Transforming Risk

Scenario

Well Funded Startup

60 Developers

Daily Releases

#SquadGoals

10 Product Squads

(Generalist role)

2 Platform Squads

(Specialist Role)

Fields of Green

Brand new super cool blockchain project

Releases to Production in 2 weeks

Lydia Smith - Lead Dev punk-IPA squad

6 Years Java experience - 2 years security champion

Day 1 - Catalogue

Project Name: crypto-sling

Service Name: app-backend

Service Type: backend-spring

Deployment Type: docker

Team Name: punk-IPA

Security Champion: lydia-smith

Day 1 - Catalogue

Build Pipeline to Prod
Git & Artifact Repos
Static Analysis
Dependency Checking
Project Archetype
Docker File
Terraform Project
Threadfix Application
JIRA Integration

Generate!

Day 3 - Build In the Risk

Whiteboard designs complete
Rough backlog established
STRIDE analysis defines security controls
Create stories for controls and link to product stories

Day 6 - Push to Prod

Day 6 - Push To Prod

ThreadFix

JIRA Release gate

Aggregates all scanning results
Agreed Policy For Pass / Fail (CVSS / CWE)
Champion Can Suppress issues
Platform Sec Available for expertise

Scans code comments for user story numbers
Calls JIRA API
Fails if any linked security controls are open
Product Owner can attach timed Risk with risk owner
Creates Confluence Doc for Successful Release

Workflow

US104 - Save User Registration In Database

SEC285 - Securely Obtain DB Secrets Using Vault

SEC286 - Ensure Public Endpoint Is Rate Limited

Workflow

US104 - Save User Registration In Database

Platform Squad have created client library and custom Vault documentation

User story must be reviewed by Platform Security Squad to be closed

Workflow

SEC286 - Ensure Public Endpoint Is Rate Limited

Team consider this less of a risk
Product Owner works with Risk assessor and Raises Risk Acceptance JIRA ticket for 2 months
Champion or Platform Security feed into risk assessment
Valid risk ticket allows release gate to pass

JIRA Risks

Could be created from many sources:

Pen Test
Vulnerable Dependency
STRIDE Analysis
Deprecated Runtimes

Can All be Enforced! Some linked to stories and some global risks

Result

Team Responsibility for Finding and Fixing security Issues and designing securely
Product Owner accepts Risks which when expire block builds
Virtual Team of Champions extremely useful for incident response, training other team mates etc.
All Risks timed, kept alive and in JIRA for reporting
Pre-agreed security policy, no surprises

Practicalities

Can be achieved without automation
Absolutely key is security champion in team and technical security expertise available quickly
Something or Somebody has to enforce process - Not the technical security person chasing!
Requires co-location or Slack for effective collaboration between teams