SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Building an Effective SDLC Program: Case Study

hume avatar
hume
15 diapositives · 389 Views · Jul 30, 2014

Building an Effective SDLC Program: Case Study. Guy Bejerano, CSO, LivePerson Ofer Maor, CTO, Seeker Security. The Next 45 Min. SDLC – Why Do We Bother? Vendor Heaven – Sell All You Can Sell Finding Your Path in The Jungle - Assembling The Puzzle to Build a Robust SDLC Program.

#building an effective sdlc program: case study #building an effective sdlc program: case study ppt #powerpoint #presentation
Building an Effective SDLC Program: Case Study - slide 1
01 / 15Building an Effective SDLC Program: Case Study
1 / 17

Télécharger la présentation

Building an Effective SDLC Program: Case Study
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Building an Effective SDLC Program: Case Study • Guy Bejerano, CSO, LivePerson • Ofer Maor, CTO, Seeker Security

  2. The Next 45 Min SDLC – Why Do We Bother? Vendor Heaven – Sell All You Can Sell Finding Your Path in The Jungle - Assembling The Puzzle to Build a Robust SDLC Program Data & Insights based on our experience @ LivePerson

  3. Seeker Security Identify, Demonstrate & Mitigate Critical Application Business Risk Formerly Hacktics® (Acquired by EY) New Generation of Application Security Testing (IAST) Recognized as Top 10 Most Innovative Companies at RSA® 2010. Recognized as “Cool Vendor” by Gartner

  4. LivePerson SAAS in a full Multi-tenancy environment Monitor web visitor’s behavior(Over 1.2 B visits each month) Deploying code on customers’ websites Providing Engagement platform(Over 10 M chats each month) Process and Store customers’ data on our systems

  5. Providing Service to Some of the Biggest

  6. Cloud Motivation for Building Secure Code Risk Characteristics • Cyber Crime – Financial motivation • Systems are more accessible and Perimeter protection is not enough Reputation in a social era Legal liability and cost of non-compliance Customers (over 15 application pen-tests in the past year)

  7. The Impact of Security Bugs in Production Highly expensive to fix (4X than during the dev process) Creates friction – Externally and Internally We are not focusing on the upside

  8. Back in the Waterfall Days 3rd party Pen-Testing Customer Testing Bug Fixing Design Development QA Rollout Challenges • Accuracy of Testing • Same Findings Repeating • Internal Friction Still Exists SecurityRequirements

  9. And Then We Moved to Agile 3rd party Pen-Testing Customer Testing In Production Sprint Plan Sprint & Regression Rollout Challenges • Shorter Cycle (Design, Bug Fixing) • Greater Friction SecurityRequirements

  10. The Solution Matrix Vendor Heaven Infinite Services, Products, Solutions & Combinations In House / Outsourced Services / Product / SaaS Manual / Automated Blackbox / Whitebox Penetration Test / Code Review DAST / SAST / IAST

  11. The Solution Matrix - Considerations • Service/Product/SaaS (Manual/Automated) In-House/ Outsourced Skills Accuracy Availability False Positives Cost Ease of Use False Negatives Repeatability Skills/Quality Repeatability SDLC Integration SDLC Integration Coverage Intellectual Property DAST/SAST/IAST (PT/CR, Black/White Box) Accuracy False Positives False Negatives Quality of Results Pinpointing Code Validation Data Handling Ease of Operation 3rd Party Code Scale

  12. How to Assemble All the Pieces? Define Your Playground Risk – Web, Data, Multi-Tenancy Customers – SLA, Standards Choose a Framework Highly Technical Organization (System Owners, Scrum Masters, Tech Leaders) Who Leads This Program Hands-On… QA FirstOn-going sessions Knowledge – Who & How

  13. How to Assemble All the Pieces? 3rd PartyBlackboxPre-defined flows to check Pen-Test Strategy Java – Multi-TierAgile Methodology JIRA (For bug tracking) Fitting Tools to Platform and Development Process Define Operational cycle Key Performance Indicators Operational Review (by system owners)

  14. SDLC Take #2 SecurityDesign Static Code Analysis Runtime/Dynamic Code Analysis 3rd party Pen-Testing Customer Testing In Production Sprint Plan Sprint & Regression Rollout Budgeted “Certification” Program R&D / QA Ownership (Tech Leaders & System Owners) Knowledge (Hands-On Training + On-Going Sessions) Embedded Bug Tracking in Dev Tools

  15. Thank You! Q&A