1. Implementation Lessons Learned Application Security Summit 2007
SANS
August 15, 2007

2. Too Many Experts, Not Enough Coders
Three Things
No Silver Bullet
Too Many Experts, Not Enough Coders
Grassroots Works If…(no wait)…It Doesn’t

3. X No Single Solution Tools + Experts No Silver Bullet Dynamic Tool
Directory
Browsing
Insecure
Function
Secure
Design
Dynamic Tool X
Static Tool
Expert Testing
No Single Solution
To borrow from Fred Brooks’ concept – the complexity of application security is similar to that of software engineering because it possesses certain elements of essential complexity
There are problems that can’t be solved with “simple solutions” because they don’t address all problems adequately.
A lot of people go out into the market and look for a tool or a vendor that will solve their application security problem – this is the wrong approach, unfortunately, it’s not that easy.

4. Use Experts Use Tools Experts == $Expensive Smart & Accurate
No Silver Bullet
Use Experts
Experts == $Expensive
Smart & Accurate
Use Tools
Tools == Spell Checkers
Fast & Cheap
Use Multiple Tools
What can tools do for you? LHF.
Make you a better speller NOT a better writer.
Tools will help you catch the basic security issues, they aren’t intelligent enough to catch anything beyond that.
It requires manual review to identify issues in design and business logic.

5. Overtraining Developers
Too Many Experts
Overtraining Developers
The problem of improperly applying resources.

6. You can’t architect SQL injection out of your code.
Not Enough Coders
You can’t architect SQL injection out of your code.
You can’t code directory browsing out of your server.
You can’t configure a bad password out of your server.
Use the right people with the right tools at the right time.

7. Grassroots Doesn’t Work
You need money, you need time, and you need resources.
Find a Compelling Reason
Assessments (shock & awe)
Incident
Compliance
Find a Sponsor
Executive Support
Developers won’t give you any of these.
Don’t waste your time.

8. Grassroots Works If…(no wait)…It Doesn’t
Three Things
No Silver Bullet
It takes Tools and Experts
Too Many Experts, Not Enough Coders
Use a Balanced Approach
Grassroots Works If…(no wait)…It Doesn’t
Get Executive Support

9. Q & A
Thank you for your time.
Questions?

10. Additional Slide
These are not the slides you a looking for…