OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

20
OpenSAMM in the Real World: Pitfalls Discovered and Treasure Collected Along the Way Philip J. Beyer - Texas Education Agency [email protected] @pjbeyer Scott Stevens - Denim Group [email protected] http://lanyrd.com/shgmf 1 LASCON 2011 Copyright 2011 by Texas Education Agency. All rights reserved.

description

:: History :: LASCON 2011 - October 28, 2011 (Philip J Beyer and Scott Stevens) - http://lanyrd.com/shgmf :: Summary :: We will present the difficulties and successes involved with realigning the development lifecycle at TEA using OpenSAMM. :: Abstract :: In "Pitfall!", a player must maneuver Pitfall Harry through a maze-like jungle to stay alive. Along the way, he must negotiate numerous hazards, try to recover treasure, and do it all in a limited time. Implementing OWASP's OpenSAMM in a large organization is kinda like playing that classic game. It's a little dangerous, requires vision, planning, and precision, and promises rewards. Like many of its size and with its mandate, the Texas Education Agency already has an SDLC. Enter Pitfall Phil. In an effort to build a stronger program, Pitfall Phil shifted the focus of TEA's application security program to align with OpenSAMM. We will present the hazards he discovered and the treasure he found while playing the game.

Transcript of OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Page 1: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

OpenSAMM in the Real World: Pitfalls Discovered and Treasure

Collected Along the Way Philip J. Beyer - Texas Education Agency

[email protected] @pjbeyer

Scott Stevens - Denim Group [email protected]

http://lanyrd.com/shgmf 1 LASCON 2011 Copyright 2011 by Texas Education Agency. All rights reserved.

Page 2: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Overview

• Background • The Manual • The Premise • Treasures and Pitfalls • Game Over

LASCON 2011 http://lanyrd.com/shgmf 2 Copyright 2011 by Texas Education Agency. All rights reserved.

Page 3: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

About

• Phil Beyer – Information Security Officer – Consulting background

• Scott Stevens – Project Manager – Application development background

• TEA – ~700 employees – ~1200 school districts – ~5 million students

LASCON 2011 http://lanyrd.com/shgmf 3 Copyright 2011 by Texas Education Agency. All rights reserved.

Page 4: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Where Did TEA Start?

• Application Security Program already established – Some policies & procedures – Initial training & exposure to concepts – Historically siloed approach

• Outsourcing for subject matter expertise

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf 4

Page 5: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Where Do You Start?

• Establish your Application Security Program • Be the Champion (or find one) • Make sure your Team Gets It • Have a Roadmap to Maturity

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf 5

Page 6: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

The Manual Business Functions

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf 6

Page 7: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

The Manual Security Practices

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf 7

Page 8: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

The Manual Phases

1. The Early Levels 2. Racking Up Some

Points 3. Hitting Your Stride 4. Bigger Treasures,

Deeper Pits The End Game

Copyright 2011 by Texas Education Agency. All rights reserved.

Page 9: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

The Premise

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf 9

• It has already started • Shortcuts don’t exist

– No cheat codes – No invincibility – No God mode

• There are Pitfalls • There are Treasures

Page 10: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

The Early Levels (Phase 1) Treasures

• A Map – Not necessarily THE Map, but

something to get started – An organizational roadmap is a

powerful thing

• Some Running Room – Awareness in the organization is

increasing

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

10

Page 11: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

The Early Levels (Phase 1) Pitfalls

• The Log – You can’t stand still – Move through Phase 1 so you

don’t get rolled over

• Inertia – Getting started is just plain hard – Determining who should play is

also hard

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

11

Page 12: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Racking Up Some Points (Phase 2) Treasures

• Silver Bars – Development teams begin to

appreciate the security problem

• The Ladder – More of the team is involved in

practicing security – You’ve found a new way around

the alligator-infested pond Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

12

Page 13: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Racking Up Some Points (Phase 2) Pitfalls

• The Alligator – There’s a dangerous thing there

on the screen – Threats are real, and now they

see some of them too • More Players

– Other people are going to play your game

– They may not play as { nice | carefully | safely } as you

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

13

Page 14: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Hitting Your Stride (Phase 3) Treasures

• Gold Bars – Better visibility instills confidence

in Management

• The Compass – The Program has direction – From requirements to

maintenance, a formal process starts to emerge

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

14

Page 15: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Hitting Your Stride (Phase 3) Pitfalls

• The Scorpion – Better informed Management

may sting

• The Wall – A different kind of obstacle will

block your path – Developers and Operators may

not enjoy working together more closely

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

15

Page 16: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Bigger Treasures, Deeper Pits (Phase 4) Treasures

• The Bridge – Get rid of that Rope and jeer at

the Alligators as you walk across – The whole Program is working

together to build securely and verify aggressively

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

16

Page 17: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Bigger Treasures, Deeper Pits (Phase 4) Pitfalls

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

17

• The Hole – Compliance is not Security – Don’t let Management fall into the

trap at this stage of the game… It can be a pretty deep pit

Page 18: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

The End Game (Phases 5 & 6) Treasures

• Shangri-La – You’ve reached the mystical,

harmonious valley; a permanently happy land isolated from the outside world

– I’d tell you how it feels, but we haven’t gotten there yet

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

18

Page 19: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

It’s Time to Play

• Build a Mature Software Assurance Program • Measure and Report Your Progress • Have Fun!

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

19

Page 20: OpenSAMM in the Real World: Pitfalls Discovered and Treasures Collected Along the Way

Resources

• OWASP – Open Web Application Security Project – http://www.owasp.org/

• OpenSAMM - Software Assurance Maturity Model – http://www.opensamm.org/

• Attribution

– All OpenSAMM images are licensed under the Creative Commons Attribution-Share Alike 3.0 License.

Copyright 2011 by Texas Education Agency. All rights reserved. LASCON 2011 http://lanyrd.com/shgmf

20