Upload File

start with security - austin.pptx [read-only] · building a security culture security as core value...

  • Home
  • Documents
  • Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
41
#StartwithSecurity

Upload: others

Post on 20-Jun-2020

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

#StartwithSecurity

Page 2: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

WelcomeBobby Chesney

Director, Robert Strauss Center for International Security and Law, University of Texas

Page 3: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Introductory RemarksDama Brown

Regional Director, Federal Trade Commission

Page 4: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Opening RemarksTerrell McSweeny

Commissioner, Federal Trade Commission

Page 5: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Panel 1: Starting up Security Building a Security Culture

Page 6: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

FeaturingChristophe Borg, VP Engineering Operations, RetailMeNotAlan Daines, Chief Information Security Officer, DellJosh Sokol, Information Security Owner, National Instruments

Moderator: Laura Riposo VanDruff, Division of Privacy and Identity Protection, FTC

Page 7: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Building a Security CultureSecurity as Core Value– Founders, executives, and employeesBuilding Security Expertise– Engineers with interest can become security championsLeveraging the Security Community– OWASP, BSides, (ISC)2, ISSA, SANS, and other free and proprietary resources

ntegrating Threat Modeling– Consider potential threats early

Page 8: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Common Vulnerabilities1. Injection2. Broken Authentication and 

Session Management3. Cross‐Site Scripting4. Insecure Direct Object 

References5. Security Misconfiguration6. Sensitive Data Exposure7. Missing Function Level Access 

Control8. Cross‐Site Request Forgery9. Using Components with Known 

Vulnerabilities10. Unvalidated Redirects and 

Forwards

Page 9: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Cross‐Site Scripting (XSS)

High‐risk, easy to exploit vulnerability– Present in 7 out of 10 web applications– Vulnerability not affected by language choice– Attacker can run JavaScript in victim’s browser

Consequences for company, consumers– Risks consumers’ personal information through malware, adware, spyware

– Reputation and other harms to company

Page 10: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Training to Prevent XSS

Look for places where user input is displayed back on a web pagePass in html tags to see if you can inject special charactersConsult OWASP XSS Prevention Cheat Sheet and other resources

Page 11: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Building a Security CultureSecurity as Core Value– Founders, executives, and employeesBuilding Security Expertise– Engineers with interest can become security championsLeveraging the Security Community– OWASP, BSides, (ISC)2, ISSA, SANS, and other free and proprietary resources

Integrating Threat Modeling– Consider potential threats earlyUsing Secure Frameworks– Don’t reinvent the wheel

Page 12: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

#StartwithSecurity

Page 13: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Panel 2: Scaling SecurityAdapting Security Testing for DevOps 

and Hyper‐growth

Page 14: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

FeaturingMatt Johansen, Directory of Security, Honest DollarMatt Tesauro, Senior Software Security Engineer, PearsonJames Wickett, Engineer of Awesome, Signal Sciences Corp.

Moderator: Laura Berger, Division of Privacy and Identity Protection, FTC

Page 15: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Vulnerabilities are Everywhere

Page 16: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

They get fixed slowly…

Page 17: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

…if at all

Page 18: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Scaling Security: a Rugged DevOps AppSec Pipeline Template

Page 19: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Integrating into the DevOps Pipeline

DevOps Pipeline AppSec Pipeline

Page 20: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Gauntlt Example

Page 21: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

#StartwithSecurity

Page 22: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Investing in Security:Fireside Chat with LiveOak Venture Partners 

Co‐founder Venu Shamapant

Moderated by Commissioner Terrell McSweeny

Page 23: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Panel 3: Third‐party AppSecDealing with Bugs, Bug Reports, and 

Third‐party Code

Page 24: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

FeaturingHD Moore, Chief Research Officer, Rapid 7Katie Moussouris, Chief Policy Officer, HackerOneWendy Nather, Research Director, Retail Cyber Intelligence Sharing Center

Moderator: Jarad Brown, Division of Privacy and Identity Protection, FTC

Page 25: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Managing Third‐party Software Security

More information– Third Party Software Security Working Group, Appropriate Software Security Control Types for Third Party Service and Product Providers, http://docs.ismgcorp.com/files/external/WP_FSISAC_Third_Party_Software_Security_Working_Group.pdf

Page 26: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Managing Service Provider and Vendor Security

Evaluating Vendors– Standard Information Gathering Questionnaire, https://sharedassessments.org/

– Cloud Security Alliance Consensus Assessments Working Group Questionnaire, https://cloudsecurityalliance.org/group/consensus‐assessments/

– OWASP Secure Software Contract Annex, https://www.owasp.org/index.php/OWASP_Secure_Software_Contract_Annex

Page 27: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Managing Vulnerability Reports

Roll out the red carpet– [email protected] – [email protected]– company.com/security

Process to Verify ReportsProcess to Address Reports

Page 28: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Identify Bug Internally

Inform Bug Reporter

Receive Bug Report

Develop Bug Disclosure Policy & Capability to Receive Bug Reports

Develop Bug Handling Policy & Organizational 

Framework

Acknowledge Receipt Verify Bug

No

Bug Verified?

Develop Security Update

Yes

Release Security Update

Improve SDLC

Disclosure

Response

Adapted from Katie Moussouris, RSA 2013 presentation 'Application Security Response: When Hackers Come A‐Knockin’http://www.rsaconference.com/events/us13/agenda/sessions/122/application‐security‐response‐when‐hackers‐come‐a

Page 29: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
Page 30: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
Page 31: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
Page 32: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
Page 33: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
Page 34: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
Page 35: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

#StartwithSecurity

Page 36: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Panel 4: Beyond BugsEmbracing Security Features

Page 37: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Featuring

Robert Hansen, VP of White Hat Labs, White Hat SecurityClare Nelson, CEO, ClearMark ConsultingCaleb Queern, Manager, KPMG Cyber

Moderator: Katherine McCarron, Division of Privacy and Identity Protection, FTC 

Page 38: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
Page 39: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Subscribe to the FTC Business Blog business.ftc.gov/blog

Page 40: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers
Page 41: Start with security - Austin.pptx [Read-Only] · Building a Security Culture Security as Core Value – Founders, executives, and employees Building Security Expertise – Engineers

Building Reference Security Architecturearchive.opengroup.org/public/member/proceedings/q...Building Reference Security Architecture Bob Steadman, Sr. Director Predrag Zivic, Sr. Security

Building Automation (In)Security

BellaVita Business Building System – Founders Edition

Entrepreneurship Workshop - Co-founders and Team Building

Building a database security program

Building a Foundation and Your Future - Global Genes · measuring the success of your foundation against the success of other founders. Experienced founders advise that, regardless

Building an API Security Ecosystem

Building a Tech Team for Non-Techie Founders

Building, Security & Architecture Supplement

Founders Society The Founders Society recognizes the

Building & Measuring Security in Web Applications - … Presentations...Building & Measuring Security in Web Applications ... ACEGI Commons Validator ... Perform Application Security

Building a Security Architecture

Innovative Solutions for Building Safety & Security - te.com · Innovative Solutions for Building Safety & Security ... TE Connectivity Innovative Solutions for Building Safety &

MILITARY JUSTICE,MILITARY JUSTICE, SECURITY SECTOR …€¦ · MILITARY JUSTICE,MILITARY JUSTICE, SECURITY SECTOR REFORM & STATE BUILDING& STATE BUILDING KCIS SECURITY & GOVERNANCE:

A Developmental Approach to Building Sustainable Security ...€¦ · rity cooperation, security sector reform, building partner capacity, and defense institution– building (DIB),

Building Assets, Building Financial Security

Building an OpenStack Security Group.pdf

Designing and Building Security Operations Centercdn.ttgtmedia.com/rms/security/Designing-and-Building-Security... · Operation center infrastructure ... security infrastructure;

Building Security Operation Center

Founders Drinks Sept: Building a global A-Team with freelancers

FIRST E FOUNDERS’ DAYfirstexistentialist.org/sites/default/...Years_new.pdf · ebration of Life - in our own building - the first Sun-day in May, 1980. We celebrated our first Founders’

Building Safety and Security

Building: Knowledge, Security, Confidence

Practical Security Recommendations for building OPC … · Practical Security Recommendations for building OPC UA Applications ... document “Practical Security Recommendations for

FOUNDERS’ HALL - ITA | Event Venues London, Christmas ... · Great Fire of London, Founders’ Hall is a remarkable building that boasts striking style and flair. The street in

BUILDING SAFETY & SECURITY

Building Cloud Security from Scratch

Building better product security

WE ARE more than a building - Home - Cristo Rey St. … › wp-content › uploads › ...Dear Founders: Thank you for celebrating Cristo Rey St. Martin’s virtual 2020 Founders’

Building Security Requirements

Female Founders Monitor Female Founders Monitor

Building a security strategy

Homeland Security Perspectives for Building Cyber Security ... · Homeland Security Perspectives for Building Cyber Security Capacity, Capability, & Resilience Franco Cappa, CISSP

Building a Mobile Security Model

IR BASED BUILDING SECURITY SYSTEM