Ten Practical Steps to Reducing Software-based Threats

1. Ten Practical Steps to Reducing Software-based Threats Dr Serdar Cabuk, CISSP Security Specialist, VISA Europe (ISC)2 SecureLondon 2009, London, United Kingdom This information is not intended, and should not be construed, as an offer to sell, or as a solicitation of an offer to purchase, any securities

2. Outline Motivation and scope Methodology Plan (2) Do (5) Check (2) Act (1) The way forward

3. Motivation Fact You have an SDLC in place Reality You don’t have a secure SDLC Strategic v Tactical Drivers Budget Time to market Top down v Bottom up

4. Scope What it isn’t Strategic Certified / Methodical Framework based Long term What it is Tactical Customised / Hands on Process based Short term

5. Methodology PMM SALC SDLC SDLC+

6. PLAN : Preparation Goal : Ensure readiness and support prior to process improvement Prerequisites Security policy Management buy in

7. PLAN : Preparation Segregate software assurance and development functions Assurance Development

8. PLAN : Preparation Engage with all functions including Information security Compliance specialists and security architects Architecture Solutions or technical architects Development Analysts and lead developers Engineering Infrastructure and network specialists Service owner and key stakeholders Project and programme management

9. DO : Transition Goal : Improve software development by introducing targeted additions to the lifecycle Prerequisites Buy in from all teams involved

10. DO : Transition Perform initial threat assessment to drive the high level design Input Requirements OutputImproved high level design

11. DO : Transition Perform application threat modelling to identify software-based threats Input Requirements and initial design Output Application threat model

12. DO : Transition Perform secure design reviews to ensure secure software architecture Input High level design and application threat model Output Application level design

13. DO : Transition Perform source code analysis (SCA) to identify and address code level vulnerabilities Input Application software and SCA tool Output Improved application software

14. DO : Transition Employ secure coding principles to reduce software based threats and improve code quality Input Coding standards Output Improved application software

15. CHECK : Embedding Goal : Ensure process implementation and establish security standard Prerequisites Documented process and templates

16. CHECK : Embedding Ensure process embedding through SDLC workshops and documentation Establish security standards and raise awareness through security events and training

17. ACT : Alignment Goal : Continuous capability maturity improvement using an industry standard framework Introduce an industry standard ISMS framework and align it with the secure SDLC

18. Summary Segregate software assurance and development functions Engage with all functions including information security, architecture, development, engineering and project management Perform initial threat assessment to drive the high level design Perform application threat modelling to identify software-based threats Perform secure design reviews to ensure secure software architecture

19. Summary Perform source code analysis (SCA) to identify and address code level vulnerabilities Employ secure coding principles to reduce software based threats and improve code quality Ensure process embedding through SDLC workshops and documentation Establish security standards and raise awareness through security events and training Introduce an industry standard process framework and align it with the secure SDLC

20. Thank you (ISC)2 SecureLondon 2009, London, United Kingdom This information is not intended, and should not be construed, as an offer to sell, or as a solicitation of an offer to purchase, any securities