building better product security

Building better product securityan engineering approach

Who we are

Client was hacked

Security Assessment of completed product…

…is not good enough sometimes either

Secure Development Lifecycle

Engineer becomes a part of team

How security process looks in reality

Than start process of re-Coding, re-Building, re-Testing, re-Auditing

3rd party or internal audit

Tone of security defects

BACK to re-Coding, re-Building, re-Testing, re-Auditing

Generic Approach for Security

Design Build Test Production

security requirements / risk and threat analysis

coding guidelines /code reviews/ static

analysis

security testing / dynamic analysis

vulnerability scanning / WAF

Reactive ApproachProactive Approach

Secure SDLC

Defining security requirements for a project

Developing coding guidelines and static code analysis

Security testing

Vulnerabilty testing

Common SDLC fails

CODE

It is not a vulnerability, it is a feature

Installling application after SDLC on vulnerable environment

SDLC makes everyone happy

Such approach eventually may save one’s business

Questions?

Thanks!

http://owasp-lviv.blogspot.com