book

Agile Application Security

by Laura Bell, Michael Brunton-Spall, Rich Smith, Jim Bird

September 2017

Intermediate to advanced

386 pages

11h

English

O'Reilly Media, Inc.

Read now

Unlock full access

Preface
Who Should Read This BookThe Agile PractitionerThe Security PractitionerThe Agile Security PractitionerNavigating This BookPart 1: FundamentalsPart 2: Agile and SecurityPart 3: Pulling It All TogetherConventions Used in This BookO’Reilly SafariHow to Contact UsAcknowledgments
1. Getting Started with Security
This Isn’t Just a Technology ProblemNot Just for GeeksSecurity Is About RiskVulnerability: Likelihood and ImpactWe Are All VulnerableNot Impossible, Just ImprobableMeasuring the CostRisk Can Be Minimized, Not AvoidedAn Imperfect World Means Hard DecisionsThreat Actors and Knowing Your EnemyThere Is an Attacker for EveryoneMotivation, Resources, AccessSecurity Values: Protecting Our Data, Systems, and PeopleKnow What You Are Trying to ProtectConfidentiality, Integrity, and AvailabilityNonrepudiationCompliance, Regulation, and Security StandardsCommon Security Misconceptions or MistakesSecurity Is AbsoluteSecurity Is a Point That Can Be ReachedSecurity Is StaticSecurity Requires Special [Insert Item/Device/Budget]Let’s Get Started
2. Agile Enablers
Build PipelineAutomated TestingContinuous IntegrationInfrastructure as CodeRelease ManagementVisible TrackingCentralized FeedbackThe Only Good Code Is Deployed CodeOperating Safely and at Speed
3. Welcome to the Agile Revolution
Agile: A Potted LandscapeScrum, the Most Popular of Agile MethodologiesSprints and BacklogsStand-upsScrum Feedback LoopsExtreme ProgrammingThe Planning GameThe On-Site CustomerPair ProgrammingTest-Driven DevelopmentShared Design MetaphorKanbanKanban Board: Make Work VisibleConstant FeedbackContinuous ImprovementLeanAgile Methods in GeneralWhat About DevOps?Agile and Security
4. Working with Your Existing Agile Life Cycle
Traditional Application Security ModelsPer-Iteration RitualsTools Embedded in the Life CyclePre-Iteration InvolvementTooling for Planning and DiscoveryPost-Iteration InvolvementTools to Enable the TeamCompliance and Audit ToolsSetting Secure BaselinesWhat About When You Scale?Building Security Teams That EnableBuilding Tools That People Will UseDocumenting Security TechniquesKey Takeaways
5. Security and Requirements
Dealing with Security in RequirementsAgile Requirements: Telling StoriesWhat Do Stories Look Like?Conditions of SatisfactionTracking and Managing Stories: The BacklogDealing with BugsGetting Security into RequirementsSecurity StoriesPrivacy, Fraud, Compliance, and EncryptionSAFECode Security StoriesSecurity Personas and Anti-PersonasAttacker Stories: Put Your Black Hat OnWriting Attacker StoriesAttack TreesBuilding an Attack TreeMaintaining and Using Attack TreesInfrastructure and Operations RequirementsKey Takeaways
6. Agile Vulnerability Management
Vulnerability Scanning and PatchingFirst, Understand What You Need to ScanThen Decide How to Scan and How OftenTracking VulnerabilitiesManaging VulnerabilitiesDealing with Critical VulnerabilitiesSecuring Your Software Supply ChainVulnerabilities in ContainersFewer, Better SuppliersHow to Fix Vulnerabilities in an Agile WayTest-Driven SecurityZero Bug ToleranceCollective Code OwnershipSecurity Sprints, Hardening Sprints, and Hack DaysTaking On and Paying Down Security DebtKey Takeaways
7. Risk for Agile Teams
Security Says, NoUnderstanding Risks and Risk ManagementRisks and ThreatsDealing with RiskMaking Risks VisibleAccepting and Transferring RisksChanging Contexts for RisksRisk Management in Agile and DevOpsSpeed of DeliveryIncremental Design and RefactoringSelf-Organized, Autonomous TeamsAutomationAgile Risk MitigationHandling Security Risks in Agile and DevOpsKey Takeaways
8. Threat Assessments and Understanding Attacks
Understanding Threats: Paranoia and RealityUnderstanding Threat ActorsThreat Actor ArchetypesThreats and Attack TargetsThreat IntelligenceThreat AssessmentYour System’s Attack SurfaceMapping Your Application Attack SurfaceManaging Your Application Attack SurfaceAgile Threat ModelingUnderstanding Trust and Trust BoundariesBuilding Your Threat Model“Good Enough” Is Good EnoughThinking Like an AttackerSTRIDE: A Structured Model to Understand AttackersIncremental Threat Modeling and Risk AssessmentsAssess Risks Up FrontReview Threats as the Design ChangesGetting Value Out of Threat ModelingCommon Attack VectorsKey Takeaways
9. Building Secure and Usable Systems
Design to Resist CompromiseSecurity Versus UsabilityTechnical ControlsDeterrent ControlsResistive ControlsProtective ControlsDetective ControlsCompensating ControlsSecurity ArchitecturePerimeterless SecurityAssume CompromisedComplexity and SecurityKey Takeaways

10. Code Review for Security
Why Do We Need to Review Code?Types of Code ReviewsFormal InspectionsRubber Ducking or Desk CheckingPair Programming (and Mob Programming)Peer Code ReviewsCode AuditsAutomated Code ReviewsWhat Kind of Review Approach Works Best for Your Team?When Should You Review Code?Before Code Changes Are CommittedGated Checks Before ReleasePostmortem and InvestigationHow to Review CodeTake Advantage of Coding GuidelinesUsing Code Review ChecklistsDon’t Make These MistakesReview Code a Little Bit at a TimeWhat Code Needs to Be Reviewed?Who Needs to Review Code?How Many Reviewers?What Experience Do Reviewers Need?Automated Code ReviewsDifferent Tools Find Different ProblemsWhat Tools Are Good For, and What They’re Not Good ForGetting Developers to Use Automated Code ReviewsSelf-Service ScanningReviewing Infrastructure CodeCode Review Challenges and LimitationsReviews Take TimeUnderstanding Somebody Else’s Code Is HardFinding Security Vulnerabilities Is Even HarderAdopting Secure Code ReviewsBuild on What the Team Is Doing, or Should Be DoingRefactoring: Keeping Code Simple and SecureFundamentals Will Take You a Long Way to Secure, Safe CodeReviewing Security Features and ControlsReviewing Code for Insider ThreatsKey Takeaways
11. Agile Security Testing
How Is Testing Done in Agile?If You Got Bugs, You’ll Get PwnedThe Agile Test PyramidUnit Testing and TDDWhat Unit Testing Means to System SecurityGet Off the Happy PathService-Level Testing and BDD ToolsGauntlt (“Be Mean to Your Code”)BDD-SecurityLet’s Look Under the CoversAcceptance TestingFunctional Security Testing and ScanningZAP TutorialZAP in Continuous IntegrationBDD-Security and ZAP TogetherChallenges with Application ScanningTesting Your InfrastructureLintingUnit TestingAcceptance TestingCreating an Automated Build and Test PipelineNightly BuildContinuous IntegrationContinuous Delivery and Continuous DeploymentOut-of-Band Testing and ReviewsPromoting to ProductionGuidelines for Creating a Successful Automated PipelineWhere Security Testing Fits Into Your PipelineA Place for Manual Testing in AgileHow Do You Make Security Testing Work in Agile and DevOps?Key Takeaways
12. External Reviews, Testing, and Advice
Why Do We Need External Reviews?Vulnerability AssessmentPenetration TestingRed TeamingBug BountiesHow Bug Bounties WorkSetting Up a Bug Bounty ProgramAre You Sure You Want to Run a Bug Bounty?Configuration ReviewSecure Code AuditCrypto AuditChoosing an External FirmExperience with Products and Organizations Like YoursActively Researching or Updating SkillsMeet the Technical PeopleGetting Your Money’s WorthDon’t Waste Their TimeChallenge the FindingsInsist on Results That Work for YouPut Results into ContextInclude the Engineering TeamMeasure Improvement Over TimeHold Review/Retrospective/Sharing Events and Share the ResultsSpread Remediation Across Teams to Maximize Knowledge TransferRotate Firms or Swap Testers over TimeKey Takeaways
13. Operations and OpSec
System Hardening: Setting Up Secure SystemsRegulatory Requirements for HardeningHardening Standards and GuidelinesChallenges with HardeningAutomated Compliance ScanningApproaches for Building Hardened SystemsAutomated Hardening TemplatesNetwork as CodeMonitoring and Intrusion DetectionMonitoring to Drive Feedback LoopsUsing Application Monitoring for SecurityAuditing and LoggingProactive Versus Reactive DetectionCatching Mistakes at RuntimeRuntime DefenseCloud Security ProtectionRASPIncident Response: Preparing for BreachesGet Your Exercise: Game Days and Red TeamingBlameless Postmortems: Learning from Security FailuresSecuring Your Build PipelineHarden Your Build infrastructureUnderstand What’s in the CloudHarden Your CI/CD ToolsLock Down Configuration ManagersProtect Keys and SecretsLock Down ReposSecure ChatReview the LogsUse Phoenix Servers for Build and TestMonitor Your Build and Test SystemsShh…Keeping Secrets SecretKey Takeaways
14. Compliance
Compliance and SecurityDifferent Regulatory ApproachesPCI DSS: Rules-BasedReg SCI: Outcome-BasedWhich Approach Is Better?Risk Management and ComplianceTraceability of ChangesData PrivacyHow to Meet Compliance and Stay AgileCompliance Stories and Compliance in StoriesMore Code, Less PaperworkTraceability and Assurance in Continuous DeliveryManaging Changes in Continuous DeliveryDealing with Separation of DutiesBuilding Compliance into Your CultureKeeping Auditors HappyDealing with Auditors When They Aren’t HappyCertification and AttestationContinuous Compliance and BreachesCertification Doesn’t Mean That You Are SecureKey Takeaways
15. Security Culture
The Importance of Security CultureDefining “Culture”Push, Don’t PullBuilding a Security CulturePrinciples of Effective SecurityEnable, Don’t BlockTransparently SecureDon’t Play the Blame GameScale Security, Empower the EdgesThe Who Is Just as Important as the HowSecurity OutreachSecurgonomicsDashboardsKey Takeaways
16. What Does Agile Security Mean?
Laura’s StoryNot an Engineer but a HackerYour Baby Is Ugly and You Should Feel BadSpeak Little, Listen MuchLet’s Go FasterCreating Fans and FriendsWe Are Small, but We Are ManyJim’s StoryYou Can Build Your Own Security ExpertsChoose People over ToolsSecurity Has to Start with QualityYou Can Make Compliance an Everyday ThingMichael’s StorySecurity Skills Are Unevenly DistributedSecurity Practitioners Need to Get a Tech RefreshAccreditation and Assurance Are DyingSecurity Is an EnablerRich’s StoryThe First Time Is FreeThis Can Be More Than a Hobby?A Little Light BulbComputers Are Hard, People Are HarderAnd Now, We’re Here
Index

Content preview from Agile Application Security

Chapter 11. Agile Security Testing

One of the most fundamental changes in Agile development is in how testing is done. Because Agile teams move so fast, testing relies heavily, and often exclusively, on automation. If you are delivering working software every week, or if you’re pushing each change to production immediately in continuous deployment, manual testing isn’t a viable option.

Throwing code over to an independent test team at the end of a sprint is an anti-pattern in Agile. Testing has to be done in phase as changes are made. Hardening sprints, where the team blocks off time to focus on testing, debugging, and patching the code before it can be deployed to production, is another practice that most modern teams avoid.

Organizations that depend on independent test teams for quality assurance, and on manual penetration testing gates or scheduled scans or audits for security, need to change the way that they think and work.

How Is Testing Done in Agile?

In many Agile and DevOps teams, there are no testers. Developers take on the responsibility for testing their own code, because they have to. The Product Owner or someone else on the team playing the role of the “customer” may write acceptance test scenarios using tools supplied by the team. But developers are responsible for writing all the other tests and making sure that they pass. Testing becomes an integral part of coding, instead of a separate Waterfall phase.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781491938836Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Agile Application Security

by Laura Bell, Michael Brunton-Spall, Rich Smith, Jim Bird

Chapter 11. Agile Security Testing

How Is Testing Done in Agile?

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.