.
SECURITY INSIDE WALLS, REASON #2 – TEAMS
6
People
Techno
logy
Proces
ses &
proce
dures
Security surrounded by walls does not allow the flow of knowledge and awareness through the organization and also breeds shadow IT. People are afraid of security to say “No”.
OK, GOT IT, WE HAVE TO CHANGE
7
•A new paradigm shift
•Transformation of culture and mindset.
•Security – responsibility of everyone.
•No more silos.
•Information security as a competitive advantage.
8
REASON #3 – THE CUSTOMER …
OR DURABLE COMPETITIVE ADVANTAGE
A very important concept by the greatest investor of our time – Warren Buffett.
The main question is – for a company with a business based on a technological competitive advantage, can this advantage be durable without a strong information security program to protect it?
Here’s where security interconnects deeply with business and becomes part of the durable competitive advantage!
9
WHAT IS AGILE?
•Common name for a group of iterative and incremental methodologies.
•Specific mindset and style of work, following a set of values and principles, where requirements and solutions can evolve through team collaboration.
• Time-fixed, repeatable and self-adjusting process.
10
REALLY, WHAT IS AGILE?
AGILE
VALUES & PRINCIPLES
DECISIONS
DEVELOP WORKING SOFTWARE
11
WHAT IS AGILE – A PENCIL ANALOGY
Watch the YouTube video “Agile Explained... with a PENCIL!”
https://www.youtube.com/watch?v=k_ndH7B-IS4
12
WATERFALL VS. AGILE
Quality
Time Cost
FunctionalityTime Cost
Quality
Functionality
Waterfall Agile
Fixed
Variable
13
Waterfall methodology - first described back in 1970 by Winston Royce as “something you shouldn’t do" in his article "Managing the development of large software systems”.
HISTORY OF WATERFALL
Winston Walker Royce (August 15, 1929 – June 7, 1995)
FOUR CORE VALUES OF AGILE
OR AGILE MANIFESTO
14
We are uncovering better ways of developing software by doing it and helping others do it.Through this work we have come to value:
1. Individual interactions over processes and tools.2.Working software over comprehensive documentation.3.Customer collaboration over contract negotiations.4.Responding to change over following a plan.
That is, while there is value in the items on the right, we value the items on the left more.
15
12 PRINCIPLES OF AGILE
1. Satisfy the customer.
2. Welcome change.
3. Deliver frequently.
4. Work together.
5. Trust, support & motivate.
6. Face-to-face communication.
16
7. Working software.
8. Sustainable development.
9. Continuous attention to technical excellence.
10. Simplicity is essential.
11. Self-organized teams.
12. Reflect and adjust.
12 PRINCIPLES OF AGILE
17
KEY FACTS ABOUT AGILE
• It’s driven by reality and customer requirements.
• It’s focused on end user/customer, i.e. the business.
• It’s based on free communication and open collaboration.
• It takes reward/risk into account.
• It’s characterized with timely and rapid delivery of results.
• It’s highly adaptable to change, using course corrections natively.
• It relies on discipline and focus.
18
THE SCRUM METHODOLOGY
Sprint planning
Sprint review & retrospect
19Product Owner
MAIN ROLES IN A PRODUCT STREAM
Scrum Master
Team Members
Business Users
WHAT IS A USER STORY?
20
As a < type of user >, I want < some function>, so that < some benefit >
Example: As a web site user, I want to be able to login, so I can access my personalized dashboard.
21
EFFECTIVE COLLABORATION IS PARAMOUNT
•Open collaborative environment.
•Teams engage and share ideas easily and without constrains.
•No more working in silos.
•Everyone as a team is responsible for the success as well as the failure.
22
Improve efficiency.
Better use of resources.
Empower the human talent.
Don’t reinvent the wheel.
AUTOMATION EVERYWHERE
Popular automation tools:
SOLUTIONS THAT MATTER
23
How to make sure security becomes integral part of Agile?
Key paradigm shift: Security – responsibility of EVERYONE!
24
SECURITY CHAMPIONS PROGRAM
•A key strategy to address security in the Agile environment.
•Adopted successfully by many organizations.
•Creates strong bond between Security and Agile teams.
25
INDUSTRY TRENDS
“By 2021, 35% of enterprises will implement a security
champions program, up from less than 10% in 2017”
Gartner
26
MAIN OBJECTIVES
• Develop Working and Secure Code.
• Manage Security Risk for Agile.
• Do everything the Agile way.
27
OWASP DEFINITION
• Security Champions are active members of a team that may help to make decisions about when to engage the Security Team
• Act as the "voice" of security for the given product or team
• Assist in the triage of security bugs for their team or area
28
SECURITY CHAMPION’S ROLE
• Act as a security ambassador in their product streams.
• Communicate CoP (Community of Practice) decisions andknowledge back to the teams.
• Assess security impact and risk at the high level.
• Make decisions about engaging Security.
• Develop “evil stories” for their team’s sprints.
• Review and approve usage of third party libraries.
• Have these responsibilities in their PA goals.
29
HOW TO RUN THE SECURITY CHAMPIONS PROGRAM?
Communicate – simplify the security concepts for the Agile teams and don’t reinvent the wheel, but utilize the full potential of popular Agile tools, such as Confluence/Jira.
Step 1
30
HOW TO RUN THE SECURITY CHAMPIONS PROGRAM?
Step 2
Collaborate – make it easy for the Agile teams to engage security, again, by utilizing the full potential of the widely used Agile tools.
31
HOW TO RUN THE SECURITY CHAMPIONS PROGRAM?
Step 3
Coach – training and coaching is the key to achieve competence across the board and build trust. Coaching of security knowledge must follow the Agile values and principles in a complete sync.
32
HOW TO RUN THE SECURITY CHAMPIONS PROGRAM?
Step 4
Trust – build strong team relationship, based on mutual trust. It should come naturally as a result of executing successfully the above steps from 1 to 3.
33
HOW TO RUN THE SECURITY CHAMPIONS PROGRAM?
Step 5
Deputize – delegate responsibilities, based on the strong foundation of trust.
34
HOW TO RUN THE SECURITY CHAMPIONS PROGRAM?
Step 6
Quantify – build statistics using easy to implement metrics in order to measure the progress and to provide adjustments that further improve the overall process.
SOME PRACTICAL TASKS
35
• Organize continuous training sessions, preferably bi-weekly.
• Constantly improve the resources for Security Champions:
• By creating ‘Secure Coding Cheat sheet’.
• By offering online training resources for continuous self-training (ex. Hacksplaining.com).
• By constantly updating the ‘Secure Code’ Confluencepage, following the industry.
• Possibly provide a tool for each team to create and use Evil-Stories within each sprint – i.e. Microsoft Threat Modeling Tool.
36
•An innovative idea by the OWASP team.
•Simplifies the threat modeling process forAgile and makes it easier to understand.
•Provides an Agile-friendly method ofincluding security requirements in eachsprint cycle.
•Can be easily embedded in the processfor each Agile sprint in the backlog assecurity task to “fight evil”.
THE CONCEPT OF “EVIL STORIES”
37
EXAMPLE OF A SECURITY STORY
Security Story Backlog Tasks SAFECode
Fundamental
Practices
CWE-ID
As a(n) architect/developer, I want to
ensure AND as QA, I want to verify that
cross-site request forgery attacks are
prevented.
* Use one of the many available
libraries and
frameworks that takes CSRF into
account.
* Defend against cross-site
scripting Story.
* Do not use HTTP GET for any
method that effects a change in
system state.
* Use Anti-Cross
Site Scripting
(XSS) Libraries
* Validate
Input
and Output
to Mitigate
Common
Vulnerabilities
* Use Logging
and
Tracing
CWE-
352
38
HELPFUL TOOLS
Microsoft Threat Modeling Tool 2016 (free to download)
SAFECode
Practical Security Stories and
Security Tasks
for Agile Development
Environments
(34 pages PDF document)
Enterprise Tools
Education and training
https://www.hacksplaining.com/
39
FOCUS ON COACHING
The Agile Security process is focused on iterative and self-adjusting coaching and general awareness initiativestowards the goal of making security everyone’sresponsibility.
40
Evil stories To-Do: “Fight Evil”Security stories
Code Analysis
Secure Increment
Definition of “Done”Acceptance Criteria
• Evil stories are created foreach sprint and are brokendown to “fight evil” securitystories and to-do tasks &components whichrepresent the securityrequirements.
• Static code scans areperformed in each sprintcycle.
• Secure increments arereleased to production inan automated fashion.
SCRUM WITH EMBEDDED SECURITY
41
DO WE HAVE TO CHANGE AGILE?
Not really. It’s all about interpretation of the “working andvaluable software” phrase from customer’s perspective.
Working and valuable also means SECURE!
But even if you add “secure” to Agile’s values and principles, itstill doesn’t change its philosophy!
42
Closing remarks
Security must be Agile and Agile adopts security naturally!
Change is inevitable – embrace it!
Everyone benefits from it!
QUESTIONS?
43
“The important thing is not to stop questioning.
Curiosity has its own reason for existing.”
Albert Einstein
THANK YOU!
44