Security in agile teams
2 likes244 views
The document discusses the importance of security in agile teams, highlighting methods to improve security practices through better planning and testing. It emphasizes the need for a thorough understanding of current systems, threat landscapes, and essential security tools like password managers and static analysis tools. Additionally, it outlines the process for integrating security requirements and acceptance criteria in development and quality assurance phases.
Security in agile teams
- 1. D o u b l e - c l i c k t o e d i t SECURITY IN AGILE TEAMS Maria Gomez @mariascandella Barcelona June 2017
- 4. With great power comes great responsibility “ — uncle Ben https://flic.kr/p/5UDwbm
- 6. We could do better
- 8. BENEFITS • Higher confidence • Evolutionary model • Better testing and planning • Faster reaction to making improvements or fixes
- 10. INCEPTION
- 11. WHAT’S THE CURRENT STATE? • List of existing systems/applications as well as their users. • Review of past incidents/attacks • Review of existing security policies and how they will impact the scope of the project
- 12. WHAT WILL BE BUILT?
- 13. WHAT IS THE CURRENT THREAT LANDSCAPE? https://www.owasp.org/index.php/Application_Threat_Modeling
- 14. DELIVERY
- 15. SECURITY CHECKLIST • Secret Management tool for the team • Password Manager • Keep secrets out of source control • Dependency checker for the CI/CD pipeline • Static analysis tools Cade Cairns - Security Playbook (https://github.com/cairnsc/security-playbook)
- 16. READY FOR DEV • Identify security requirements • Introduce acceptance criteria Given an unauthenticated user enters the system When she tries to view her profile Then she is redirected to the login page #0
- 17. IN DEV
- 18. IN QA The system meets the acceptance criteria CFRs have been taken into account and implemented as part of the story, if necessary Established code conventions have been met Check against attack trees
- 19. IN PROD Incident Report Plan
- 20. CONTINUOUS IMPROVEMENT Given an unauthenticated user enters the system When she tries to view her profile Then she is redirected to the login page #