SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Essential Guide to Developing an Application Security Program

haven avatar
haven
23 diapositives · 353 Views · Jul 29, 2014

In this presentation from the TASSCC 2011 Annual Conference, Philip J. Beyer and John B. Dickson discuss key fundamentals of an effective application security program. They cover the growing importance of application security, current trends, and essential practices for establishing a robust security framework. Attendees will learn about common misconceptions, what tools are necessary at different stages, and the incremental steps toward maturity in application security. This session emphasizes understanding risks, managing teams, and leveraging existing resources for optimal success.

Essential Guide to Developing an Application Security Program - slide 1
01 / 23Essential Guide to Developing an Application Security Program
1 / 17

Télécharger la présentation

Essential Guide to Developing an Application Security Program
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Lean and (Prepared for) Mean:Application Security Program Essentials Philip J. Beyer - Texas Education Agency philip.beyer@tea.state.tx.us John B. Dickson - Denim Group john@denimgroup.com TASSCC 2011 Annual Conference

  2. Overview • Background • Trends • Essentials • Roadmap TASSCC 2011 Annual Conference

  3. About • Phil Beyer • Information Security Officer • Consulting background • John Dickson • Application security industry leader • TEA • ~700 employees • ~1200 school districts • ~5 million students TASSCC 2011 Annual Conference

  4. Application Security – What? Why? • In Brief • Web applications can be attacked • Attacks are different from network or OS levels • Becoming a significant attack vector • Impact • Attackers bypass traditional infrastructure security controls • Users are a target as well as data TASSCC 2011 Annual Conference

  5. Trends • At TEA • Applications created regularly and retired slowly • Ability to outsource remediation decreased due to funding limitations • In the Industry • Attacks are increasingly sophisticated and automated • Remediation costs increase in later phases of the development cycle TASSCC 2011 Annual Conference

  6. EssentialsWhere Did TEA Start • Application Security Program established • Some policy and procedure • Initial training and exposure to concepts • Historically siloed approach • Outsourcing for subject matter expertise • Veracode • Denim Group TASSCC 2011 Annual Conference

  7. EssentialsThe Premise • Some things you Don’t Need • Some things you Do Need • Some things you Just Don’t Need Yet TASSCC 2011 Annual Conference

  8. EssentialsWhat You Don’t Need • An Expensive Scanner • A Security Process for scanning is more important • Simple (free) scanners will get you started • Buy the software later TASSCC 2011 Annual Conference

  9. EssentialsWhat You Don’t Need • A Complicated Scoring/Tracking Tool • A Security Process for profiling is more important • Risk ranking doesn’t have to be hard • Keeping track of your applications can be simple • Buy the software later TASSCC 2011 Annual Conference

  10. EssentialsWhat You Don’t Need • A Dedicated Application Security Team • A Security Process for testing is more important • Leverage your existing QA and Testing team • Simple security testing will get you started • Build and train your testing capability gradually TASSCC 2011 Annual Conference

  11. EssentialsWhat You Don’t Need • A Perfect SDLC • Get started with what you have now • Update your policies and procedures as you go • Don’t try to drop in “The Secure SDLC” all at once TASSCC 2011 Annual Conference

  12. EssentialsWhat You Do Need • A Champion • That’s You! • Understand the problem • Communicate the risk • Work with the business TASSCC 2011 Annual Conference

  13. EssentialsWhat You Do Need • A Team that Gets It • Managers • Developers • Testers • Security TASSCC 2011 Annual Conference

  14. EssentialsWhat You Do Need • Good Training • Resources exist, some are free • The trainer is important • Attacks evolve, so should your training TASSCC 2011 Annual Conference

  15. EssentialsWhat You Do Need • Expert Help • Technical questions will arise • Some vendors will dispute vulnerabilities • Be sure your team can consult with experts TASSCC 2011 Annual Conference

  16. EssentialsWhat You Do Need • A Roadmap to Maturity • Use an established maturity model • OpenSAMM • BSIMM • Design a roadmap to get to maturity • Don’t try to do it all at once TASSCC 2011 Annual Conference

  17. RoadmapUse a Maturity Model • OpenSAMM - Software Assurance Maturity Model • Maturity levels 1 thru 4 • Governance • Strategy & Metrics (2), Policy & Compliance (3), Education & Guidance (3) • Construction • Threat Assessment (3), Security Requirements (3), Secure Architecture (3) • Verification • Design Review (2), Code Review (2), Security Testing (3) • Deployment • Vulnerability Management (3), Environment Hardening (3), Operational Enablement (3) TASSCC 2011 Annual Conference

  18. Roadmap – Phase 1Governance • Estimate overall business risk profile • Build and maintain an application security program roadmap • Build and maintain compliance guidelines • Conduct technical security awareness training • Build and maintain technical guidelines TASSCC 2011 Annual Conference

  19. Roadmap – Phase 1Construction • Derive security requirements based on business functionality • Evaluate security and compliance guidance for requirements TASSCC 2011 Annual Conference

  20. Roadmap – Phase 1Verification • Derive test cases from known security requirements • Conduct penetration testing on software releases TASSCC 2011 Annual Conference

  21. Roadmap – Phase 1Deployment • Identify point of contact for security issues • Create informal security response team(s) TASSCC 2011 Annual Conference

  22. Resources • OWASP – Open Web Application Security Project • http://www.owasp.org/ • OpenSAMM - Software Assurance Maturity Model • http://www.opensamm.org/ • Denim Group – Remediation Resource Center • http://www.denimgroup.com/remediation/ TASSCC 2011 Annual Conference

  23. Questions? TASSCC 2011 Annual Conference