Secure, Resilient, and Agile Software Development

Book description

This book is written with a contemporary view on securing all types of software development practices or methodologies with in-depth, practical, and accessible advice. It is complete with successful secure, resilient, and agile software development practices that meet or exceed the demands of today’s increasingly digital world.

Table of contents

  1. Cover
  2. Half Title
  3. Title Page
  4. Copyright Page
  5. Dedication
  6. Table of Contents
  7. Preface
  8. About the Author
  9. Chapter 1: Today’s Software Development Practices Shatter Old Security Practices
    1. 1.1 Over the Waterfall
    2. 1.2 What Is Agile?
    3. 1.3 Shift Left!
    4. 1.4 Principles First!
    5. 1.5 Summary
    6. References
  10. Chapter 2: Deconstructing Agile and Scrum
    1. 2.1 The Goals of Agile and Scrum
    2. 2.2 Agile/Scrum Terminology
    3. 2.3 Agile/Scrum Roles
    4. 2.4 Unwinding Sprint Loops
    5. 2.5 Development and Operations Teams Get Married
    6. 2.6 Summary
    7. References
  11. Chapter 3: Learning Is FUNdamental!
    1. 3.1 Education Provides Context and Context Is Key
    2. 3.2 Principles for Software Security Education
    3. 3.3 Getting People’s Attention
    4. 3.4 Awareness versus Education
    5. 3.5 Moving into the Education Phase
    6. 3.6 Strategies for Rolling Out Training
    7. 3.7 Encouraging Training Engagement and Completion
    8. 3.8 Measuring Success
    9. 3.9 Keeping the Drumbeat Alive
    10. 3.10 Create and Mature a Security Champion Network
    11. 3.11 A Checklist for Establishing a Software Security Education, Training, and Awareness Program
    12. 3.12 Summary
    13. References
  12. Chapter 4: Product Backlog Development— Building Security In
    1. 4.1 Chapter Overview
    2. 4.2 Functional versus Nonfunctional Requirements
    3. 4.3 Testing NFRs
    4. 4.4 Families of Nonfunctional Requirements
      1. 4.4.1 Availability
    5. 4.5 Capacity
    6. 4.6 Efficiency
    7. 4.7 Interoperability
    8. 4.8 Manageability
      1. 4.8.1 Cohesion
      2. 4.8.2 Coupling
    9. 4.9 Maintainability
    10. 4.10 Performance
    11. 4.11 Portability
    12. 4.12 Privacy
    13. 4.13 Recoverability
    14. 4.14 Reliability
    15. 4.15 Scalability
    16. 4.16 Security
    17. 4.17 Serviceability/Supportability
    18. 4.18 Characteristics of Good Requirements
    19. 4.19 Eliciting Nonfunctional Requirements
    20. 4.20 NFRs as Acceptance Criteria and Definition of Done
    21. 4.21 Summary
    22. References
  13. Chapter 5: Secure Design Considerations
    1. 5.1 Chapter Overview
    2. 5.2 Essential Concepts
    3. 5.3 The Security Perimeter
    4. 5.4 Attack Surface
      1. 5.4.1 Mapping the Attack Surface
      2. 5.4.2 Side Channel Attacks
    5. 5.5 Application Security and Resilience Principles
      1. 5.5.1 Practice 1: Apply Defense in Depth
      2. 5.5.2 Practice 2: Use a Positive Security Model
      3. 5.5.3 Practice 3: Fail Securely
      4. 5.5.4 Practice 4: Run with Least Privilege
      5. 5.5.5 Practice 5: Avoid Security by Obscurity
      6. 5.5.6 Practice 6: Keep Security Simple
      7. 5.5.7 Practice 7: Detect Intrusions
      8. 5.5.8 Practice 8: Don’t Trust Infrastructure
      9. 5.5.9 Practice 9: Don’t Trust Services
      10. 5.5.10 Practice 10: Establish Secure Defaults
    6. 5.6 Mapping Best Practices to Nonfunctional Requirements (NFRs) as Acceptance Criteria
    7. 5.7 Summary
    8. References
  14. Chapter 6: Security in the Design Sprint
    1. 6.1 Chapter Overview
    2. 6.2 Design Phase Recommendations
    3. 6.3 Modeling Misuse Cases
    4. 6.4 Conduct Security Design and Architecture Reviews in Design Sprint
    5. 6.5 Perform Threat and Application Risk Modeling
      1. 6.5.1 Brainstorming Threats
    6. 6.6 Risk Analysis and Assessment
      1. 6.6.1 Damage Potential
      2. 6.6.2 Reproducibility
      3. 6.6.3 Exploitability
      4. 6.6.4 Affected Users
      5. 6.6.5 Discoverability
    7. 6.7 Don’t Forget These Risks!
    8. 6.8 Rules of Thumb for Defect Removal or Mitigation
    9. 6.9 Further Needs for Information Assurance
    10. 6.10 Countering Threats through Proactive Controls
    11. 6.11 Architecture and Design Review Checklist
    12. 6.12 Summary
    13. References
  15. Chapter 7: Defensive Programming
    1. 7.1 Chapter Overview
    2. 7.2 The Evolution of Attacks
    3. 7.3 Threat and Vulnerability Taxonomies
      1. 7.3.1 MITRE’s Common Weaknesses Enumeration (CWE™)
      2. 7.3.2 OWASP Top 10—2017
    4. 7.4 Failure to Sanitize Inputs is the Scourge of Software Development
    5. 7.5 Input Validation and Handling
      1. 7.5.1 Client-Side vs. Server-Side Validation
      2. 7.5.2 Input Sanitization
      3. 7.5.3 Canonicalization
    6. 7.6 Common Examples of Attacks Due to Improper Input Handling
      1. 7.6.1 Buffer Overflow
      2. 7.6.2 OS Commanding
    7. 7.7 Best Practices in Validating Input Data
      1. 7.7.1 Exact Match Validation
      2. 7.7.2 Exact Match Validation Example
      3. 7.7.3 Known Good Validation
      4. 7.7.4 Known Bad Validation
      5. 7.7.5 Handling Bad Input
    8. 7.8 OWASP’s Secure Coding Practices
    9. 7.9 Summary
    10. References
  16. Chapter 8: Testing Part 1: Static Code Analysis
    1. 8.1 Chapter Overview
    2. 8.2 Fixing Early versus Fixing Later
    3. 8.3 Testing Phases
      1. 8.3.1 Unit Testing
      2. 8.3.2 Manual Source Code Reviews
    4. 8.4 Static Source Code Analysis
    5. 8.5 Automated Reviews Compared with Manual Reviews
    6. 8.6 Peeking Inside SAST Tools
    7. 8.7 SAST Policies
    8. 8.8 Using SAST in Development Sprints
    9. 8.9 Software Composition Analysis (SCA)
    10. 8.10 SAST is NOT for the Faint of Heart!
    11. 8.11 Commercial and Free SAST Tools
    12. 8.12 Summary
    13. References
  17. Chapter 9: Testing Part 2: Penetration Testing/Dynamic Analysis/IAST/RASP
    1. 9.1 Chapter Overview
    2. 9.2 Penetration (Pen) Testing
    3. 9.3 Open Source Security Testing Methodology Manual (OSSTMM)
    4. 9.4 OWASP’s ASVS
    5. 9.5 Penetration Testing Tools
    6. 9.6 Automated Pen Testing with Black Box Scanners
    7. 9.7 Deployment Strategies
      1. 9.7.1 Developer Testing
      2. 9.7.2 Centralized Quality Assurance Testing
    8. 9.8 Gray Box Testing
    9. 9.9 Limitations and Constraints of Pen Testing
    10. 9.10 Interactive Application Security Testing (IAST)
    11. 9.11 Runtime Application Self-Protection (RASP)
    12. 9.12 Summary
    13. References
  18. Chapter 10: Securing DevOps
    1. 10.1 Overview
    2. 10.2 Challenges When Moving to a DevOps World
      1. 10.2.1 Changing the Business Culture
    3. 10.3 The Three Ways That Make DevOps Work
    4. 10.4 The Three Ways Applied to AppSec
    5. 10.5 OWASP’s DevSecOps Maturity Model
    6. 10.6 OWASP’s DevSecOps Studio
    7. 10.7 Summary
    8. References
  19. Chapter 11: Metrics and Models for AppSec Maturity
    1. 11.1 Chapter Overview
    2. 11.2 Maturity Models for Security and Resilience
    3. 11.3 Software Assurance Maturity Model—OpenSAMM
      1. 11.3.1 OpenSAMM Business Functions
      2. 11.3.2 Core Practice Areas
    4. 11.4 Levels of Maturity
      1. 11.4.1 Objective
      2. 11.4.2 Activities
      3. 11.4.3 Results
      4. 11.4.4 Success Metrics
      5. 11.4.5 Costs
      6. 11.4.6 Personnel
      7. 11.4.7 Related Levels
      8. 11.4.8 Assurance
    5. 11.5 Using OpenSAMM to Assess Maturity Levels
    6. 11.6 The Building Security In Maturity Model (BSIMM)
    7. 11.7 BSIMM Organization
    8. 11.8 BSIMM Software Security Framework
      1. 11.8.1 Governance
      2. 11.8.2 Intelligence
      3. 11.8.3 SSDL Touchpoints
      4. 11.8.4 Deployment
    9. 11.9 BSIMM’s 12 Practice Areas
    10. 11.10 Measuring Results with BSIMM
    11. 11.11 The BSIMM Community
    12. 11.12 Conducting a BSIMM Assessment
    13. 11.13 Summary
    14. References
  20. Chapter 12: Frontiers for AppSec
    1. 12.1 Internet of Things (IoT)
      1. 12.1.1 The Industry Responds
      2. 12.1.2 The Government Responds
    2. 12.2 Blockchain
      1. 12.2.1 Security Risks with Blockchain Implementations
      2. 12.2.2 Securing the Chain
    3. 12.3 Microservices and APIs
    4. 12.4 Containers
      1. 12.4.1 Container Security Issues
      2. 12.4.2 NIST to the Rescue Again!
    5. 12.5 Autonomous Vehicles
    6. 12.6 Web Application Firewalls (WAFs)
    7. 12.7 Machine Learning/Artificial Intelligence
    8. 12.8 Big Data
      1. 12.8.1 Vulnerability to Fake Data Generation
      2. 12.8.2 Potential Presence of Untrusted Mappers
      3. 12.8.3 Lack of Cryptographic Protection
      4. 12.8.4 Possibility of Sensitive Information Mining
      5. 12.8.5 Problems with Granularity of Access Controls
      6. 12.8.6 Data Provenance Difficulties
      7. 12.8.7 High Speed of NoSQL Databases’ Evolution and Lack of Security Focus
      8. 12.8.8 Absent Security Audits
    9. 12.9 Summary
    10. References
  21. Chapter 13: AppSec Is a Marathon— Not a Sprint!
    1. 13.1 Hit the Road
    2. 13.2 Getting Involved with OWASP
    3. 13.3 Certified Secure Software Lifecycle Professional (CSSLP®)
      1. 13.3.1 Why Obtain the CSSLP?
    4. 13.4 Higher Education
    5. 13.5 Conclusion
    6. References
  22. Appendix A: Sample Acceptance Criteria for Security Controls
  23. Appendix B: Resources for AppSec
    1. Training
    2. Cyber Ranges
    3. Requirements Management Tools
    4. Threat Modeling
    5. Static Code Scanners: Open Source
    6. Static Code Scanners: Commercial
    7. Dynamic Code Scanners: Open Source
    8. Dynamic Code Scanners: Commercial
    9. Maturity Models
    10. Software Composition Analysis
    11. IAST Tools
    12. API Security Testing
    13. Runtime Application Self-Protection (RASP)
    14. Web Application Firewalls (WAFs)
    15. Browser-centric Protection
  24. Index

Product information

  • Title: Secure, Resilient, and Agile Software Development
  • Author(s): Mark Merkow
  • Release date: December 2019
  • Publisher(s): Auerbach Publications
  • ISBN: 9781000041750