Research

Over the last couple months I have had many similar conversations on enterprise application security: customers identify gaps in their security program, are unaware of the availability of certain types of solutions, or simply don’t believe that certain solutions deliver their advertised value. But I expect issues when speaking to a company who wants to implement advanced security on a Hadoop database, where technology simply may not exist to deliver the security and performance required. It is altogether different when talking about SAP or Oracle financials. These are mature platforms, often in place for more than a decade, so you would expect every aspect to be covered. Surprisingly that is often not the case. There are many reasons for these security gaps. Companies often invest in generic assessment or configuration analysis tools, which don’t actually provide an in-depth view of application configuration settings or best practices. Perhaps they were told their SIEM would collect all application logs but they don’t contain the necessary information to evaluate user actions, or they are simply too verbose to collect. The application vendors all provide lists of security best practices, but don’t list anything they do not sell, nor advise customers to uninstall unneeded components to reduce attack surface. Security teams know little about how application platforms work so they cannot independently identify which deployment models would work, and IT staff is not likely to volunteer suggestions that will require them to do more work. Finally, the largest issue is that many approaches are simply unsuitable for large enterprise applications because they will break the application, limit usability, or degrade performance, none of which are acceptable. These issues contribute to security and compliance gaps at most firms. Supply chain management, customer relationship management, enterprise resource management, business analytics, and financial transaction management, are all multi-billion dollar application platforms unto themselves. We are beyond explaining why enterprise applications need security to protect these investments – it is well established that insiders and persistent adversaries target these applications. Companies invest heavily in these applications, hardware to run them, and teams to keep them up and running. They perform extensive risk analysis on their business implications and the costs of downtime. And in many cases their security investments are a byproduct of these risk profiles. Application security trends in the 1-2% range of total application investment, but I cannot say large enterprises don’t take security seriously – they spend millions and hire dedicate staff to protect these platforms. That said, their investments are not always optimal – enterprises may bet on solutions with limited effectiveness, without a complete understanding of the available options. It is time for a fresh look. To fill some of these gaps we are starting a new series on Building an Enterprise Application Security program. We spend a lot of time on advanced technologies on the Securosis blog: variants of monitoring, auditing, assessment, threat management, application security, and so on – but we have never pulled all these facets together for companies to assemble into an enterprise application security program. Or goal is to discuss specific security and compliance use cases for large enterprise applications, highlight gaps, and explain some application-specific tools to address these issues. This will not be an exhaustive examination of enterprise application security controls, nor an examination of generic security platforms – instead we will offer a focused summary of the most common deficiencies, with suggestions for what to do about them. The remainder of this series will cover the following: Needs: Use Cases Compliance (SOX, PCI, etc.) and internal audit reporting Transaction verification Use of sensitive information Security (insider and external threats) Change management & policy enforcement Gaps: What Works and What Doesn’t Why enterprise applications are different SAP: special issues with this poster child for enterprise applications Security and compliance gaps with IAM, encryption, and data encryption Inventory, discovery, and assessment Network monitoring deficiencies Conventional application and database layer protection Skills and priorities Program Elements Assessment: discovery and configuration analysis Patching and configuration management (environment, application, database, & modules) Application and database monitoring Management frameworks and policy enforcement Logging, auditing, and compliance reports Additional recommendations Our next post will discuss use cases and problems firms need to address, which we will use to frame our subsequent discussion of security gaps. Share:

Lots of folks talk lovingly about their first computers. Mine was a Timex Sinclair I ran through my 10” black-and-white TV. But that wasn’t the first computer I played with. My Dad was pretty early into the word processing world as part of his law practice. So when we went to the computer show down in NYC and checked out all the new wares, I was like a kid in a candy store. When he lugged home the Kaypro II, I thought it was the coolest thing ever. And evidently a significant productivity enhancer, especially hooked up to that old daisy wheel printer. You remember those, right? So when I saw Throwback Thursday: Kaypro II Stole My Heart on InformationWeek, it was a nostalgic moment. The Kaypro II, released in 1982, featured two 5¼-inch double-density floppy-disk drives, 64 KB of RAM, and ran Digital Research’s CP/M operating system. Weighing in at 29 pounds, it and other PCs like it were dubbed transportables or, more cheekily, luggables. Luggable LOL. Though I do remember my Dad lugging the Kaypro between his condo and the office, so I guess it was transportable. And mention of the 9” green (monochrome) CRT made me smile as well. Of course my kids will have no grasp of what the early days of personal computing were really like. They are bitching about their old iPod touches that won’t run iOS 8. And they are right – technology is moving so fast that a 5-year-old device is severely limited. But old folks (or at least survivors of that early computer age) like me remember. And we laugh. Because the progress we have seen over the past 30 years is really incredible. Yet it’s only beginning. I cannot even imagine what things will look like in another 30 years. Photo credit: “untitled” originally uploaded by Marcin Wichary Share:

Rich here. Last night I arrived home around 11pm from the totally awesome SecTor conference in Toronto. It took about 11 hours to wend my way home through the air system, which has a certain beauty. Yeah, I took it to 11. Before that I was home for a couple days, during one of which we took the kids to the local aquarium-in-the-outlet-mall to meet the Octonauts. Yes, we have one of those. Yes, if your kids are of a certain age, they know the Octonauts. And yes, the Octonauts have a totally awesome Star Trek TOS vibe, and I weirdly learn cool stuff – like how freaky vampire squids are – from watching it. I won’t link – I want you to have the pleasure of searching for “vampire squid” and then not sleeping. Before that I was in Amsterdam for 5 days. With my wife but without kids. I spent two of those days teaching the cloud security class for Black Hat, and the two free days touring around with her. Amsterdam reminds me of New Orleans in spots, which means it’s fun, and then it’s smelly. I have never been into the hedonistic stuff but I love cool historical cities. Especially without the kids. Assuming they have beer. Before that is a blur; it probably involved airplanes. Next week I head to Houston for Camp DevOps. I really like those events – so much so that I will spend 6 hours on a plane for what is normally an under-2-hour flight. One problem with traveling so much is that I struggle to find time to set up the next trip, so I got hammered with insane prices. I am unwilling to spend over $1K to fly from Phoenix to Houston, so I got a middle seat on Delta, routed through Salt Lake and Atlanta. Yay team. After that, I can’t talk about it, but the week after that is Amazon re:Invent. I’m not speaking there, but even if you use other cloud providers re:Invent is a must-attend event. Okay, it helps if you use AWS, but still, there is a ton of great info, some of it generalized. So there you have it. I am wicked jetlagged from too many time zones in too short a time, but when you work for yourself you can’t gripe too much about being busy. And, you know, 5 days in Amsterdam with my wife & my kids, so I should really just shut up and not complain. On a different note, you may have noticed some weirdness with our site recently. We had a conflict between our super-secure hosting architecture and an underlying component update we couldn’t totally nail down. It got so bad we moved to a slightly-less-secure host temporarily, which fixed the problem. I am actually rearchitecting the entire deployment (with our developer contractors) to take advantage of all the cloud security and DevOps research I have been working on, but that move will take a little time. We apologize sincerely, and at some point I will provide a more detailed writeup. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences eWeek covered Rich’s talk on DevOps at SecTor. Their writeup was great and really captured the core of the talk. eSecurity Planet covered the SecTor Fail Panel. That one also had Mr. Lewis and Mr. Arlen. Rich wrote up Spotlight Suggestions privacy for TidBITS. I guess this is why I didn’t post much on our own site. Need to work on that. Favorite Securosis Posts Adrian: Running Man. Mike. Running. Running distance !?! I … {head explode}. Rich: I guess I need to kneecap Mike. He’s stealing my thunder. I’ve done some half marathons, and no f###### way I will let him beat me to doing a marathon. Other Securosis Posts Hindsight is 20/20. Favorite Outside Posts Adrian: NSA Tech Director Explains Snowden Docs. I don’t know when this was published but it’s fascinating. I usually suspect disinformation attempts but this seems genuine. Mike: 6 Buddhist Principles That Will Help You Be A Better Boss. Yeah, I’m pimping some more mindfulness stuff. But these are good things to think about, regardless of how much time you spend being mindful… Research Reports and Presentations Leveraging Threat Intelligence in Incident Response/Management. Pragmatic WAF Management: Giving Web Apps a Fighting Chance. The Security Pro’s Guide to Cloud File Storage and Collaboration. The 2015 Endpoint and Mobile Security Buyer’s Guide. Analysis of the 2014 Open Source Development and Application Security Survey. Defending Against Network-based Distributed Denial of Service Attacks. Reducing Attack Surface with Application Control. Leveraging Threat Intelligence in Security Monitoring. The Future of Security: The Trends and Technologies Transforming Security. Security Analytics with Big Data. Top News and Posts Updated Windows FTDI Drivers bricking chips Schneier on Crypto Wars II. Google Launches 2FA as part of FIDO Alliance NAT-PMP vuln puts 1.2 million routers at risk. Share:

There were always reasons I wasn’t a runner. I was too big and carried too much weight. I was prone to knee pain. I never had good endurance. I remember the struggle when I had to run 3 miles as a pledge back in college. I finished, but I was probably 10 minutes behind everyone else. Running just wasn’t for me. So I focused on other methods of exercise. I lifted weights until my joints let me know that wasn’t a very good idea. Then I spent a couple years doing too many 12-ounce curls and eating too many burritos. For the past few years I have been doing yoga and some other body weight training. But it was getting stale. I needed to shake things up a bit. So I figured I’d try running. I had no idea how it would go, given all my preconceived expectations that I couldn’t be a runner. I mentioned it to a friend and he suggested I start with a run/walk program espoused by Jeff Galloway. I got his 5K app and figured I’d work up to that distance over the summer. I started slowly during my beach vacation. Run 2 minutes, walk 1 minute. Then I ran 3 minutes, etc. Before I knew it, I had worked up to 3 miles. At some point my feet started hurting. I knew it was time to jettison my 5-year-old running shoes and get a real pair. I actually went to the running store with the boy and got fitted for shoes. It made a world of difference. I was running 3 days a week and doing yoga another 3 days. I was digging it. Though over the summer it wasn’t that hard. I’d get out early before it got too hot and just run. After conquering the 5K I figured I’d work up to a 10K, so I started another training program to build up to that distance. I made it to the 6-mile mark without a lot of fuss. Even better, I found myself in cool places for work and I’d run there. It’s pretty okay to start the day with a run along Boulder Creek or the Embarcadero. Life could be worse. I was routinely blowing past the suggested distance in the 10K program. I banged out almost 7 miles on one run and wasn’t totally spent. That’s when it hit me. Holy crap, I’m a runner. So I decided to run a half marathon in March. I figured that was plenty of time to get ready and a couple buddies committed to run with me. I did 8 miles and then 10 miles. Just to see if I could, and I could. Then I thought, what the hell am I waiting for? My sister-in-law is running a half in early November and she is just working up to 10 miles. I signed up to run a half this Thanksgiving. I even paid $15 for the race t-shirt (it’s a free race, so the shirt was extra). That’s in about a month and I’ll be ready. If there is one thing I have learned from this, it’s that who I was doesn’t dictate what I can accomplish. I can overcome my own perceptions and do lots of things I didn’t think I could, including running. –Mike Photo credit: “Day 89 – After the Run” originally uploaded by slgckgc The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Security and Privacy on the Encrypted Network The Future is Encrypted Secure Agile Development Deployment Pipelines and DevOps Building a Security Tool Chain Process Adjustments Working with Development Agile and Agile Trends Introduction Trends in Data Centric Security Deployment Models Tools Introduction Use Cases Newly Published Papers The Security Pro’s Guide to Cloud File Storage and Collaboration The 2015 Endpoint and Mobile Security Buyer’s Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Incite 4 U Attitude > technical chops: It seems every day someone bitches to me about the difficulty in finding good people to staff the security function. Thom Langford thinks a lot of folks are looking in the wrong places, and that good potential security folks may already be in your organization – just not doing security. Thom added an executive assistant to the security team and it has worked out well for him because of her attitude and understanding of how to get things done within the organization. “Technology and hard skills are things that can be taught in relatively short periods of time; attitude is something that takes a lot longer to learn, decades even.” Actually, a lot of

It won’t happen to you, right? After every breach you see all sorts of former employees and others crawl out from under their various rocks to talk about how screwed-up their former employer was. And how the breach was inevitable. It is a bit comical at this point. The latest example is a bunch of former Home Depot employees talking about their old shop. Yet five former staffers describe a work environment in which employee turnover, outdated software, and a stated preference for “C-level security” (as opposed to A-level or B-level) hampered the team’s effectiveness. Well, here is BREAKING news. Every big company is screwed up in some way. Every company – big or small – needs to make tough choices. Some companies consistently choose wrong. Others do a good job of making those decisions – or they get lucky, it doesn’t really matter. But the truth remains: they will all get breached… sooner or later. In the aftermath of a breach – or really any mistake – there are always things that could have been done differently. But most security folks need to toe the corporate line, which may be to deal with mediocre security. Job #1 is often not to disrupt business operations. As a security person such directives may make you sick. And if your shop consistently makes decisions like this, maybe you should work somewhere else. That’s always a choice. And sooner or later (likely sooner), you will get called by journalists looking for dirt. Then you can say you told them so and they didn’t listen. Good for you. Photo credit: “Black and white hindsight” originally uploaded by Tim J Keegan Share:

This is off topic, but this post from Daniel Miessler is a great example of how I want to reorient my world view. Basically, I’ve done most things I could have wanted to do in a life already. This doesn’t mean that I don’t have more to do. It doesn’t mean I don’t still have goals, because I do. What it means is that if things were to end suddenly tomorrow, and I had even the shortest time to reflect, I would smile knowing that there wasn’t some other big thing I needed to be happy. I already am happy. Anything past this point is just greedy. I’ve already lived a remarkable life, and now I want another 50 years of it? Seems rather selfish when you think about it. That is real gratitude. From where I sit, I still feel I have a lot to contribute and so much more to learn. And I’m not one to call my life to date ‘remarkable’, but I have done some cool stuff. I’m with Daniel – I don’t want to be greedy. This kind of gratitude is hard for a lot of us, as culture has us striving to move on to the next hill – before we are over the current one. In the rush to always get something else done, I find it helpful to sometimes just sit and appreciate where I have already been. That helps me get excited for whatever is to come. Both the positives and the negatives. Everything is a learning experience. Today I’m grateful for the opportunity to keep learning. Photo credit: “Gratitude changes the way we look at the world” originally uploaded by BK Share:

A few years ago I had to stop competing. The constant need to win – whatever that even meant – was making me unhappy. Even when things were going well, I found some reason to feel like a loser. So I got off the hamster wheel and put myself in positions where I wasn’t really competing against others. I am always trying to improve, but I stopped doing that in terms of others. Set a goal. Work toward it. Adjust as needed. The only time I even sort of compete now is my annual golf trip. Except for four rounds that weekend, I don’t play golf. It’s not that I don’t enjoy the game, but it just takes too much time. So every year 9-11 buddies and I go to a nice resort town and play a tournament Ryder Cup style. There is a draft and this year we used Potato Head dolls to represent the players. Mine was a riot, as you can see in the picture below. The captains negotiate handicaps and set the line-ups, and we play. The winners make some beer money and the losers… well, there aren’t actually any losers – we are hanging with buddies on a ridiculous beachfront property and playing golf every day. Since I’m not a good golfer, I am usually the high handicapper. But it’s not like that helps me much. At multiple points over four days, my game falls apart. I typically shoot between 120 and 130, usually losing the match. Except there are no losers, right? But this year was different. I missed last year’s trip so I hadn’t picked up my clubs in 2 years. I went to the new TopGolf near my house the day before the trip to hit some balls, and I was hitting solid and straight. But I entered the weekend with zero expectations about playing decent golf. Without those expectations I was calm on the course. I just enjoyed being outside in a beautiful place. I had a few beers. OK, maybe more than a few. I kept my ego in the bag and swung nice and easy – even as some of the gorillas in my group hit 50-60 yards past me. I shot pretty well the first day (111) and with my handicap we smoked the other team. Huh. The next day I was playing a heads-up match. I shot a 101 and closed out my opponent on the 13th hole, which is apparently pretty good. Strange. My game didn’t fall apart. What’s going on here? By this time I had a pretty sizable lead in the overall. The other guys on the trip started talking about how evidently I’m a golfer and wondering if I had secretly taken a crapload of lessons. Then I actually believed maybe I was a golfer, and I wanted to win. I started feeling bad when I hit a bad shot. Predictably my game fell apart and I shot 61 on the front. Then I remembered that I don’t need to win, I just want to be credible. That is the key. It’s about not getting attached to the outcome and just having fun instead. So that’s what I did. Suffice it to say I shot 44 on the back and had a grand old time. I finished up Sunday with a 117 and took home the overall. That means I will be one of the captains next year – a place I never thought I’d be. I lost the final day match, but my team won the cup as well. So I won by not needing to win. What was the difference? Without sounding corny, it’s all the mindfulness work I’m doing. I used body awareness and scanned my body for tension points before every swing to make sure I was relaxed. I visualized a good shot, not skulling the ball into the water hazard. I recognized that my increasing desire to win was causing tension, which resulted in bad shots. I had a short memory, so when I hit a bad shot I’d just let it go. Then I’d hit a good shot. Or not. I’d look up at the sky and be grateful that I was on the course. Then drink another beer. At some point during the trip I made the connection. Golf is mostly a mental game, as is most of life. The work I’m doing to be more mindful translates directly – even to my golf trip. Controlling my own self-imposed expectations and decreasing the pressure I put on myself allowed me to compete without stressing out. Being able to maintain that for four days was a real victory. Winning the golf trophy is besides the point. At least for me… –Mike Photo credit: Incite Potato Head uploaded by MSR The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS,

Ever tried to count to a billion? Don’t bother. The average human lifespan is about 2.5 billion seconds, so you’d waste half your life trying. But that may help put into perspective Databrick’s latest announcement that they were able to sort 10 trillion records in four hours with the Spark platform. That’s three times faster than the previous record, with one-tenth the number of server nodes. Or perhaps you noticed that Amazon added full JSON support to DynamoDB, so you can easily inject JSON directly into the cluster. Or maybe you saw that Data Torrent now supports analytics on the incoming data stream. Or perhaps you were pleased to see ParStream’s distributed approach specifically geared to the Internet of Things. None of these individual events is all that newsworthy. But the scale and pace of innovation across hundreds of different NoSQL platforms is. I hAve said many times here that NoSQL is the database of the future, but I don’t think I have stressed enough that no matter what you want to do with a database, there is a flavor of NoSQL designed for your use case. And even if it’s not a perfect match, the flexibility and customization possible with most NoSQL platforms can make it work. Size, scale, and speed – at cost unimaginable just a few years ago. What does this have to do with security? I no longer speak to customers with a single Hadoop installation of 20 or so nodes. The number of nodes is climbing, and the number of NoSQL databases running in parallel at customer sites is climbing as well. The size of these clusters is beginning to break our security recommendations from the last few years. In some cases security goals require an architectural shift. In other cases I am at a loss to provide recommendations – I am not certain that security controls exist to accommodate the size and velocity of some clusters. Hang on to your seats because it is getting interesting in the world of NoSQL security. Butterflies. Not that you care, but there are a lot of butterflies in Phoenix this year. And my wife and I have planted a huge number of shrubs that attract butterflies, so we are fortunate to have swarms of them in the yard the last three weeks. Yellow ones, green ones, black with patches of amber and brilliant blue dots, giant black and yellow ones, some orange, and others orange with black spots. Dozens or even hundreds of them in the back yard on any given day. Colors that match New England fall leaves, but this is living art with a delicacy hard to imagine until you see them defying the breeze. It is one of the most beautiful sites I have ever seen. If only I could capture it on video … On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Rich in TidBITS #1: You Are Apple’s Greatest Security Challenge. Rich in TidBITS #2: Apple and Google Spark Civil Rights Debate. Favorite Securosis Posts David Mortman: An Example of Gratitude. Adrian Lane: The photo in Mike’s post on Competing made coffee spurt through my nose, I laughed so hard, but my favorite this week is Rich’s post on Physicality because he totally nails my experience and tribulations with writing! Other Securosis Posts Incite 10/15/2014: Competing. Favorite Outside Posts Rich: Rethinking the Security “Con”. Great rant by Shack about security conferences. There are too many, saying the same stuff. I like his suggestions toward the end, especially having everyone share 5 things they learned. That would be awesome. Mike Rothman: Before the Startup. With so much money flowing into everything ‘cyber’ we have lots of folks who want to start companies. They should read this post. It is a different counterintuitive world. It’s like riding a roller coaster. Every day. That doesn’t mean don’t do it, but go in with your eyes open. David Mortman: Homebrew Incident Response. Adrian Lane: Wake up to a POODLE puddle. Kudos to Martin for coming up with a list of links of everything you need to know about POODLE attacks, and my favorite vulnerability logo for this issue! Research Reports and Presentations Leveraging Threat Intelligence in Incident Response/Management. Pragmatic WAF Management: Giving Web Apps a Fighting Chance. The Security Pro’s Guide to Cloud File Storage and Collaboration. The 2015 Endpoint and Mobile Security Buyer’s Guide. Analysis of the 2014 Open Source Development and Application Security Survey. Defending Against Network-based Distributed Denial of Service Attacks. Reducing Attack Surface with Application Control. Leveraging Threat Intelligence in Security Monitoring. The Future of Security: The Trends and Technologies Transforming Security. Security Analytics with Big Data. Top News and Posts Alleged Dropbox hack underlines danger of reusing passwords Laura Poitras on the Crypto Tools That Made Her Microsoft, Adobe Push Critical Security Fixes Government Set Up A Fake Facebook Page In This Woman’s Name What you need to know about POODLE/SSL 3.0 vulnerability Apple Pay Setup, Functionality Leaked in New Screenshots Blog Comment of the Week This week’s best comment goes to Anonymous, saying something about buying Viagra on the cheap. That’s great news – it means blog comments are working again. Thanks for testing, spammers! Share:

Writing is an oddly physical act. Technically you are just sitting there, clanking away on the keyboard, while your bottom loses circulation and gets sore. (Maybe I need a new chair.) But keeping your brain running at the right tempo for effective writing involves a complicated dance of nutrition, sleep, physical movement, and environmental management. The past few days I have been cranking through some projects, writing one or two major pieces a day. While sometimes the words flow, this run was more the molasses sort. I never seemed to maintain the right combination of sleep, caffeine, food, and activity to hammer through the content effectively. But deadlines are deadlines so I pushed through as best I could. Take today, for example. I felt better than any other morning this week, so I ran to a coffee shop and carefully managed my food-to-caffeine ration in an effort to maintain a productivity-enhancing caffeine buzz. Too much and I can’t focus. Too little and I… can’t focus. I did manage to keep it going for a few hours and finished one deliverable, but then it was time for lunch. If I didn’t eat I’d crash. But I knew once I did, I’d crash in a different way. Lose/lose situation. So I ate, then had more coffee, then wasted an hour before I could write again. But at that point it was mid-afternoon, when I tend to be at my worst. Normally I’d go work out to clear the head, but that wasn’t an option. So I muscled through. As a result, my 600-800 word piece is now clocking in at 1,800 words, and I cannot figure out whether it’s better than what I mapped out in my head last night. I knew I should have written it right then and there. And 1,800 words takes a certain amount of time, no matter how fast your write. Leaving me at 6pm to write this summary sitting on the floor, watching Peppa Pig with my two youngest kids, barely able to hold my head up, but knowing that if I don’t go for a run when my wife gets home I won’t sleep well tonight, and will be even less productive tomorrow. Yes, there are worse work-related problems out there. I have held far more outwardly physical jobs, some putting me at great physical risk. But never doubt that writing isn’t physical. And unlike rescue or manual labor, you don’t get to release any of the stress through movement. I am not thrilled with most of what I wrote this week. I’m hoping that’s just my usual self-criticism, but nothing really came out as I intended, and that is a direct result of being unable to properly manage my physical state to optimize my focus. Sounds stilly, but in the end I might have blown an article because a cat decided to sleep on my face the other night. In unrelated news, the rest of the Securosis team is completely out this week, so the rest of this summary is slimmed down. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Adrian will be presenting Pragmatic WAF Management October 15. Favorite Securosis Posts Adrian Lane: Deployment Pipelines and DevOps. Rich does a great job tying the series together and showing how and where DevOps is making development and security more Agile. Other Securosis Posts Firestarter: Hulk bash. Like I said: everyone is out. Favorite Outside Posts A special note first – Brian Krebs is releasing his book, Spam Nation. I haven’t read it, but I guarantee you it will be good. Brian knows more than anyone about the computer underground. Well, more than anyone who can talk about it without getting shot. I mean, he probably won’t get shot. Er, I hope he doesn’t get shot. Adrian Lane: A State of Xen – Chaos Monkey & Cassandra. Keeping a 2,600-node Cassandra cluster up and running is hard. Keeping it fully functional while 10% of the cluster is rebooted is fracking astounding! Chaos Monkey is one of the few truly Rugged approaches to software development I have seen. Rich: Have most analysts completely given up doing “research”? An interesting take, especially because Securosis is quite profitable, and doesn’t do a single thing they talk about. Then again I’m not sure you could scale us. Research Reports and Presentations Leveraging Threat Intelligence in Incident Response/Management. Pragmatic WAF Management: Giving Web Apps a Fighting Chance. The Security Pro’s Guide to Cloud File Storage and Collaboration. The 2015 Endpoint and Mobile Security Buyer’s Guide. Analysis of the 2014 Open Source Development and Application Security Survey. Defending Against Network-based Distributed Denial of Service Attacks. Reducing Attack Surface with Application Control. Leveraging Threat Intelligence in Security Monitoring. The Future of Security: The Trends and Technologies Transforming Security. Security Analytics with Big Data. Top News and Posts The Horror of a ‘Secure Golden Key’. Hackers’ Attack Cracked 10 Financial Firms in Major Assault BadUSB ‘Patch’ Skirts More Effective Options Share:

Our last post reviewed key tools to conduct security tests in the development process, and before that we discussed big picture process adjustments to accommodate security testing, but didn’t fully how to integrate. Agile itself is in the middle of a major disruptive evolution, transforming into a new variant called DevOps, bringing significant long-term implications which are beneficial to security. The evolution of development security and Agile are closely tied together, so we can start by specifying how to integrate into the deployment pipeline, then discuss the implications of DevOps. Understanding the Deployment Pipeline The best way to integrate security testing into the development process is by integrating with the deployment pipeline. This is the series of tools an organization uses to take developed code from the brain of a developer into the hands of a customer. While products vary greatly, the toolchains themselves are relatively consistent, although not all organizations use all components. Integrated Development Environment (IDE): The IDE is where developers write code. It typically consists of a source code editor (a text editor), a compiler or an interpreter, a debugger, and other tools to help the programmer write code and build applications (such as a user interface editor, code snippet library, version control browser, etc.). Issue Tracker: A tracker is basically a project management tool designed to integrate directly into the development process. User stories are entered directly, broken down into features, and broken down again then specific developer tasks/assignments. Detected bugs also go into the issue tracker. This is the central tool for tracking the status of the development project – from earliest concepts, to updates, to production bugs. Version Control System/Source Code Management: Managing constantly changing code for even a small application is challenging. Source code is mostly a bunch of text files. And we mean a lot of files, which may be worked on by teams of tens, hundreds, or thousands of developers. The version control system/source code management tool keeps track of all changes and handles checkout, checkin, branching, forking, and otherwise keeping the code consistent and manageable. Whichever tool is used, this is typically referred to as the source code repository, or repo for short. Build Automation: Automation tools convert the text of source code into compiled applications. Most modern applications include many components which need to be compiled, integrated, and linked in the correct order. A build automation tool handles both simple and complex scenarios, according to scripts created by developers. Continuous Integration (CI) Server: A CI server is the next iteration of build automation. It connects to the source code repository and, based on rules, automatically integrates and compiles code as it is committed. Rather than manually running a build automation tool, the CI server grabs code, creates a build, and runs automated testing automatically when triggered – such as when a developer commits code from an IDE. CI servers can also automate the deployment process, pushing updated code onto production systems. There are an unlimited range of possible deployment pipelines, and the pipeline is often actually a series of manual processes. But the broad steps are: The product owner enters requirements for a feature into the issue tracker. The product owner or someone else on the development team (such as the program manager) breaks the user story and features down into a set of developer assignments, which are then added to the backlog. The program manager assigns specific tasks to developers. A developer checks out the latest code, writes/edits in an IDE, tests and debugs locally, and then commits it to the source code repository using the version control system. The developer might for existing for independent development and testing, depending on the nature of the feature. The build automation tool compiles the code into the main application and may perform automated testing. The compiled product is then sent to QA/testing and eventually to operations to push into production. If something breaks, that is marked as a bug in the issue tracker. If the organization uses continuous integration the code will be automatically compiled, integrated, and tested using the CI server. It may be pushed into deployment or handed off for additional manual testing, such as user acceptance testing. Again, if something breaks that becomes a bug in the issue tracker, probably automatically. Not every organization follows even this general process, but just about everyone running Agile uses some variation of it. Integrating Security If you map our security toolchain to the deployment pipeline there are clear opportunities for integration. The ones we most commonly see are: Security manages security issues and bugs in the issue tracker. Security features are often entered as user stories or feature requirements, in cooperation with the product owner or program manager. Security sensitive bugs are tagged as security issues. In some cases security teams monitor the issue tracker to help identify potential vulnerabilities that might have been entered as simple bug reports. Static analysis is integrated in the IDE, build automation tool, or CI server. Sometimes all of the above. For example when a developer commits code locally it can undergo static analysis, with issues highlighted back in the IDE for easy identification and remediation. Static analysis may also be triggered when code is committed to the source code repository. Dynamic analysis is also typically integrated at the build automation or CI server, using tests defined by security. Other security tests, such as unit, component, and regression testing, are also often best integrated at the build or CI server. Vulnerability analysis may be automated if the organization uses a CI server, but otherwise is often a manual or periodic process. Any problems discovered by the testing tools generate entries in the issue tracker, just like any other bugs. Ideally security needs to sign off on any unremediated security bugs before release. Security and DevOps There is no single definition of DevOps, but essentially it means deeper integration of development and operations in the software deployment process. A better way to phrase it is