Agile sdlc-v1.1-owasp-app sec-usa

21
From the Trenches: Real- World Agile SDLC Chris Eng & Ryan O’Boyle OWASP AppSec USA November 20, 2013

Transcript of Agile sdlc-v1.1-owasp-app sec-usa

Page 1: Agile sdlc-v1.1-owasp-app sec-usa

From the Trenches:

Real-World Agile SDLC

Chris Eng & Ryan O’BoyleOWASP AppSec USANovember 20, 2013

Page 2: Agile sdlc-v1.1-owasp-app sec-usa

Ryan O’Boyle@523

Chris Eng@chriseng

Page 3: Agile sdlc-v1.1-owasp-app sec-usa
Page 4: Agile sdlc-v1.1-owasp-app sec-usa
Page 5: Agile sdlc-v1.1-owasp-app sec-usa
Page 6: Agile sdlc-v1.1-owasp-app sec-usa
Page 7: Agile sdlc-v1.1-owasp-app sec-usa
Page 8: Agile sdlc-v1.1-owasp-app sec-usa
Page 9: Agile sdlc-v1.1-owasp-app sec-usa
Page 10: Agile sdlc-v1.1-owasp-app sec-usa
Page 11: Agile sdlc-v1.1-owasp-app sec-usa
Page 12: Agile sdlc-v1.1-owasp-app sec-usa
Page 13: Agile sdlc-v1.1-owasp-app sec-usa
Page 14: Agile sdlc-v1.1-owasp-app sec-usa
Page 15: Agile sdlc-v1.1-owasp-app sec-usa
Page 16: Agile sdlc-v1.1-owasp-app sec-usa
Page 17: Agile sdlc-v1.1-owasp-app sec-usa
Page 18: Agile sdlc-v1.1-owasp-app sec-usa
Page 19: Agile sdlc-v1.1-owasp-app sec-usa
Page 20: Agile sdlc-v1.1-owasp-app sec-usa
Page 21: Agile sdlc-v1.1-owasp-app sec-usa

Secure SDLC: The Good, The Bad, and The Ugly - OWASP• Working Smarter, Not Harder 6 7 • Insufficient Support from Management • Reactive Security Posture • Check-in-the-box

Secure SDLC: The Good, The Bad, and The Ugly - OWASP• Working Smarter, Not Harder 6 7 • Insufficient Support from Management • Reactive Security Posture • Check-in-the-box

OWASP CODE REVIEW GUIDE€¦ · OWASP Code Review Guide V1.1 2008 2 Table of Contents Foreword by Jeff Williams, OWASP Chair ..... 4

OWASP CODE REVIEW GUIDE€¦ · OWASP Code Review Guide V1.1 2008 2 Table of Contents Foreword by Jeff Williams, OWASP Chair ..... 4

SOURCE CODE REVIEW - BRISK INFO SEC · 2020. 9. 4. · OWASP Code Review Code Review Tools SCST DCST Source Code Security Assessment Standa rds we follo w OWASP SDLC WASC. Title:

SOURCE CODE REVIEW - BRISK INFO SEC · 2020. 9. 4. · OWASP Code Review Code Review Tools SCST DCST Source Code Security Assessment Standa rds we follo w OWASP SDLC WASC. Title:

SDLC Model

SDLC Model

From Chaos to Clarity: Embedding Security into the SDLC · requirements from the OWASP Testing Guide v4 and Industry Best Practices. • Through each of the phases of the SDLC, the

From Chaos to Clarity: Embedding Security into the SDLC · requirements from the OWASP Testing Guide v4 and Industry Best Practices. • Through each of the phases of the SDLC, the

OWASP CODE REVIEW GUIDE - mirrors.ocf.berkeley.edu · OWASP Code Review Guide V1.1 2008 8 ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT The Open Web Application Security Project

OWASP CODE REVIEW GUIDE - mirrors.ocf.berkeley.edu · OWASP Code Review Guide V1.1 2008 8 ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT The Open Web Application Security Project

Microsoft SDL: Agile Development - OWASP · Microsoft SDL: Agile Development Nick Coblentz, CISSP, Microsoft MVP Senior Security Consultant ... SDLC (Waterfall Methodology) January

Microsoft SDL: Agile Development - OWASP · Microsoft SDL: Agile Development Nick Coblentz, CISSP, Microsoft MVP Senior Security Consultant ... SDLC (Waterfall Methodology) January

SDLC Presentation

SDLC Presentation

Java Developers OWASP TOP 10 - doag.org€¦ · Document secure coding conventions Think about a Software Development Lifecycle (SDLC) later 5. ... Use an OR-Mapper like Hibernate,

Java Developers OWASP TOP 10 - doag.org€¦ · Document secure coding conventions Think about a Software Development Lifecycle (SDLC) later 5. ... Use an OR-Mapper like Hibernate,

MÁSTER EN CIBERSEGURIDAD · • Systems Development Life Cycle (SDLC). • Open Web Application Security Project (OWASP) general. •OWASP Top 10. • OWASP Java Top 10. • Seguridad

MÁSTER EN CIBERSEGURIDAD · • Systems Development Life Cycle (SDLC). • Open Web Application Security Project (OWASP) general. •OWASP Top 10. • OWASP Java Top 10. • Seguridad

Isc2 secure sdlc owasp achieving compliance v1.0 2012 05-04

Isc2 secure sdlc owasp achieving compliance v1.0 2012 05-04

IA in SDLC - ISACA · 2014-09-02 · Project risks Role of IA in SDLC Discussion Solutions to SDLC challenges The SDLC What the auditor should not do Challenges in the SDLC IA in

IA in SDLC - ISACA · 2014-09-02 · Project risks Role of IA in SDLC Discussion Solutions to SDLC challenges The SDLC What the auditor should not do Challenges in the SDLC IA in

Secure SDLC: The Good, The Bad, and The Ugly - OWASP · 2020-01-17 · Secure SDLC: The Good, The Bad, and The Ugly. Joey Peloquin, Director, Application Security. FishNet Security.

Secure SDLC: The Good, The Bad, and The Ugly - OWASP · 2020-01-17 · Secure SDLC: The Good, The Bad, and The Ugly. Joey Peloquin, Director, Application Security. FishNet Security.

Owasp tools - OWASP Serbia

Owasp tools - OWASP Serbia

OWASP MOBILE SECURITY TESTING · Network Communication Requirements OWASP Mobile Application Security Verification Standard v1.1 21 V5: Network Communication RequirementsFile Size:

OWASP MOBILE SECURITY TESTING · Network Communication Requirements OWASP Mobile Application Security Verification Standard v1.1 21 V5: Network Communication RequirementsFile Size:

OWASP Code Review Guide V1.1

OWASP Code Review Guide V1.1

OWASP Automated Threat Handbook Web Applications · OWASP Automated Threat Handbook . A new addition for v1.1 is the work we have undertaken on enumeration and documentation of 14

OWASP Automated Threat Handbook Web Applications · OWASP Automated Threat Handbook . A new addition for v1.1 is the work we have undertaken on enumeration and documentation of 14

Evolving web security model v1.1 - Portland OWASP May 29 2014

Evolving web security model v1.1 - Portland OWASP May 29 2014

Certification Project Discussion - OWASP · –eLearning/Certification Case Studies ... •Published 7 books, ... Symantec, Microsoft and SAP as part of their SDLC

Certification Project Discussion - OWASP · –eLearning/Certification Case Studies ... •Published 7 books, ... Symantec, Microsoft and SAP as part of their SDLC

Secure development and the SDLC - OWASP development and the SDLC ... A3 Cross-Site Scripting (XSS) ... Database / SQL Injection Parameterization / ORM

Secure development and the SDLC - OWASP development and the SDLC ... A3 Cross-Site Scripting (XSS) ... Database / SQL Injection Parameterization / ORM