Battle Tested Application Security
- 1. Battle Tested Application Security Ty Sbano October 17, 2018
- 2. Bio Ty Sbano Currently the head of security at Periscope Data. Ty is an Information Security leader with over 12 years of experience, mainly in Financial Technology organizations. Ty's career has been focused on developing application and product security programs for Capital One, JPMorgan Chase, LendingClub, and Target. Key areas of knowledge include developing security champions, threat modeling, secure code training, static code analysis, component analysis, dynamic analysis, penetration testing, and red teaming. Ty’s security mentality has been concentrated on enabling engineering and product teams to securely move at the speed of the business to make it a competitive advantage. Ty graduated from Penn State University with a B.S. in Information Science & Technology and from Norwich University with a M.S. in Information Assurance. Ty also holds the CISSP, SSCP, CEH and CCSK.
- 3. The views and opinions expressed in this discussion are those of the authors and do not necessarily reflect the official policy or position of any company.
- 4. How do we build An Application Security Program? Step 1 – Learn your internal tech culture Step 2 – Ignore all the vendors (for now) Step 3 – Roll up your sleeves and get to work
- 5. • Development • Operations • Security • Architecture General Approach to Application Security 01 • Requirements • Goals • Measurements 02 • Retrospectives • Post Mortems • Rinse & Repeat 04 Culture 101 Criteria for Success Kaizen to Enhance • Role Centric • End Users • Developers • Security • Audit • Regulators • Executives 03 Educate for Scale Set the tone of the program by establishing a mission statement
- 6. Software Development Lifecycle (SDLC) Product Development Lifecycle (PDLC) Waterfall • Established Cadence/Gates • Required Risk Remediation • Executive Dashboards Agile • Constant Releases • Risk Management, Acceptable Tolerance • Real-Time, API Friendly Data Automation and Self- Service Capabilities Will Enable Security At The Speed of Business
- 7. Engineering Team Composition? In-Sourced • Education and Training • Self-Service • Assessments, Consulting and Support Out-Sourced • Contract Requirements • Vendor Due Diligence • Attestation and Consulting • Standards Commercial Off The Shelf (COTS) • Contract Requirements • Customer Advisory Board aka Influence the feature prioritization / backlog
- 8. Where’s the silver bullet solution? Be Tool Agnostic, Problem Specific Source: Forrester Wave for SAST, 2017
- 9. Security Staffing Strategy Insourced • Talent Acquisition / Sourcing • Talent Management • Rewarding Hybrid Approach • Staff Augmentation • Cross Training • Work/Life Balance Do Outsource Consistent, Repeatable Processes Do Not Outsource Something You Don’t Understand Outsourced • Scales Quickly • Cost Opportunities • Externalized Accountability
- 10. Funding the Program? Project Based (Product) • Incremental • Time Consuming • Cost Avoidance Internally Funded (Security Budget) • Annual • Responsibility on AppSec • Forecasting and Variance Challenges Business Owner (Non-IT) • Annual • Tracking Challenges • Cost Avoidance, e.g. Security Avoidance Remove Budget From The Equation, Your Engineering Teams will be more Engaged
- 11. Areas of Focus with High Return On Investment 25% Training & Education 30% Embrace Open Source 45% Asset Management It’s Less About Financial Investment, More About Engagement • Real-Time Coaching • Champion Programs • Brand and Be Bold • SneakerNet • Scanning Technology • OWASP??? • Understand the Business • Inventory • Business Oriented Risk Ranking • Defect Tracking
- 12. Forward Looking Lessons Hygiene over HYPE • Inventory, Asset Management, Security Basics over “Silver Bullets” Dialogue over Confidentiality • Engage your team, don’t always say everything is confidential – let people help Carrot beats Stick • Recognition always trumps reprimands, plus swag helps Always Be Learning • Take the opportunity of the rapid development world to learn something new everyday
- 13. Contact Linkedin - https://www.linkedin.com/in/tysbano/ Articles - https://techbeacon.com/contributors/ty-sbano Website - http://www.tysbano.com Twitter - @tysbano Instagram - https://www.instagram.com/takoyakity/ *Nothing to do with security https://www.periscopedata.com/careers Come work with me!
- 16. Meet me in the Slack channel for Q&A bit.ly/addo-slack