{"id":299,"date":"2009-11-12T11:30:28","date_gmt":"2009-11-12T16:30:28","guid":{"rendered":"http:\/\/www.webadminblog.com\/?p=299"},"modified":"2009-11-12T16:15:55","modified_gmt":"2009-11-12T21:15:55","slug":"enterprise-application-securit","status":"publish","type":"post","link":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/12\/enterprise-application-securit\/","title":{"rendered":"Enterprise Application Security &#8211; GE&#8217;s Approach to Solving Root Cause"},"content":{"rendered":"<p>The first presentation of the day that I went to\u00a0 was by GE&#8217;s Darren Challey and was about GE&#8217;s application security program and how he took a holistic approach to securing the enterprise.\u00a0 My notes on this presentation are below:<\/p>\n<p>Why is AppSec so hard?<\/p>\n<ul>\n<li>AppSec changes rapidly (look at difference between 2004, 2007, and 2010 Top 10)<\/li>\n<li>Changing landscape\n<ul>\n<li>Increase skill and talen t pool of technically proficient individuals willing to break the law<\/li>\n<li>Growing volume of financially valuable data online<\/li>\n<li>Development of criminal markets (black markets) to facilitate conversion to money<\/li>\n<\/ul>\n<\/li>\n<li>&#8220;Attackers now have effective skills, something to steal, and a place to sell it&#8221;<\/li>\n<\/ul>\n<ul>\n<li>Application Security is a complete one-sided game<\/li>\n<li>Need to become an enabler (not a barrier)<\/li>\n<li>Must inject application security earlier through Guidance, Education, and Tools<\/li>\n<li>Must understand the development and deployment process and integrate rather than mandate<\/li>\n<li>NIST study on cost to repair defects when found at different stages of software development (http:\/\/www.nist.gov\/director\/prog-ofc\/report02-3.pdf)<\/li>\n<li>Solving the problem of the enterprise (Culture Change)<\/li>\n<li>Success factors<\/li>\n<li>Form a mission and strategy<\/li>\n<li>Develop policy (but not corporate &#8220;mandate&#8221;)<\/li>\n<li>Gain executive buy-in (cost \/ benefit \/ risk)<\/li>\n<li>Understand the magnitude of problem (metrics)<\/li>\n<li>Asset inventory and vulnerability management<\/li>\n<li>Develop standards (what should I do and when?)<\/li>\n<li>Establish a formal program (strong leadership)<\/li>\n<li>Focus on education and training materials<\/li>\n<li>Develop in-house expertise, services and &#8220;COE&#8221;<\/li>\n<li>Continuous improvement, measurement, KPI<\/li>\n<li>Communicate!<\/li>\n<li>Drive a culture change (shared need, WIIFM)<\/li>\n<li>Communicate expectations with vendors<\/li>\n<li>Implement incentives (and penalties)<\/li>\n<li>Digitize after the process is solid (tools)<\/li>\n<li>AppSec program mission &amp; structure<\/li>\n<li>AppSec program strategy<\/li>\n<li>Policy (guidance) -&gt; Standards (Guidance) -&gt; Training (Education) -&gt; Metrics (tools) -&gt; Security tools (tools) -&gt; Inventory &amp; tracking (tools) -&gt; Monitor &amp; Improve<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Guidance<\/strong><\/span><\/p>\n<ul>\n<li>&#8220;GE Application Security Working Group&#8221; (Talking to the businesses is critical!\u00a0 Meet every 2 weeks.)<\/li>\n<li>Secure Coding Guidelines<\/li>\n<li>Vulnerability Remediation Guide<\/li>\n<li>Secure Deployment<\/li>\n<li>Quick Reference Card<\/li>\n<li>Contractual Language<\/li>\n<li>Desk Calendars<\/li>\n<li>Metrics: AppSec calendars helped increase visitors to key Guidance materials\u00a0 (track hits to website docs when certain activities take place)<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Education<\/strong><\/span><\/p>\n<ul>\n<li>CBT1: Intro to AppSec at GE (60 min for any IT person) &#8211; why AppSec is important and what happens when you don&#8217;t do it<\/li>\n<li>CBT2: GE Best Practices for Secure Coding (90 min)<\/li>\n<li>CBT3: Attack Profiles &amp; Countermeasures (120 min for security people)<\/li>\n<li>Developer Awareness Assessment:\n<ul>\n<li>100&#8217;s of internally-developed questions<\/li>\n<li>Randomized questions, timed completion<\/li>\n<li>Vendors track their own resutls<\/li>\n<li>Allows tailoring of training\/awareness programs<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Tools<\/strong><\/span><\/p>\n<ul>\n<li>&#8211; COE AppSec assessment services<\/li>\n<li>Vendor framework &amp; Metrics<\/li>\n<li>Compliance handbook<\/li>\n<li>Common objects repository<\/li>\n<li>GE Enterprise Application Security<\/li>\n<li>Scanning and Monitoring tools<\/li>\n<li>Automation is the way to go (but the tools are not quite there yet)<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Metrics<\/strong><\/span><\/p>\n<ul>\n<li>Measure Vendor AppSec Performance (Avg % Critical\/High Vulnerabilities per Assessment vs % Assessments with Zero Critical\/High Vulnerabilities)<\/li>\n<li>Is it making a difference (map avg of critical\/high vulnerabilities per assessment)<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Forming a Center of Excellence<\/strong><\/span><\/p>\n<ul>\n<li>Combines the best available people, processes and tools<\/li>\n<li>Formal training &amp; defined roles (Comprehensive training program for all auditors to ensure skills are kept current and that auditors can provide more than one type of service)<\/li>\n<li>COE Team structure (tools, research, operations, stakeholder management, queue management, application security auditors<\/li>\n<li>Application Assessment Types (black\/grey box vs white box)<\/li>\n<li>Application assessment process (map of the workflow with &#8220;swim lanes&#8221; of who does each step)<\/li>\n<li>Measure number of vulnerabilities and severities<\/li>\n<li>Measure customer satisfaction (overall, ease of engagement, responsiveness)<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The first presentation of the day that I went to\u00a0 was by GE&#8217;s Darren Challey and was about GE&#8217;s application security program and how he took a holistic approach to securing the enterprise.\u00a0 My notes on this presentation are below: Why is AppSec so hard? AppSec changes rapidly (look at difference between 2004, 2007, and [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[307,28],"tags":[76,309,151,308,310,622,227],"class_list":["post-299","post","type-post","status-publish","format-standard","hentry","category-owasp-appsec-dc-2009","category-security","tag-application","tag-education","tag-enterprise","tag-ge","tag-metrics","tag-security","tag-tools"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pfI0c-4P","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/comments?post=299"}],"version-history":[{"count":4,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/299\/revisions"}],"predecessor-version":[{"id":318,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/299\/revisions\/318"}],"wp:attachment":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/media?parent=299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/categories?post=299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/tags?post=299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}