Moving from “Bolt-on” to “Build-in” Security Controls Secure SDLC Moving from “Bolt-on” to “Build-in” Security Controls Nitin Kotwal CEO @ Hack2Secure

Easiest Path for Attackers “Insecure Software” Easiest Path for Attackers

Heartland Payment System (HPS) Case Study … Heartland Payment System (HPS) Data Security Breach Quick Fact “Malware” was Injected [SQLi] on Bank’s Website Bypasses Network Security Controls It moves towards (PCI compliant) Payment Network Internally placed Processing Server Steal Account Details for 4 months Active & Passive Loss Stocks dips by 78% Lost 5,000 merchants Delisted by Visa & MasterCard

Heartland Payment System (HPS) Case Study … Heartland Payment System (HPS) Data Security Breach Lessons “Insecure Application” as Easy Entry Point ‘Ensuring’ Compliances vs ‘Effective’ Implementation INTRANET Security

“Insecure Design” Easy Attack Surface

Facebook Incorrectly Implemented ‘Download Your Information’ Toolbox Case Study .. Facebook Incorrectly Implemented ‘Download Your Information’ Toolbox Impact User Privacy Leak Undetected for a Year Public Apology Privacy Lawsuits

Facebook Incorrectly Implemented ‘Download Your Information’ Toolbox Case Study .. Facebook Incorrectly Implemented ‘Download Your Information’ Toolbox Lessons Secure Feature Design Security in “Requirement Gathering” Compliance & Standard alignment “Security Feature” vs “Secure Implementation”

Lack of Awareness & Skills Partially Integrated Practices Software Security .. Current Challenges Lack of Awareness & Skills Partially Integrated Practices In-adequate Resources [Documentation, Process, Practices] One Plan Won’t Fit All

So, What can be done.. To Optimize Software Security Needs Ensure in-built Security Attack Resiliency

Integrate Security Controls Across SDLC Phases Security Awareness Security Requirements Secure by Design Secure Implementation Security Testing Security Review & Response Secure Deployment Security Maintenance Secure SDLC

Early Identification & Mitigation of Security Vulnerabilities Secure SDLC .. Benefits Early Identification & Mitigation of Security Vulnerabilities Reduced Security Control Implementation Cost

Secure SDLC .. Benefits “Earlier you Detect, Lesser be Cost of Fixing it” “Relative” Cost of Addressing Security Defect at different SDLC Stages

Informed Security Decision making Secure SDLC .. Benefits Informed Security Decision making Comprehensive Risk Management Awareness of Potential Engineering Challenges

Security Strategies across Development Models Secure SDLC .. Benefits Water Fall Model V Model Incremental Model RAD Model Agile Model Iterative Model Spiral Model Security Strategies across Development Models

Easy Compliance Adoption Secure SDLC .. Benefits Easy Compliance Adoption

Security “Awareness” “There is only one way to keep your product plans safe and that is by having a Trained, Aware and a Conscientious workforce” Kevin Mitnick ‘The Art of Deception’

Define Security ‘Requirements’ Without System Requirements, System will Fail. Without Secure System Requirement, Organizations will. Security Compliance & Standard Needs Security Checklist & Gates Measurable Risk Definition Assurance Methodologies

Attack Surface Analysis Threat Modeling Building Secure “Design” Treat Security as an Integral part of Overall System Design NIST SP 800-27: “Engineering Principles for Information Technology Security” Define Design Measure Attack Surface Analysis Threat Modeling Threats are NOT Vulnerabilities. Threats Live Forever, They are Attackers Goal 

Safeguards and Countermeasures Secure “Implementation” Secure Coding Practices   Code (Security) Review Safeguards and Countermeasures

“Security Testing” is different from “Functional Security Testing” Grey Box Assessment   Risk based Analysis Security Test Plan Best Practices Security Requirements Identified Threats Implemented Safeguards

Audit & Compliance Review Deployment & Procurement Risk Security “Review” & “Response” Final Security Review Audit & Compliance Review Deployment & Procurement Risk Vulnerability Assessment Penetration Testing Incident Handling

Security in “Maintenance” Phase Patch Management 3rd Party Libraries Disposal Policy

Awareness Explore Customize Align Skills according to Role Secure SDLC as a Process .. How to Integrate Awareness Skills according to Role Explore Framework, Practices and Resources Customize Adopt and Integrate Controls Align Standards & Case Studies

Case Study … CISCO adoption of Secure SDLC Aligned with ISO 27034 guidelines Adapted for Agile and Waterfall models Enable Global Sale Ref: http://www.cisco.com/c/en/us/about/security-center/security-programs/secure-development-lifecycle.html

Case Study … MICROSOFT and VMware adoption Ref: https://www.microsoft.com/en-us/sdl/ Ref: https://www.vmware.com/security/sdl.html

E: info@hack2secure.com Thank You www.hack2secure.com E: info@hack2secure.com