SlideShare uma empresa Scribd logo

Software Security Debt Management

•Transferir como PPTX, PDF•
•
Global Business Events
Global Business Events

This document discusses the concept of "security debt" in software development, which refers to known and unknown security issues that exist in software due to tradeoffs made between security and speed of delivery. It notes that all software accrues security debt over time. It discusses different types of security debt and factors that influence how much debt is acceptable. The document advocates treating security debt like technical debt by prioritizing issues, assigning repayment timelines, and continually working to reduce the debt load over time through secure development practices and prioritized fixes. The goal is managing risk from security debt issues rather than achieving zero debt.

1 de 35
Software Security Austerity Security Debt in Modern Software Development Ollie Whitehouse, Associate Director, NCC Group
Agenda • Introduction • Software Security Debt • Debt Management • Conclusions
Before we begin… metaphor abuse warning!
… before we begin part 2… there is a white paper available
Security debt
Technical debt "Shipping first time code is like going into debt. A little debt speeds development so long as it is paid back promptly with a rewrite. The danger occurs when the debt is not repaid. Every minute spent on not-quite-right code counts as interest on that debt."
Security debt… • Present in all software • Analogous to development and bugs • security is just a type of bug • Analogous to development and tech debt • The trade off between • fix everything and ship nothing -versus- • fix only the critical -versus- • real world business
Security debt… • You get good… • .. you get a new problem • Too many vulnerabilities! • You focus on just the critical / serious • … the low / medium mountain grows
Security debt – types? • Known – identified, but yet to be addressed • Unknown – latent issues yet to be discovered
Security debt – source? • Self my development • Supply chain my outsourced development • Dependency COTS component use without formal support
Security debt and SDLs • SDL does not mean 0 debt • SDL means known security debt • with a repayment plan • No SDL means latent security debt • with no repayment plan • SDL means more bugs than resources • quite quickly / in the short to medium term • SDL means accelerated discovery • you get too good
Security debt and SDLs • Why accelerated discovery? • requirements reviews • static code analysis • manual code analysis • automated testing (fuzzing) • increased awareness and knowledge • root cause analysis and variations
Accruing debt based on risk • Financial cost versus • Revenue • Cost of a response incident • Brand impact • Liability • Time cost versus • Resources • Time to market • Financial costs
Accruing debt based on risk • Impact versus • Discovery • Mitigations • Complexity and prerequisite conditions • Access requirements • Marker expectation
Latent debt resilience • Latent debt will always exist • through own activities • through suppliers • through dependencies • The need to feed upstream • The need to build resilient software
Debt Management
Why we care • Client expectation • Regulatory requirements • Increasing cost of debt • Attacker capability evolution • Increased external focus
Why we care
Why we care
Assigning interest rates to security debt • Interest rate = Priority • Priority = risk • Risk = informed
Assigning interest rates to security debt Threat = f (Motivation, Capability, Opportunity, Impact)
Assigning interest rates to security debt DREAD
Assigning interest rates to security debt CVSS
Assigning interest rates to security debt • Impact • Distribution • Disclosure • Likelihood of discovery • Presence of mitigations • Complexity of exploitation • Access requirements • Customer expectation
Repayment – New version requirements
Repayment – Severity prioritization • Next release (any type) • Next release (major version) • Next release +1 (any type) • Next release +2 (any type) • Next release +3 (any type)
Repayment – Percentage reduction Severity Percentage to be resolved Critical 100% Serious 50% Moderate 30% Low 20% Other 0 to 5 %
Repayment – Forced
Debt Expiry
Debt Overhang • Stuart Myers paper (1977) ‘Determinants of Corporate Borrowing’ • Debt mountain equals death by a thousand cuts • Leading to inability to accrue more security debt • Leading to slower innovation
Strategic Debt Restructuring
Bankruptcy
Non Repayment – Consequence Planning "We may be at the point of diminishing returns by trying to buy down vulnerability," the general observed. Instead, he added, "maybe it’s time to place more emphasis on coping with the consequences of a successful attack, and trying to develop networks that can "self-heal" or "self-limit“ the damages inflicted upon them. "
Conclusions • Zero debt is not good business practice • SDLs enable debt discovery and repayment • A pure risk approach allows the mountain to grow • Outsourcing carries risk of larger latent debt • A mature model is to understand and plan payment • … while educating upstream • … while paying down the mountain • … while still using risk
Thanks! Questions? UK Offices North American Offices Australian Offices Manchester - Head Office San Francisco Sydney Cheltenham Atlanta Edinburgh New York Leatherhead Seattle London Thame European Offices Amsterdam - Netherlands Ollie Whitehouse Munich – Germany Zurich - Switzerland ollie.whitehouse@nccgroup.com

Recomendados

Ann Shanklin: Risk Management Basics
Ann Shanklin: Risk Management BasicsAnn Shanklin: Risk Management Basics
Ann Shanklin: Risk Management BasicsSocial Media for Nonprofits
 
Crisis & Risk Management for Companies Training by University of Alexandria
Crisis & Risk Management for Companies Training by University of AlexandriaCrisis & Risk Management for Companies Training by University of Alexandria
Crisis & Risk Management for Companies Training by University of AlexandriaAtlantic Training, LLC.
 
Decision making under condition of risk and uncertainty
Decision making under condition of risk and uncertaintyDecision making under condition of risk and uncertainty
Decision making under condition of risk and uncertaintysapna moodautia
 
Crisis management
Crisis managementCrisis management
Crisis managementahmadsanadsalim
 
Crisis management
Crisis managementCrisis management
Crisis managementAtindya K Ghosh
 
Crisis management plan presentation
Crisis management plan presentationCrisis management plan presentation
Crisis management plan presentationSandra Eblevi
 
Environmental Law for Business Seminar: Disaster Management
Environmental Law for Business Seminar: Disaster ManagementEnvironmental Law for Business Seminar: Disaster Management
Environmental Law for Business Seminar: Disaster ManagementThis account is closed
 
Crisis management
Crisis managementCrisis management
Crisis managementBusiness Management
 

Recomendados

Ann Shanklin: Risk Management Basics
Ann Shanklin: Risk Management BasicsAnn Shanklin: Risk Management Basics
Ann Shanklin: Risk Management BasicsSocial Media for Nonprofits
 
Crisis & Risk Management for Companies Training by University of Alexandria
Crisis & Risk Management for Companies Training by University of AlexandriaCrisis & Risk Management for Companies Training by University of Alexandria
Crisis & Risk Management for Companies Training by University of AlexandriaAtlantic Training, LLC.
 
Decision making under condition of risk and uncertainty
Decision making under condition of risk and uncertaintyDecision making under condition of risk and uncertainty
Decision making under condition of risk and uncertaintysapna moodautia
 
Crisis management
Crisis managementCrisis management
Crisis managementahmadsanadsalim
 
Crisis management
Crisis managementCrisis management
Crisis managementAtindya K Ghosh
 
Crisis management plan presentation
Crisis management plan presentationCrisis management plan presentation
Crisis management plan presentationSandra Eblevi
 
Environmental Law for Business Seminar: Disaster Management
Environmental Law for Business Seminar: Disaster ManagementEnvironmental Law for Business Seminar: Disaster Management
Environmental Law for Business Seminar: Disaster ManagementThis account is closed
 
Crisis management
Crisis managementCrisis management
Crisis managementBusiness Management
 
Crisis Management Webinar - Core Consulting
Crisis Management Webinar - Core ConsultingCrisis Management Webinar - Core Consulting
Crisis Management Webinar - Core ConsultingCORE Consulting
 
Chapter 2 (crisis management)
Chapter 2 (crisis management)Chapter 2 (crisis management)
Chapter 2 (crisis management)Abdul Jawad Chaudhry
 
Crisis Management Strategies When Disaster Strikes
Crisis Management Strategies When Disaster StrikesCrisis Management Strategies When Disaster Strikes
Crisis Management Strategies When Disaster StrikesThe Windsdor Consulting Group, Inc.
 
SoluxR- The Uncertainty Continuum
SoluxR- The Uncertainty ContinuumSoluxR- The Uncertainty Continuum
SoluxR- The Uncertainty ContinuumPeadar Duffy
 
Adw
AdwAdw
Adwbigj686
 
Crisis management
Crisis managementCrisis management
Crisis managementRajat Ghosh
 
Crisis Management Training Strategies by RIMS
Crisis Management Training Strategies by RIMSCrisis Management Training Strategies by RIMS
Crisis Management Training Strategies by RIMSAtlantic Training, LLC.
 
Crisis Management Training by Iowa State University
Crisis Management Training by Iowa State UniversityCrisis Management Training by Iowa State University
Crisis Management Training by Iowa State UniversityAtlantic Training, LLC.
 
Financial decision making by anil kumar a cfo mantri developers 24 march 2011
Financial decision making by anil kumar a cfo mantri developers 24 march 2011Financial decision making by anil kumar a cfo mantri developers 24 march 2011
Financial decision making by anil kumar a cfo mantri developers 24 march 2011gajananh999
 
Crisis Management and Crisis Communication
Crisis Management and Crisis Communication Crisis Management and Crisis Communication
Crisis Management and Crisis Communication Alaa Abdallah
 
Crisis Management in Organization Development by The College of Saint Scholas...
Crisis Management in Organization Development by The College of Saint Scholas...Crisis Management in Organization Development by The College of Saint Scholas...
Crisis Management in Organization Development by The College of Saint Scholas...Atlantic Training, LLC.
 
Crisis management
Crisis management Crisis management
Crisis management Tribhuvan University,
 
Crisis Management
Crisis ManagementCrisis Management
Crisis ManagementRalph Bateman
 
risk management
risk managementrisk management
risk managementQue Tomeyz
 
David Hancock - Risk Leadership in a world of Uncertainty and Ambiguity
David Hancock - Risk Leadership in a world of Uncertainty and AmbiguityDavid Hancock - Risk Leadership in a world of Uncertainty and Ambiguity
David Hancock - Risk Leadership in a world of Uncertainty and AmbiguityAssociation for Project Management
 
Crisis management for non crisis managers Taha ABULAYNIN
Crisis management for non crisis managers Taha ABULAYNINCrisis management for non crisis managers Taha ABULAYNIN
Crisis management for non crisis managers Taha ABULAYNINTaha ABULAYNIN
 
Risk transfer strategy.
Risk transfer strategy.Risk transfer strategy.
Risk transfer strategy.Ignacio Reclusa
 
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)Devin DeCiantis
 
Crisis management final
Crisis management finalCrisis management final
Crisis management finalGeeg geeh
 
Crisis Management Plan
Crisis Management PlanCrisis Management Plan
Crisis Management PlanYOUNAJ16
 
Webinar - Risk Methodologies - Why are there so many?
Webinar - Risk Methodologies - Why are there so many?Webinar - Risk Methodologies - Why are there so many?
Webinar - Risk Methodologies - Why are there so many?easy2comply
 
Cyber Resilience: Managing Cyber Shocks
Cyber Resilience: Managing Cyber ShocksCyber Resilience: Managing Cyber Shocks
Cyber Resilience: Managing Cyber ShocksPhil Huggins FBCS CITP
 

Mais conteúdo relacionado

Mais procurados

Crisis Management Webinar - Core Consulting
Crisis Management Webinar - Core ConsultingCrisis Management Webinar - Core Consulting
Crisis Management Webinar - Core ConsultingCORE Consulting
 
SoluxR- The Uncertainty Continuum
SoluxR- The Uncertainty ContinuumSoluxR- The Uncertainty Continuum
SoluxR- The Uncertainty ContinuumPeadar Duffy
 
Crisis management
Crisis managementCrisis management
Crisis managementRajat Ghosh
 
Crisis Management Training Strategies by RIMS
Crisis Management Training Strategies by RIMSCrisis Management Training Strategies by RIMS
Crisis Management Training Strategies by RIMSAtlantic Training, LLC.
 
Crisis Management Training by Iowa State University
Crisis Management Training by Iowa State UniversityCrisis Management Training by Iowa State University
Crisis Management Training by Iowa State UniversityAtlantic Training, LLC.
 
Financial decision making by anil kumar a cfo mantri developers 24 march 2011
Financial decision making by anil kumar a cfo mantri developers 24 march 2011Financial decision making by anil kumar a cfo mantri developers 24 march 2011
Financial decision making by anil kumar a cfo mantri developers 24 march 2011gajananh999
 
Crisis Management and Crisis Communication
Crisis Management and Crisis Communication Crisis Management and Crisis Communication
Crisis Management and Crisis Communication Alaa Abdallah
 
Crisis Management in Organization Development by The College of Saint Scholas...
Crisis Management in Organization Development by The College of Saint Scholas...Crisis Management in Organization Development by The College of Saint Scholas...
Crisis Management in Organization Development by The College of Saint Scholas...Atlantic Training, LLC.
 
risk management
risk managementrisk management
risk managementQue Tomeyz
 
David Hancock - Risk Leadership in a world of Uncertainty and Ambiguity
David Hancock - Risk Leadership in a world of Uncertainty and AmbiguityDavid Hancock - Risk Leadership in a world of Uncertainty and Ambiguity
David Hancock - Risk Leadership in a world of Uncertainty and AmbiguityAssociation for Project Management
 
Crisis management for non crisis managers Taha ABULAYNIN
Crisis management for non crisis managers Taha ABULAYNINCrisis management for non crisis managers Taha ABULAYNIN
Crisis management for non crisis managers Taha ABULAYNINTaha ABULAYNIN
 
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)Devin DeCiantis
 
Crisis management final
Crisis management finalCrisis management final
Crisis management finalGeeg geeh
 
Crisis Management Plan
Crisis Management PlanCrisis Management Plan
Crisis Management PlanYOUNAJ16
 

Mais procurados (20)

Crisis Management Webinar - Core Consulting
Crisis Management Webinar - Core ConsultingCrisis Management Webinar - Core Consulting
Crisis Management Webinar - Core Consulting
 
Chapter 2 (crisis management)
Chapter 2 (crisis management)Chapter 2 (crisis management)
Chapter 2 (crisis management)
 
Crisis Management Strategies When Disaster Strikes
Crisis Management Strategies When Disaster StrikesCrisis Management Strategies When Disaster Strikes
Crisis Management Strategies When Disaster Strikes
 
SoluxR- The Uncertainty Continuum
SoluxR- The Uncertainty ContinuumSoluxR- The Uncertainty Continuum
SoluxR- The Uncertainty Continuum
 
Adw
AdwAdw
Adw
 
Crisis management
Crisis managementCrisis management
Crisis management
 
Crisis Management Training Strategies by RIMS
Crisis Management Training Strategies by RIMSCrisis Management Training Strategies by RIMS
Crisis Management Training Strategies by RIMS
 
Crisis Management Training by Iowa State University
Crisis Management Training by Iowa State UniversityCrisis Management Training by Iowa State University
Crisis Management Training by Iowa State University
 
Financial decision making by anil kumar a cfo mantri developers 24 march 2011
Financial decision making by anil kumar a cfo mantri developers 24 march 2011Financial decision making by anil kumar a cfo mantri developers 24 march 2011
Financial decision making by anil kumar a cfo mantri developers 24 march 2011
 
Crisis Management and Crisis Communication
Crisis Management and Crisis Communication Crisis Management and Crisis Communication
Crisis Management and Crisis Communication
 
Crisis Management in Organization Development by The College of Saint Scholas...
Crisis Management in Organization Development by The College of Saint Scholas...Crisis Management in Organization Development by The College of Saint Scholas...
Crisis Management in Organization Development by The College of Saint Scholas...
 
Crisis management
Crisis management Crisis management
Crisis management
 
Crisis Management
Crisis ManagementCrisis Management
Crisis Management
 
risk management
risk managementrisk management
risk management
 
David Hancock - Risk Leadership in a world of Uncertainty and Ambiguity
David Hancock - Risk Leadership in a world of Uncertainty and AmbiguityDavid Hancock - Risk Leadership in a world of Uncertainty and Ambiguity
David Hancock - Risk Leadership in a world of Uncertainty and Ambiguity
 
Crisis management for non crisis managers Taha ABULAYNIN
Crisis management for non crisis managers Taha ABULAYNINCrisis management for non crisis managers Taha ABULAYNIN
Crisis management for non crisis managers Taha ABULAYNIN
 
Risk transfer strategy.
Risk transfer strategy.Risk transfer strategy.
Risk transfer strategy.
 
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)
COVID-19 Crisis Management Toolkit for Family Business (Executive Summary)
 
Crisis management final
Crisis management finalCrisis management final
Crisis management final
 
Crisis Management Plan
Crisis Management PlanCrisis Management Plan
Crisis Management Plan
 

Semelhante a Software Security Debt Management

Webinar - Risk Methodologies - Why are there so many?
Webinar - Risk Methodologies - Why are there so many?Webinar - Risk Methodologies - Why are there so many?
Webinar - Risk Methodologies - Why are there so many?easy2comply
 
Cyber Resilience: Managing Cyber Shocks
Cyber Resilience: Managing Cyber ShocksCyber Resilience: Managing Cyber Shocks
Cyber Resilience: Managing Cyber ShocksPhil Huggins FBCS CITP
 
Understanding credit risk : mint2save
Understanding credit risk : mint2saveUnderstanding credit risk : mint2save
Understanding credit risk : mint2saveMint2Save
 
Agile and the nature of decision making
Agile and the nature of decision makingAgile and the nature of decision making
Agile and the nature of decision makingDennis Stevens
 
Getting down to business with security
Getting down to business with securityGetting down to business with security
Getting down to business with securityGerhard de Klerk
 
Agile and the nature of decision making
Agile and the nature of decision makingAgile and the nature of decision making
Agile and the nature of decision makingdrewz lin
 
Risk management automation
Risk management automationRisk management automation
Risk management automationsheyam selvaraj
 
Rims 2016 Global supply chain risk and resiliency
Rims 2016 Global supply chain risk and resiliencyRims 2016 Global supply chain risk and resiliency
Rims 2016 Global supply chain risk and resiliencyLootok, Ltd
 
Risk Management in Financial Institutions
Risk Management in Financial InstitutionsRisk Management in Financial Institutions
Risk Management in Financial InstitutionsArchanaKamble18
 
Risks of Risk-Based Testing
Risks of Risk-Based TestingRisks of Risk-Based Testing
Risks of Risk-Based Testingrrice2000
 
Security Compliance Tackled by Taylor Hersom
Security Compliance Tackled by Taylor HersomSecurity Compliance Tackled by Taylor Hersom
Security Compliance Tackled by Taylor HersomSaraPia5
 
Risk managemet made easy
Risk managemet made easyRisk managemet made easy
Risk managemet made easysheyam selvaraj
 
Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?Skybox Security
 
Introduction to credit risk management
Introduction to credit risk managementIntroduction to credit risk management
Introduction to credit risk managementTOSHI STATS Co.,Ltd.
 
Digital Marketing in the "Secure Age"
Digital Marketing in the "Secure Age"Digital Marketing in the "Secure Age"
Digital Marketing in the "Secure Age"Alert Logic
 
[CB19] Integration of Cyber Insurance Into A Risk Management Program by Jake ...
[CB19] Integration of Cyber Insurance Into A Risk Management Program by Jake ...[CB19] Integration of Cyber Insurance Into A Risk Management Program by Jake ...
[CB19] Integration of Cyber Insurance Into A Risk Management Program by Jake ...CODE BLUE
 

Semelhante a Software Security Debt Management (20)

Webinar - Risk Methodologies - Why are there so many?
Webinar - Risk Methodologies - Why are there so many?Webinar - Risk Methodologies - Why are there so many?
Webinar - Risk Methodologies - Why are there so many?
 
Cyber Resilience: Managing Cyber Shocks
Cyber Resilience: Managing Cyber ShocksCyber Resilience: Managing Cyber Shocks
Cyber Resilience: Managing Cyber Shocks
 
Understanding credit risk : mint2save
Understanding credit risk : mint2saveUnderstanding credit risk : mint2save
Understanding credit risk : mint2save
 
Agile and the nature of decision making
Agile and the nature of decision makingAgile and the nature of decision making
Agile and the nature of decision making
 
Presentation on credit risk
Presentation on credit risk Presentation on credit risk
Presentation on credit risk
 
Getting down to business with security
Getting down to business with securityGetting down to business with security
Getting down to business with security
 
DRIDeckFinalMar3
DRIDeckFinalMar3DRIDeckFinalMar3
DRIDeckFinalMar3
 
Agile and the nature of decision making
Agile and the nature of decision makingAgile and the nature of decision making
Agile and the nature of decision making
 
Risk management automation
Risk management automationRisk management automation
Risk management automation
 
Rims 2016 Global supply chain risk and resiliency
Rims 2016 Global supply chain risk and resiliencyRims 2016 Global supply chain risk and resiliency
Rims 2016 Global supply chain risk and resiliency
 
Risk Management in Financial Institutions
Risk Management in Financial InstitutionsRisk Management in Financial Institutions
Risk Management in Financial Institutions
 
Risks of Risk-Based Testing
Risks of Risk-Based TestingRisks of Risk-Based Testing
Risks of Risk-Based Testing
 
Security Compliance Tackled by Taylor Hersom
Security Compliance Tackled by Taylor HersomSecurity Compliance Tackled by Taylor Hersom
Security Compliance Tackled by Taylor Hersom
 
Risk managemet made easy
Risk managemet made easyRisk managemet made easy
Risk managemet made easy
 
Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?
 
Managing Risk
Managing RiskManaging Risk
Managing Risk
 
Introduction to credit risk management
Introduction to credit risk managementIntroduction to credit risk management
Introduction to credit risk management
 
Digital Marketing in the "Secure Age"
Digital Marketing in the "Secure Age"Digital Marketing in the "Secure Age"
Digital Marketing in the "Secure Age"
 
[CB19] Integration of Cyber Insurance Into A Risk Management Program by Jake ...
[CB19] Integration of Cyber Insurance Into A Risk Management Program by Jake ...[CB19] Integration of Cyber Insurance Into A Risk Management Program by Jake ...
[CB19] Integration of Cyber Insurance Into A Risk Management Program by Jake ...
 
PCG Presentation
PCG PresentationPCG Presentation
PCG Presentation
 

Mais de Global Business Events

Ludo Van den Kerckhove , Managing Partner at A-cross Health - The Network Alw...
Ludo Van den Kerckhove , Managing Partner at A-cross Health - The Network Alw...Ludo Van den Kerckhove , Managing Partner at A-cross Health - The Network Alw...
Ludo Van den Kerckhove , Managing Partner at A-cross Health - The Network Alw...Global Business Events
 
Tim Mann, CIO at NFU Mutual - Digital Transformation Case Studies: how NFUM i...
Tim Mann, CIO at NFU Mutual - Digital Transformation Case Studies: how NFUM i...Tim Mann, CIO at NFU Mutual - Digital Transformation Case Studies: how NFUM i...
Tim Mann, CIO at NFU Mutual - Digital Transformation Case Studies: how NFUM i...Global Business Events
 
Neil Ward-Dutton, Founder & Research Director at MWD Advisors - Innovating di...
Neil Ward-Dutton, Founder & Research Director at MWD Advisors - Innovating di...Neil Ward-Dutton, Founder & Research Director at MWD Advisors - Innovating di...
Neil Ward-Dutton, Founder & Research Director at MWD Advisors - Innovating di...Global Business Events
 
Mark Jacot, Assistant Director – IT Service Deliveryat The Open University - ...
Mark Jacot, Assistant Director – IT Service Deliveryat The Open University - ...Mark Jacot, Assistant Director – IT Service Deliveryat The Open University - ...
Mark Jacot, Assistant Director – IT Service Deliveryat The Open University - ...Global Business Events
 
Gerard O'Hara, Head of IT EMEA at Facebook - How the Facebook IT department i...
Gerard O'Hara, Head of IT EMEA at Facebook - How the Facebook IT department i...Gerard O'Hara, Head of IT EMEA at Facebook - How the Facebook IT department i...
Gerard O'Hara, Head of IT EMEA at Facebook - How the Facebook IT department i...Global Business Events
 
Hakan Yaren, Managing Director IT at FedEx Express EMEA - IT Modernisation
Hakan Yaren, Managing Director IT at FedEx Express EMEA - IT ModernisationHakan Yaren, Managing Director IT at FedEx Express EMEA - IT Modernisation
Hakan Yaren, Managing Director IT at FedEx Express EMEA - IT ModernisationGlobal Business Events
 
Sam De Silva, Partner - Head of IT and Outsourcing Group at Penningtons Manch...
Sam De Silva, Partner - Head of IT and Outsourcing Group at Penningtons Manch...Sam De Silva, Partner - Head of IT and Outsourcing Group at Penningtons Manch...
Sam De Silva, Partner - Head of IT and Outsourcing Group at Penningtons Manch...Global Business Events
 
Hugo Smith, CTO at Broadbandchoices - Improving the Agility of your Business ...
Hugo Smith, CTO at Broadbandchoices - Improving the Agility of your Business ...Hugo Smith, CTO at Broadbandchoices - Improving the Agility of your Business ...
Hugo Smith, CTO at Broadbandchoices - Improving the Agility of your Business ...Global Business Events
 
Mark Aikman, IT Director at The North Group - Leading a Complex Bespoke Syste...
Mark Aikman, IT Director at The North Group - Leading a Complex Bespoke Syste...Mark Aikman, IT Director at The North Group - Leading a Complex Bespoke Syste...
Mark Aikman, IT Director at The North Group - Leading a Complex Bespoke Syste...Global Business Events
 
David Clarke, CITSO at Digital Arena - Security Benchmarking, best practise a...
David Clarke, CITSO at Digital Arena - Security Benchmarking, best practise a...David Clarke, CITSO at Digital Arena - Security Benchmarking, best practise a...
David Clarke, CITSO at Digital Arena - Security Benchmarking, best practise a...Global Business Events
 
John Prowse, vCISO at BT - Security Anxiety
John Prowse, vCISO at BT - Security AnxietyJohn Prowse, vCISO at BT - Security Anxiety
John Prowse, vCISO at BT - Security AnxietyGlobal Business Events
 
Kevin Watkins, Enterprise Security Architect at BAT - BAT’s Managed Security ...
Kevin Watkins, Enterprise Security Architect at BAT - BAT’s Managed Security ...Kevin Watkins, Enterprise Security Architect at BAT - BAT’s Managed Security ...
Kevin Watkins, Enterprise Security Architect at BAT - BAT’s Managed Security ...Global Business Events
 
Keith Inight, CTO at Atos - Software Defined Everything
Keith Inight, CTO at Atos - Software Defined EverythingKeith Inight, CTO at Atos - Software Defined Everything
Keith Inight, CTO at Atos - Software Defined EverythingGlobal Business Events
 
David Clarke, CITSO at Vciso - Security, Standards and Swiss Cheese
David Clarke, CITSO at Vciso - Security, Standards and Swiss CheeseDavid Clarke, CITSO at Vciso - Security, Standards and Swiss Cheese
David Clarke, CITSO at Vciso - Security, Standards and Swiss CheeseGlobal Business Events
 
Dave Jones, CIO at Cape Plc - Transition of Autonomous regional IT to Providi...
Dave Jones, CIO at Cape Plc - Transition of Autonomous regional IT to Providi...Dave Jones, CIO at Cape Plc - Transition of Autonomous regional IT to Providi...
Dave Jones, CIO at Cape Plc - Transition of Autonomous regional IT to Providi...Global Business Events
 
Wolfgang Kuhl, CIO at Pharmaserv - Data Centre Planning and Execution - A Sur...
Wolfgang Kuhl, CIO at Pharmaserv - Data Centre Planning and Execution - A Sur...Wolfgang Kuhl, CIO at Pharmaserv - Data Centre Planning and Execution - A Sur...
Wolfgang Kuhl, CIO at Pharmaserv - Data Centre Planning and Execution - A Sur...Global Business Events
 
Mark Aikman, CIO at The North Group - Leading a Complex Bespoke System Transf...
Mark Aikman, CIO at The North Group - Leading a Complex Bespoke System Transf...Mark Aikman, CIO at The North Group - Leading a Complex Bespoke System Transf...
Mark Aikman, CIO at The North Group - Leading a Complex Bespoke System Transf...Global Business Events
 
Neil Ward-Dutton, Co-founder and Research Director at MWD Advisors - Digital ...
Neil Ward-Dutton, Co-founder and Research Director at MWD Advisors - Digital ...Neil Ward-Dutton, Co-founder and Research Director at MWD Advisors - Digital ...
Neil Ward-Dutton, Co-founder and Research Director at MWD Advisors - Digital ...Global Business Events
 
Gordon Tredgold, SVP Global IT at Henkel - Fast Leadership - Accelerating Pro...
Gordon Tredgold, SVP Global IT at Henkel - Fast Leadership - Accelerating Pro...Gordon Tredgold, SVP Global IT at Henkel - Fast Leadership - Accelerating Pro...
Gordon Tredgold, SVP Global IT at Henkel - Fast Leadership - Accelerating Pro...Global Business Events
 

Mais de Global Business Events (20)

Cio Event
Cio EventCio Event
Cio Event
 
Ludo Van den Kerckhove , Managing Partner at A-cross Health - The Network Alw...
Ludo Van den Kerckhove , Managing Partner at A-cross Health - The Network Alw...Ludo Van den Kerckhove , Managing Partner at A-cross Health - The Network Alw...
Ludo Van den Kerckhove , Managing Partner at A-cross Health - The Network Alw...
 
Tim Mann, CIO at NFU Mutual - Digital Transformation Case Studies: how NFUM i...
Tim Mann, CIO at NFU Mutual - Digital Transformation Case Studies: how NFUM i...Tim Mann, CIO at NFU Mutual - Digital Transformation Case Studies: how NFUM i...
Tim Mann, CIO at NFU Mutual - Digital Transformation Case Studies: how NFUM i...
 
Neil Ward-Dutton, Founder & Research Director at MWD Advisors - Innovating di...
Neil Ward-Dutton, Founder & Research Director at MWD Advisors - Innovating di...Neil Ward-Dutton, Founder & Research Director at MWD Advisors - Innovating di...
Neil Ward-Dutton, Founder & Research Director at MWD Advisors - Innovating di...
 
Mark Jacot, Assistant Director – IT Service Deliveryat The Open University - ...
Mark Jacot, Assistant Director – IT Service Deliveryat The Open University - ...Mark Jacot, Assistant Director – IT Service Deliveryat The Open University - ...
Mark Jacot, Assistant Director – IT Service Deliveryat The Open University - ...
 
Gerard O'Hara, Head of IT EMEA at Facebook - How the Facebook IT department i...
Gerard O'Hara, Head of IT EMEA at Facebook - How the Facebook IT department i...Gerard O'Hara, Head of IT EMEA at Facebook - How the Facebook IT department i...
Gerard O'Hara, Head of IT EMEA at Facebook - How the Facebook IT department i...
 
Hakan Yaren, Managing Director IT at FedEx Express EMEA - IT Modernisation
Hakan Yaren, Managing Director IT at FedEx Express EMEA - IT ModernisationHakan Yaren, Managing Director IT at FedEx Express EMEA - IT Modernisation
Hakan Yaren, Managing Director IT at FedEx Express EMEA - IT Modernisation
 
Sam De Silva, Partner - Head of IT and Outsourcing Group at Penningtons Manch...
Sam De Silva, Partner - Head of IT and Outsourcing Group at Penningtons Manch...Sam De Silva, Partner - Head of IT and Outsourcing Group at Penningtons Manch...
Sam De Silva, Partner - Head of IT and Outsourcing Group at Penningtons Manch...
 
Hugo Smith, CTO at Broadbandchoices - Improving the Agility of your Business ...
Hugo Smith, CTO at Broadbandchoices - Improving the Agility of your Business ...Hugo Smith, CTO at Broadbandchoices - Improving the Agility of your Business ...
Hugo Smith, CTO at Broadbandchoices - Improving the Agility of your Business ...
 
Mark Aikman, IT Director at The North Group - Leading a Complex Bespoke Syste...
Mark Aikman, IT Director at The North Group - Leading a Complex Bespoke Syste...Mark Aikman, IT Director at The North Group - Leading a Complex Bespoke Syste...
Mark Aikman, IT Director at The North Group - Leading a Complex Bespoke Syste...
 
David Clarke, CITSO at Digital Arena - Security Benchmarking, best practise a...
David Clarke, CITSO at Digital Arena - Security Benchmarking, best practise a...David Clarke, CITSO at Digital Arena - Security Benchmarking, best practise a...
David Clarke, CITSO at Digital Arena - Security Benchmarking, best practise a...
 
John Prowse, vCISO at BT - Security Anxiety
John Prowse, vCISO at BT - Security AnxietyJohn Prowse, vCISO at BT - Security Anxiety
John Prowse, vCISO at BT - Security Anxiety
 
Kevin Watkins, Enterprise Security Architect at BAT - BAT’s Managed Security ...
Kevin Watkins, Enterprise Security Architect at BAT - BAT’s Managed Security ...Kevin Watkins, Enterprise Security Architect at BAT - BAT’s Managed Security ...
Kevin Watkins, Enterprise Security Architect at BAT - BAT’s Managed Security ...
 
Keith Inight, CTO at Atos - Software Defined Everything
Keith Inight, CTO at Atos - Software Defined EverythingKeith Inight, CTO at Atos - Software Defined Everything
Keith Inight, CTO at Atos - Software Defined Everything
 
David Clarke, CITSO at Vciso - Security, Standards and Swiss Cheese
David Clarke, CITSO at Vciso - Security, Standards and Swiss CheeseDavid Clarke, CITSO at Vciso - Security, Standards and Swiss Cheese
David Clarke, CITSO at Vciso - Security, Standards and Swiss Cheese
 
Dave Jones, CIO at Cape Plc - Transition of Autonomous regional IT to Providi...
Dave Jones, CIO at Cape Plc - Transition of Autonomous regional IT to Providi...Dave Jones, CIO at Cape Plc - Transition of Autonomous regional IT to Providi...
Dave Jones, CIO at Cape Plc - Transition of Autonomous regional IT to Providi...
 
Wolfgang Kuhl, CIO at Pharmaserv - Data Centre Planning and Execution - A Sur...
Wolfgang Kuhl, CIO at Pharmaserv - Data Centre Planning and Execution - A Sur...Wolfgang Kuhl, CIO at Pharmaserv - Data Centre Planning and Execution - A Sur...
Wolfgang Kuhl, CIO at Pharmaserv - Data Centre Planning and Execution - A Sur...
 
Mark Aikman, CIO at The North Group - Leading a Complex Bespoke System Transf...
Mark Aikman, CIO at The North Group - Leading a Complex Bespoke System Transf...Mark Aikman, CIO at The North Group - Leading a Complex Bespoke System Transf...
Mark Aikman, CIO at The North Group - Leading a Complex Bespoke System Transf...
 
Neil Ward-Dutton, Co-founder and Research Director at MWD Advisors - Digital ...
Neil Ward-Dutton, Co-founder and Research Director at MWD Advisors - Digital ...Neil Ward-Dutton, Co-founder and Research Director at MWD Advisors - Digital ...
Neil Ward-Dutton, Co-founder and Research Director at MWD Advisors - Digital ...
 
Gordon Tredgold, SVP Global IT at Henkel - Fast Leadership - Accelerating Pro...
Gordon Tredgold, SVP Global IT at Henkel - Fast Leadership - Accelerating Pro...Gordon Tredgold, SVP Global IT at Henkel - Fast Leadership - Accelerating Pro...
Gordon Tredgold, SVP Global IT at Henkel - Fast Leadership - Accelerating Pro...
 

Software Security Debt Management

  • 1. Software Security Austerity Security Debt in Modern Software Development Ollie Whitehouse, Associate Director, NCC Group
  • 2. Agenda • Introduction • Software Security Debt • Debt Management • Conclusions
  • 3. Before we begin… metaphor abuse warning!
  • 4. … before we begin part 2… there is a white paper available
  • 6. Technical debt "Shipping first time code is like going into debt. A little debt speeds development so long as it is paid back promptly with a rewrite. The danger occurs when the debt is not repaid. Every minute spent on not-quite-right code counts as interest on that debt."
  • 7. Security debt… • Present in all software • Analogous to development and bugs • security is just a type of bug • Analogous to development and tech debt • The trade off between • fix everything and ship nothing -versus- • fix only the critical -versus- • real world business
  • 8. Security debt… • You get good… • .. you get a new problem • Too many vulnerabilities! • You focus on just the critical / serious • … the low / medium mountain grows
  • 9. Security debt – types? • Known – identified, but yet to be addressed • Unknown – latent issues yet to be discovered
  • 10. Security debt – source? • Self my development • Supply chain my outsourced development • Dependency COTS component use without formal support
  • 11. Security debt and SDLs • SDL does not mean 0 debt • SDL means known security debt • with a repayment plan • No SDL means latent security debt • with no repayment plan • SDL means more bugs than resources • quite quickly / in the short to medium term • SDL means accelerated discovery • you get too good
  • 12. Security debt and SDLs • Why accelerated discovery? • requirements reviews • static code analysis • manual code analysis • automated testing (fuzzing) • increased awareness and knowledge • root cause analysis and variations
  • 13. Accruing debt based on risk • Financial cost versus • Revenue • Cost of a response incident • Brand impact • Liability • Time cost versus • Resources • Time to market • Financial costs
  • 14. Accruing debt based on risk • Impact versus • Discovery • Mitigations • Complexity and prerequisite conditions • Access requirements • Marker expectation
  • 15. Latent debt resilience • Latent debt will always exist • through own activities • through suppliers • through dependencies • The need to feed upstream • The need to build resilient software
  • 17. Why we care • Client expectation • Regulatory requirements • Increasing cost of debt • Attacker capability evolution • Increased external focus
  • 20. Assigning interest rates to security debt • Interest rate = Priority • Priority = risk • Risk = informed
  • 21. Assigning interest rates to security debt Threat = f (Motivation, Capability, Opportunity, Impact)
  • 22. Assigning interest rates to security debt DREAD
  • 23. Assigning interest rates to security debt CVSS
  • 24. Assigning interest rates to security debt • Impact • Distribution • Disclosure • Likelihood of discovery • Presence of mitigations • Complexity of exploitation • Access requirements • Customer expectation
  • 25. Repayment – New version requirements
  • 26. Repayment – Severity prioritization • Next release (any type) • Next release (major version) • Next release +1 (any type) • Next release +2 (any type) • Next release +3 (any type)
  • 27. Repayment – Percentage reduction Severity Percentage to be resolved Critical 100% Serious 50% Moderate 30% Low 20% Other 0 to 5 %
  • 30. Debt Overhang • Stuart Myers paper (1977) ‘Determinants of Corporate Borrowing’ • Debt mountain equals death by a thousand cuts • Leading to inability to accrue more security debt • Leading to slower innovation
  • 33. Non Repayment – Consequence Planning "We may be at the point of diminishing returns by trying to buy down vulnerability," the general observed. Instead, he added, "maybe it’s time to place more emphasis on coping with the consequences of a successful attack, and trying to develop networks that can "self-heal" or "self-limit“ the damages inflicted upon them. "
  • 34. Conclusions • Zero debt is not good business practice • SDLs enable debt discovery and repayment • A pure risk approach allows the mountain to grow • Outsourcing carries risk of larger latent debt • A mature model is to understand and plan payment • … while educating upstream • … while paying down the mountain • … while still using risk
  • 35. Thanks! Questions? UK Offices North American Offices Australian Offices Manchester - Head Office San Francisco Sydney Cheltenham Atlanta Edinburgh New York Leatherhead Seattle London Thame European Offices Amsterdam - Netherlands Ollie Whitehouse Munich – Germany Zurich - Switzerland ollie.whitehouse@nccgroup.com

Notas do Editor

  1. Based on the paper written by Ollie Whitehouse and James Vaughan:http://www.amazon.co.uk/Software-Security-Austerity-development-ebook/dp/B007H76ABC/ref=sr_1_1?ie=UTF8&qid=1330955744&sr=8-1
  2. Impact: What is the impact of the issue if exploited?Distribution: How widespread is the products use, and into which markets?Disclosure: How was the issue reported or discovered, and how well known is it?Likelihood of discovery: What is the potential for the issue to be discovered outside of the organisation’s control?Presence of mitigations: Are their any effective mitigations to reduce the impact if exploited?Complexity of exploitation: What factors and knowledge are required for successful exploitation?Access requirements for exploitation: Are there certain circumstances or criteria that have to be met (outside of the product) before an attack can be brought to bear?Customer expectation of security: How security aware are users of the product, and what is their typical risk profile or appetite?
  3. Motivation: The degree to which a threat agent is prepared to implement a threat.Capability: The degree to which a threat agent is able to implement a threat.Opportunity: The requirements of access to be in a position to exploit.Threat Agents: Used to denote an individual or group that can manifest a threat.
  4. Damage potential: How great is the damage if the vulnerability is exploited?Reproducibility: How easy is it to reproduce the attack?Exploitability: How easy is it to launch an attack?Affected users: As a rough percentage, how many users are affected?Discoverability: How easy is it to find the vulnerability?
  5. Base: The intrinsic and fundamental characteristics of a vulnerability that areconstant over time and user environments.Temporal: Characteristics of a vulnerability that change over time but notamong user environments.Environmental: The characteristics of a vulnerability that are relevant andunique to a particulaire user ’s environnent.
  6. Impact: What is the impact of the issue if exploited?Distribution: How widespread is the products use, and into which markets?Disclosure: How was the issue reported or discovered, and how well known is it?Likelihood of discovery: What is the potential for the issue to be discovered outside of the organisation’s control?Presence of mitigations: Are their any effective mitigations to reduce the impact if exploited?Complexity of exploitation: What factors and knowledge are required for successful exploitation?Access requirements for exploitation: Are there certain circumstances or criteria that have to be met (outside of the product) before an attack can be brought to bear?Customer expectation of security: How security aware are users of the product, and what is their typical risk profile or appetite?