Agile Software Security
Download as PPT, PDF1 like984 views
The document discusses security assurance in agile software development, highlighting the importance of aligning security practices with user stories and addressing the risks associated with 'evil user stories.' It emphasizes the need for integrating security measures throughout the software development lifecycle, including code analysis, threat modeling, and penetration testing. The guide advocates for a balanced approach, suggesting that security should be developed organically and collaboratively within agile teams.
Agile Software Security
- 1. Agile Software Security Olli Ahonen
- 2. Outline Security assurance Misaligned Aligned Evil user stories Microsoft
- 3. Outline Security assurance Misaligned Aligned Evil user stories Microsoft
- 4. Security assurance Design principles Static code analysis External reviews Penetration testing ...
- 5. “ Good old heavyweight assurance processes” K. Beznosov and P. Kruchten
- 6. Outline Security assurance Misaligned Aligned Evil user stories Microsoft
- 7. Root causes
- 8. Working software over comprehensive documentation
- 10. Deliver working software frequently
- 11. Deliver working software frequently Collective ownership of code
- 12. Deliver working software frequently Collective ownership of code Back to square one + =
- 13. 3rd party Independence Objectivity Credibility
- 14. Misaligned External reviews Analysis and validation Test depth analysis Manual security testing
- 15. Root causes
- 16. Outline Security assurance Misaligned Aligned Evil user stories Microsoft
- 17. Natural match Internal reviews Build security in
- 18. Works anyway Architecture and design principles High-level languages & run-time environments Change tracking
- 19. Automatic Static code analysis Unit testing System testing
- 20. Outline Security assurance Misaligned Aligned Evil user stories Microsoft
- 21. Evil user stories From user stories “ How can this functionality be misused?” Build security in As an employee, I can search for other employees by their last name As an employee, I can alter the database by inserting an SQL search string
- 22. Disconnected stories “ User adds “&debug=true” to URL on any page, and receives debug information that discloses system configuration details.”
- 23. Missing stories Incomplete Inexpressible
- 24. Outline Security assurance Misaligned Aligned Evil user stories Microsoft
- 25. Security Development Lifecycle Attack surface analysis Threat modeling Cryptography review Response plan ...
- 26. SDL/ Agile
- 27. SDL/ Agile
- 28. SDL/ Agile
- 29. SDL/ Agile
- 30. Summary Don’t force it Nourish synergy Aim for secure enough