1. UISGCON11 December 4 th 2015 Svavar Ingi Hermannsson CISSP, CISA, CISM THE JOURNEY TO A SECURE SOFTWARE DEVELOPMENT LIFE CYCLE

2.  $whoami  Useful Standards  Building blocks  Adding more security OVERVIEW

3. Svavar has been specializing in IT security and software development for the last 18 years and has held various roles in programming and IT Security consulting with vast experience in penetration testing, vulnerability assessment, code auditing, information security management - including ISO/IEC 27001, PCIDSS and PADSS. These roles include a manager position at KPMG, as well as a CISO position at DH samskipti. Svavar has taught classes on computer security at the University of Iceland and the University of Reykjavik. Svavar was the chairman of the information security focus group at the Icelandic Computer Society from 2007-2012. He has given talks at multiple events in Iceland, the UK, Germany and the US, including OWASP, BSides and Hacker Halted Europe. Svavar holds various certifications, including CISSP, CISA and CISM. WHO AM I?

4. Why do we standardize? USEFUL STANDARDS

5. Security Policy, Access Control, Backups, BCP (more) ISO/IEC 27034 Information technology -- Security techniques -- Application security

6. USEFUL STANDARDS OpenSAMM (Softare Assurance Maturity Model – curtesy of OWASP)

7. How to build a strong foundation? BUILDING BLOCKS

8.  Expected implementation time for an SME  2 – 3 years BUILDING BLOCKS

9.  Decide on a software development methodology  Agile / SCRUM?  Formalize  Digitize  Source Control System  Pick one  Decide how to use it  Branching?  Release Versioning  Connect the two BUILDING BLOCKS

10.  Separate Development / Testing / Production  Separation of duties BUILDING BLOCKS

11.  Adding security to the SDLC  Start differentiating between bugs and security bugs.  Secure coding training  Secure coding Practices  Add a design + design review part (assistant from Security Architects)  Add Threat modeling (STRIDE)  Code auditing with focus on IT security  Security testing prior to release ADDING MORE SECURITY

12.  CISO  Security notifications  Security portal / vulnerability management  Incident response  Bug bounties ADDING MORE SECURITY

13.  Any Questions? svavar@security.is THANK YOU! http://www.xkcd.com/