Grab the white paper for this presentation - http://bit.ly/1JJLO12 Stakeholders involved in the creation of the software within an organization have a vested interest in understanding and contributing to the process of building more secure software. Although roles can differ between company “headquarters” managers responsible for policy and software development teams in the field, a common set of fundamental practices can provide a starting point for process improvement. Those responsible for setting policy and held accountable for corporate IT governance are critical to successful software security initiatives. Those who are building software for internal consumers are driven by two major constraints – features and timelines. As a result, security is typically a secondary concern during software requirements development. To change the way large organizations build software, an enterprise-wide initiative is required. This is at its heart a reengineering of existing development processes. A set of common best practices that large organizations have used exists to make software security initiatives successful. At the most basic, these include taking a disciplined approach by characterizing the landscape, securing champions, defining standards and strategy, executing, and then sustaining the effort. These steps, tailored to your organization, will help ensure that your corporate-wide efforts to secure applications are as productive as possible. Nearly every successful software security initiative has included most of these common strategies.

1. 5 Steps to Drive Enterprise
Software Security Programs
John B. Dickson, CISSP | @johnbdickson

2. John’s Background
• Application Security Enthusiast
• Helps CSO’s and CISO’s with
Application Security Programs
• ISSA Distinguished Fellow
• Security Author and Speaker

3. Denim Group | Company Background
• Professional services firm that builds & secures
enterprise applications
• External application & network assessments
• Web, mobile, and cloud
• Software development lifecycle development (SDLC) consulting
• Secure development services:
• Secure .NET and Java application development & remediation
• Classroom secure developer training for PCI compliance
• Developed ThreadFix

4. Overview
• Phased approach
• WAFs and automated scanners are not enough
• Deeper process improvements for SDLC needed,
especially for business logic or authorization
vulnerabilities

5. Characterize the Landscape
• Compliance framework for organization
• Analyze and understand cultural norms
• Understand current SDLCs in place
• Identify artifacts of software security
• Recognize the gap between policy and
practice

6. Secure Champions
• Confirm executive support, frequently the
CIO
• Use an internal audit to validate necessity
• Discover internal champions
• Use lunch and learns to identify candidates

7. Define Strategy & Standards
• Identify the most vulnerable applications
• Rank applications from most to least critical
• Conduct assessment on critical applications
• Define standards for future improvement
• ½ day classroom overview
• Publish Top 10 coding standards
• Implement threat modeling

8. Execute the Initiative
• Empower champions
• Include them in the plan
• Use a wiki or blog to share tactics
• Tailor to your audience
• Set success metrics
• Remember to:
• Show quick wins
• Highlight positive behaviors

9. Sustain the Program
• Monitor regulatory environment changes
• Engage broad set of stakeholders
• Identify new tools to improve software
security
• Observe new risks within your organization
• SaaS
• Increased mobile use

10. Wrap Up
• Enterprise-wide initiative required for success
• Re-engineer the existing system
• Take a disciplined approach
• Follow the strategy, tailored to your organization

11. Questions and Answers
John B. Dickson, CISSP
@johnbdickson