{"id":299,"date":"2009-11-12T11:30:28","date_gmt":"2009-11-12T16:30:28","guid":{"rendered":"http:\/\/www.webadminblog.com\/?p=299"},"modified":"2009-11-12T16:15:55","modified_gmt":"2009-11-12T21:15:55","slug":"enterprise-application-securit","status":"publish","type":"post","link":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/12\/enterprise-application-securit\/","title":{"rendered":"Enterprise Application Security – GE’s Approach to Solving Root Cause"},"content":{"rendered":"
The first presentation of the day that I went to\u00a0 was by GE’s Darren Challey and was about GE’s application security program and how he took a holistic approach to securing the enterprise.\u00a0 My notes on this presentation are below:<\/p>\n
Why is AppSec so hard?<\/p>\n
\n
AppSec changes rapidly (look at difference between 2004, 2007, and 2010 Top 10)<\/li>\n
Changing landscape\n
\n
Increase skill and talen t pool of technically proficient individuals willing to break the law<\/li>\n
Growing volume of financially valuable data online<\/li>\n
Development of criminal markets (black markets) to facilitate conversion to money<\/li>\n<\/ul>\n<\/li>\n
“Attackers now have effective skills, something to steal, and a place to sell it”<\/li>\n<\/ul>\n
\n
Application Security is a complete one-sided game<\/li>\n
Need to become an enabler (not a barrier)<\/li>\n
Must inject application security earlier through Guidance, Education, and Tools<\/li>\n
Must understand the development and deployment process and integrate rather than mandate<\/li>\n
NIST study on cost to repair defects when found at different stages of software development (http:\/\/www.nist.gov\/director\/prog-ofc\/report02-3.pdf)<\/li>\n
Solving the problem of the enterprise (Culture Change)<\/li>\n
Success factors<\/li>\n
Form a mission and strategy<\/li>\n
Develop policy (but not corporate “mandate”)<\/li>\n
Gain executive buy-in (cost \/ benefit \/ risk)<\/li>\n
Understand the magnitude of problem (metrics)<\/li>\n
Asset inventory and vulnerability management<\/li>\n
Develop standards (what should I do and when?)<\/li>\n
Establish a formal program (strong leadership)<\/li>\n
Focus on education and training materials<\/li>\n
Develop in-house expertise, services and “COE”<\/li>\n
Continuous improvement, measurement, KPI<\/li>\n
Communicate!<\/li>\n
Drive a culture change (shared need, WIIFM)<\/li>\n
Communicate expectations with vendors<\/li>\n
Implement incentives (and penalties)<\/li>\n
Digitize after the process is solid (tools)<\/li>\n
“GE Application Security Working Group” (Talking to the businesses is critical!\u00a0 Meet every 2 weeks.)<\/li>\n
Secure Coding Guidelines<\/li>\n
Vulnerability Remediation Guide<\/li>\n
Secure Deployment<\/li>\n
Quick Reference Card<\/li>\n
Contractual Language<\/li>\n
Desk Calendars<\/li>\n
Metrics: AppSec calendars helped increase visitors to key Guidance materials\u00a0 (track hits to website docs when certain activities take place)<\/li>\n<\/ul>\n
Education<\/strong><\/span><\/p>\n
\n
CBT1: Intro to AppSec at GE (60 min for any IT person) – why AppSec is important and what happens when you don’t do it<\/li>\n
CBT2: GE Best Practices for Secure Coding (90 min)<\/li>\n
CBT3: Attack Profiles & Countermeasures (120 min for security people)<\/li>\n
Developer Awareness Assessment:\n
\n
100’s of internally-developed questions<\/li>\n
Randomized questions, timed completion<\/li>\n
Vendors track their own resutls<\/li>\n
Allows tailoring of training\/awareness programs<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Tools<\/strong><\/span><\/p>\n
\n
– COE AppSec assessment services<\/li>\n
Vendor framework & Metrics<\/li>\n
Compliance handbook<\/li>\n
Common objects repository<\/li>\n
GE Enterprise Application Security<\/li>\n
Scanning and Monitoring tools<\/li>\n
Automation is the way to go (but the tools are not quite there yet)<\/li>\n<\/ul>\n
Metrics<\/strong><\/span><\/p>\n
\n
Measure Vendor AppSec Performance (Avg % Critical\/High Vulnerabilities per Assessment vs % Assessments with Zero Critical\/High Vulnerabilities)<\/li>\n
Is it making a difference (map avg of critical\/high vulnerabilities per assessment)<\/li>\n<\/ul>\n
Forming a Center of Excellence<\/strong><\/span><\/p>\n
\n
Combines the best available people, processes and tools<\/li>\n
Formal training & defined roles (Comprehensive training program for all auditors to ensure skills are kept current and that auditors can provide more than one type of service)<\/li>\n
Application Assessment Types (black\/grey box vs white box)<\/li>\n
Application assessment process (map of the workflow with “swim lanes” of who does each step)<\/li>\n
Measure number of vulnerabilities and severities<\/li>\n
Measure customer satisfaction (overall, ease of engagement, responsiveness)<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
The first presentation of the day that I went to\u00a0 was by GE’s Darren Challey and was about GE’s application security program and how he took a holistic approach to securing the enterprise.\u00a0 My notes on this presentation are below: Why is AppSec so hard? AppSec changes rapidly (look at difference between 2004, 2007, and […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[307,28],"tags":[76,309,151,308,310,622,227],"class_list":["post-299","post","type-post","status-publish","format-standard","hentry","category-owasp-appsec-dc-2009","category-security","tag-application","tag-education","tag-enterprise","tag-ge","tag-metrics","tag-security","tag-tools"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t