Application Portfolio Risk Ranking Banishing FUD With Structure and Numbers
|
|
|
- Clement Fisher
- 10 years ago
- Views:
Transcription
1 Application Portfolio Risk Ranking Banishing FUD With Structure and Numbers Dan Cornell OWASP AppSec DC 2010 November 11 th, 2010
2 Overview The Problem Information Gathering Application Scoring Risk Rank & Tradeoff Analysis Discussion Conclusion, Next Steps, and Q&A 1
3 Some Key Questions for Today s Session Where do you start? What applications represent the biggest risk? What attributes make applications more or less risky? What are the most cost-effective way to manage the risk of inherited applications? What approaches might work for your organization? 2
4 Desired Outcomes Understand risk-based options for managing the security of inherited applications Develop a framework for ranking risks with specific applications Understand some of the decision-making factors that come into play when risk-ranking applications Apply one tactic from what you learn today next week at your organization 3
5 Personal Background Denim Group CTO Developer by background Java,.NET, etc 4
6 Denim Group Background Professional services firm that builds & secures enterprise applications Secure development services: Secure.NET and Java application development Post-assessment remediation Secure web services Application security services include: External application assessments Code reviews Software development lifecycle development (SDLC) consulting Classroom and e-learning instruction for developers 5
7 What you Don t know CAN Hurt You Passion: Get security professionals to ask a better set of questions Today s presentation focuses on helping you increase your IQ in the arena of software portfolio risk 6
8 Background the Current State of Affairs Creating meaningful enterprise-wide software security initiatives is hard The vast majority of info regarding software security focuses on testing software writing more secure code or SDLC process improvement Most organizations have hundreds or thousands of legacy applications that work! They represent money already spent ROI? They are viewed part of the plumbing by management The codebases can be millions of lines of code Industry is focused on web applications Other software risks must be taken into consideration Web services, mobile applications, SaaS, certain desktop applications 7
9 Key Facts 66% have adopted a risk-based approach to remediation of application vulnerabilities 71% have an executive or team with primary ownership and accountability for application security 66% have defined communications channels between security, operations, and development teams Source: Securing Your Applications: Three Ways to Play, Aberdeen Group, August
10 Goal for Our Model Transparent Decisions and calculations should be explainable Adaptable Not every organization has the same drivers, goals or resources Practical Get something that works and iterate 9
11 Methodology Steal steal steal! Andrew Jacquith s Application Insecurity Index (AII) from his book Security Metrics Nick Coblentz s blog posts on the topic Other example spreadsheets, etc Simplify simplify simplify! Great is the enemy of the good enough Any information collected should provide value Work in progress Test with organizations Repeat 10
12 Step 1: Develop Initial Criteria Business Importance Risk Assessment Risk 11
13 Step 2 Information Gathering Build a Portfolio of Applications Public-facing web sites Customer-facing web applications Partner-facing web applications Internal- or partner-facing web services Customer Relationship Management (CRM) systems Financial applications Green screen mainframe applications Software as a Service (SaaS) applications 12
14 Step 2 Information Gathering (Continued) Collect Background Information Development Details Vendor (if any) Audience Hosting Details Assess the Data Type (CCs, PII, ephi, etc) Compliance Requirements Determine the Scale Lines of Code Dynamic Pages Concurrent Users User Roles 13
15 Step 2 Information Gathering (Continued) Assess the Underlying Technology Infrastructure (OS, hardware, etc) Platform (.NET, Java, PHP, etc) Versions Assess the Security State Assessment Activity (type, date, etc) Vulnerabilities (high, medium, low) Protection (IDS/IPS, WAF) 14
16 Step 3 Application Scoring Business Importance Risk Business Function (customer interface, internal but public-facing, departmental use only) Access Scope (external, internal) Data Sensitivity (customer data, company confidential, public) Availability Impact (serious, minor, minimal, or no reputation damage) 15
17 Step 3 Application Scoring (Continued) Technology Risk Authentication (methods, enforcement) Data Classification (formal approach or not) Input / Output Validation (structured or not) Authorization Controls (resource checks in place or not) Security Requirements (explicitly documented or not) Sensitive Data Handling (controls in place like encryption or not) User Identity Management (procedures in place for account creation, access provisioning, and change control or not) Infrastructure Architecture (network segmentation, patching) 16
18 Step 3 Application Scoring (Continued) Assessment Risk Technical Assessment (assessment activity, vulnerabilities still present) Regulatory Exposure (unknown, subject to regulation) Third-Party Risks (outsourced development, SaaS hosting, etc) 17
19 Step 4: Determine Assessment Approach Currently using OWASP Application Security Verification Standard (ASVS) Determine what you consider to be a Critical, High, Medium, Low Determine what assessment approach/standard you want to use 18
20 Results Comparison Let s analyze our results Apply quantitative decision-making analysis concepts Want to understand what level of effort addresses the highest amount of risk Tradeoff analysis 19
21 Evaluation Pros Provides for a structured approach Calculations are observable Standards can be set for specific organizations Cons Can seem like a lot of data to collect Technology Risk is hard to get at a proper level of granularity Excel spreadsheet combines data and code Needs work for dealing with cloud stuff 20
22 So where do you go from here? 21
23 Example Artifacts Application Tracking and Risk-Ranking Spreadsheet What are the applications? What are their characteristics? How do they rank against one another? Risk-Ranking Planning Spreadsheet Which applications are critical, high, medium or low? How are you going to deal with each application? 22
24 Potential Follow-up Options End of Life Remediate Potential Testing Approaches Tailoring to Documented Risk Work identified list from top to bottom Application Security Verification Standard (ASVS) Levels of application-level security verification that increase in breadth and depth as one moves up the levels Verification requirements that prescribe a unique white-list approach for security controls Reporting requirements that ensure reports are sufficiently detailed to make verification repeatable, and to determine if the verification was accurate and complete. 23
25 What you can do now! Collect or scrub your initial application inventory Develop relationships with 3 rd parties who can help you through the identification process Find a peer that is conducting the same risk ranking Familiarize yourself with OWASP OpenSAMM and OWASP ASVS 24
26 Conclusion Managing the security of inherited applications can present the most severe headaches for someone building a software security program A risk-based approach is really the only economically feasible approach given the size/complexity of the problem Understanding certain attributes of inherited applications is critical to applying a risk-based management approach 25
27 Resources Web Application Security Portfolios, ISSA Journal, May 2009, Coblentz, Nick. Open Web Application Security Project Open Software Assurance Maturity Model, Open Web Application Security Project Application Security Verification Standard, How-to-Guide for Software Security Vulnerability Remediation, Dan Cornell, Denim Group, October 2010 Cloud Security Alliance Securing your Applications, Aberdeen Group, Brink, Derek, August
28 Contact Dan Cornell (210) blog.denimgroup.com me for a copy of the example Excel spreadsheet 27
Vulnerability Management in an Application Security World. AppSec DC November 12 th, 2009. The OWASP Foundation http://www.owasp.
Vulnerability Management in an Application Security World AppSec DC November 12 th, 2009 Dan Cornell Global Membership Committee Denim Group [email protected] (210) 572-4400 Twitter: @danielcornell The
Rolling out an Effective Application Security Assessment Program. Jason Taylor, CTO [email protected]
Rolling out an Effective Application Security Assessment Program Jason Taylor, CTO [email protected] About Security Innovation Authority in Application Security 10+ years of research and assessment
Application Security 101. A primer on Application Security best practices
Application Security 101 A primer on Application Security best practices Table of Contents Introduction...1 Defining Application Security...1 Managing Risk...2 Weighing AppSec Technology Options...3 Penetration
Mean Time to Fix (MTTF) IT Risk s Dirty Little Secret Joe Krull, CPP, CISSP, IAM, CISA, A.Inst.ISP, CRISC, CIPP
Mean Time to Fix (MTTF) IT Risk s Dirty Little Secret Joe Krull, CPP, CISSP, IAM, CISA, A.Inst.ISP, CRISC, CIPP Presentation Overview Basic Application Security (AppSec) Fundamentals Risks Associated With
Building & Measuring Security in Web Applications. Fabio Cerullo Cycubix Limited 30 May 2012 - Belfast
Building & Measuring Security in Web Applications Fabio Cerullo Cycubix Limited 30 May 2012 - Belfast Brief Bio - CEO & Founder Cycubix Limited - 10+ years security experience in Technology, Manufacturing,
APPLICATION SECURITY: ONE SIZE DOESN T FIT ALL
APPLICATION SECURITY: ONE SIZE DOESN T FIT ALL Charles Henderson Trustwave SpiderLabs Session ID: Session Classification: SPO2-W25 Intermediate AGENDA One size rarely fits all Sizing up an application
Your world runs on applications. Secure them with Veracode.
Application Risk Management Solutions Your world runs on applications. Secure them with Veracode. Software Security Simplified Application security risk is inherent in every organization that relies on
The Next Generation of Security Leaders
The Next Generation of Security Leaders In an increasingly complex cyber world, there is a growing need for information security leaders who possess the breadth and depth of expertise necessary to establish
Survey on Application Security Programs and Practices
Survey on Application Security Programs and Practices A SANS Analyst Survey Written by Jim Bird and Frank Kim Advisor: Barbara Filkins February 2014 Sponsored by Hewlett-Packard, Qualys and Veracode 2014
Agile and Secure: OWASP AppSec Seattle Oct 2006. The OWASP Foundation http://www.owasp.org/
Agile and Secure: Can We Be Both? OWASP AppSec Seattle Oct 2006 Dan Cornell, OWASP San Antonio Leader Principal, Denim Group Ltd. [email protected] (210) 572-4400 Copyright 2006 - The OWASP Foundation
Domain 1 The Process of Auditing Information Systems
Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge
Security Automation in Agile SDLC Real World Cases
Security Automation in Agile SDLC Real World Cases Ofer Maor Director of Security Strategy, Synopsys AppSec California, January 2016 Speaker Security Strategy at Synopsys Founder of Seeker / Pioneer of
UIIPA - Security Risk Management. June 2015
UIIPA - Security Risk Management June 2015 1 Introduction Tim Hastings, Chief Information Security Officer State of Utah - Department of Technology Services Tim Hastings has more than 16 years of experience
Agile and Secure Can We Be Both? Chicago OWASP. June 20 th, 2007
Agile and Secure Can We Be Both? Chicago OWASP June 20 th, 2007 The Agile Practitioner s Dilemma Agile Forces: Be more responsive to business concerns Increase the frequency of stable releases Decrease
Third Party Security: Are your vendors compromising the security of your Agency?
Third Party Security: Are your vendors compromising the security of your Agency? Wendy Nather, Texas Education Agency Michael Wyatt, Deloitte & Touche LLP TASSCC Annual Conference 3 August 2010 Agenda
Cenzic Product Guide. Cloud, Mobile and Web Application Security
Cloud, Mobile and Web Application Security Table of Contents Cenzic Enterprise...3 Cenzic Desktop...3 Cenzic Managed Cloud...3 Cenzic Cloud...3 Cenzic Hybrid...3 Cenzic Mobile...4 Technology...4 Continuous
Turning the Battleship: How to Build Secure Software in Large Organizations. Dan Cornell May 11 th, 2006
Turning the Battleship: How to Build Secure Software in Large Organizations Dan Cornell May 11 th, 2006 Overview Background and key questions Quick review of web application security The web application
Achieving SOX Compliance with Masergy Security Professional Services
Achieving SOX Compliance with Masergy Security Professional Services The Sarbanes-Oxley (SOX) Act, also known as the Public Company Accounting Reform and Investor Protection Act of 2002 (and commonly called
Remediation Statistics: What Does Fixing Application Vulnerabilities Cost?
Remediation Statistics: What Does Fixing Application Vulnerabilities Cost? Dan Cornell Denim Group, Ltd. Session ID: ASEC-302 Session Classification: Intermediate Agenda An Innocent Question Finding a
Vulnerability Management
Vulnerability Management Buyer s Guide Buyer s Guide 01 Introduction 02 Key Components 03 Other Considerations About Rapid7 01 INTRODUCTION Exploiting weaknesses in browsers, operating systems and other
CloudCheck Compliance Certification Program
CloudCheck Compliance Certification Program Ensure Your Cloud Computing Environment is Secure with CloudCheck Certification Organizations today are increasingly relying on a combination of private and/or
Information & Asset Protection with SIEM and DLP
Information & Asset Protection with SIEM and DLP Keeping the Good Stuff in and the Bad Stuff Out Professional Services: Doug Crich Practice Leader Infrastructure Protection Solutions What s driving the
Cybersecurity Awareness for Executives
SESSION ID: SOP-R04 Cybersecurity Awareness for Executives Rob Sloan Head of Cyber Content and Data Dow Jones @_rob_sloan Session Overview Aim: Provide a high level overview of an effective cybersecurity
Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006
Introduction to Web Application Security Microsoft CSO Roundtable Houston, TX September 13 th, 2006 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go From
Pentests more than just using the proper tools
Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Penetration testing Introduction Evaluation scheme Security Analyses of web applications Internal Security
5 Partner Benefits and Requirements... 8 5.1 Benefits... 8 5.2 Requirements... 8
Table of Contents Table of Contents... 2 1 Overview & Presentation... 4 2 Partner Communications... 5 2.1 Partner channels... 5 2.2 Kiuwan Representatives... 5 3 About Kiuwan... 6 4 Partner Types... 7
Pentests more than just using the proper tools
Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Security testing 3. Penetration testing Introduction Evaluation scheme Security Analyses of web applications
Integrated Threat & Security Management.
Integrated Threat & Security Management. SOLUTION OVERVIEW Vulnerability Assessment for Web Applications Fully Automated Web Crawling and Reporting Minimal Website Training or Learning Required Most Accurate
Services Providers. Ivan Soto
SOP s for Managing Application Services Providers Ivan Soto Learning Objectives At the end of this session we will have covered: Types of Managed Services Outsourcing process Quality expectations for Managed
Stepping Through the Info Security Program. Jennifer Bayuk, CISA, CISM
Stepping Through the Info Security Program Jennifer Bayuk, CISA, CISM Infosec Program How to: compose an InfoSec Program cement a relationship between InfoSec program and IT Governance design roles and
From Chaos to Clarity: Embedding Security into the SDLC
From Chaos to Clarity: Embedding Security into the SDLC Felicia Nicastro Security Testing Services Practice SQS USA Session Description This session will focus on the security testing requirements which
Accenture and Software as a Service: Moving to the Cloud to Accelerate Business Value for High Performance
Accenture and Software as a Service: Moving to the Cloud to Accelerate Business Value for High Performance Is Your Organization Facing Any of These Challenges? Cost pressures; need to do more with the
How to ensure control and security when moving to SaaS/cloud applications
How to ensure control and security when moving to SaaS/cloud applications Stéphane Hurtaud Partner Information & Technology Risk Deloitte Laurent de la Vaissière Directeur Information & Technology Risk
THE BLUENOSE SECURITY FRAMEWORK
THE BLUENOSE SECURITY FRAMEWORK Bluenose Analytics, Inc. All rights reserved TABLE OF CONTENTS Bluenose Analytics, Inc. Security Whitepaper ISO 27001/27002 / 1 The Four Pillars of Our Security Program
10 Smart Ideas for. Keeping Data Safe. From Hackers
0100101001001010010001010010101001010101001000000100101001010101010010101010010100 0100101001001010010001010010101001010101001000000100101001010101010010101010010100000 0100101001001010010001010010101001010101001000000100101001010101010010101010010100000
State of Oregon. State of Oregon 1
State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information
Enabling IT Performance & Value with Effective IT Governance Assessment & Improvement Practices. April 10, 2013
Enabling IT Performance & Value with Effective IT Governance Assessment & Improvement Practices April 10, 2013 Today's Agenda: Key Topics Defining IT Governance IT Governance Elements & Responsibilities
Cloud Infrastructure Security
Cloud Infrastructure Security Dimiter Velev 1 and Plamena Zlateva 2 1 University of National and World Economy, UNSS - Studentski grad, 1700 Sofia, Bulgaria [email protected] 2 Institute of Control and
Approach to Information Security Architecture. Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera
Approach to Information Security Architecture Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera About TeliaSonera TeliaSonera provides network access and telecommunication services that help
IoT & SCADA Cyber Security Services
IoT & SCADA Cyber Security Services RIOT SOLUTIONS PTY LTD P.O. Box 10087, Adelaide St Brisbane QLD 4000 BRISBANE HEAD OFFICE Level 4, 60 Edward St, Brisbane, QLD 4000 T: 1300 744 028 Email: [email protected]
IT Vendor Due Diligence. Jennifer McGill CIA, CISA, CGEIT IT Audit Director Carolinas HealthCare System December 9, 2014
IT Vendor Due Diligence Jennifer McGill CIA, CISA, CGEIT IT Audit Director Carolinas HealthCare System December 9, 2014 Carolinas HealthCare System (CHS) Second largest not-for-profit healthcare system
How To Improve Your Business
IT Risk Management Life Cycle and enabling it with GRC Technology 21 March 2013 Overview IT Risk management lifecycle What does technology enablement mean? Industry perspective Business drivers Trends
Cloud Computing and Security Risk Analysis Qing Liu Technology Architect STREAM Technology Lab [email protected]
Cloud Computing and Security Risk Analysis Qing Liu Technology Architect STREAM Technology Lab [email protected] 1 Disclaimers This presentation provides education on Cloud Computing and its security
A Strategic Approach to Web Application Security The importance of a secure software development lifecycle
A Strategic Approach to Web Application Security The importance of a secure software development lifecycle Rachna Goel Technical Lead Enterprise Technology Web application security is clearly the new frontier
FERPA: Data & Transport Security Best Practices
FERPA: Data & Transport Security Best Practices April 2013 Mike Tassey Privacy Technical Assistance Center FERPA and Data Security Unlike HIPAA and other similar federal regulations, FERPA does not require
Integrating Security into the Application Development Process. Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis
Integrating Security into the Application Development Process Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis Agenda Seek First to Understand Source Code Security AppSec and SQA Analyzing
5 Things to Look for in a Cloud Provider When it Comes to Security
5 Things to Look for in a Cloud Provider When it Comes to Security In This Paper Internal technology services that lack resources, rigor or efficiencies are prime candidates for the cloud Understand the
Beyond BOM 101: Next Generation Bill of Materials Management whitepaper
An Arena Solutions whitepaper www.arenasolutions.com whitepaper Summary In the world of product development and manufacturing, the bill of materials (BOM) is a critical product information record for both
MIS 5203. Systems & Infrastructure Lifecycle Management 1. Week 13 April 14, 2016
MIS 5203 Lifecycle Management 1 Week 13 April 14, 2016 Study Objectives Systems Implementation contd Configuration Management Monitoring and Incident Management Post implementation Reviews Project Success
The Way to SOA Concept, Architectural Components and Organization
The Way to SOA Concept, Architectural Components and Organization Eric Scholz Director Product Management Software AG Seite 1 Goals of business and IT Business Goals Increase business agility Support new
CONSULTANTS TO THE INSURANCE INDUSTRY IT DEVELOPMENT QA TESTING CEDERIGHT REINSURANCE STAFF AUGMENTATION
CONSULTANTS TO THE INSURANCE INDUSTRY IT DEVELOPMENT QA TESTING CEDERIGHT REINSURANCE STAFF AUGMENTATION S I M P L I F Y I N G W H AT M AT T E R S 2 OUR EXPERTISE 01 02 03 04 IT Development QA Testing
Asset management guidelines
Asset management guidelines 1 IT asset management (ITAM) overview Objective Provide a single, integrated view of agency assets in order to allow agencies to identify the asset location and assess the potential
IT Security Risk Management Model for Cloud Computing: A Need for a New Escalation Approach.
IT Security Risk Management Model for Cloud Computing: A Need for a New Escalation Approach. Gunnar Wahlgren 1, Stewart Kowalski 2 Stockholm University 1: ([email protected]), 2: ([email protected]) ABSTRACT
Enterprise Application Security Program
Enterprise Application Security Program GE s approach to solving the root cause and establishing a Center of Excellence Darren Challey GE Application Security Leader Agenda Why is AppSec important? Why
The expression better, faster, cheaper THE BUSINESS CASE FOR PROJECT PORTFOLIO MANAGEMENT
Cloud Solutions for IT Management WHITE PAPER THE BUSINESS CASE FOR PROJECT PORTFOLIO MANAGEMENT How Progressive IT Organizations Are Using Hosted Solutions To Deliver On Time, On Budget, On Quota and
arenasolutions.com Whitepaper Has Your BOM Solution Bombed? Next Generation Bill of Materials Management
Whitepaper Has Your BOM Solution Bombed? Next Generation Bill of Materials Management Summary In the world of product development and manufacturing, the bill of materials (BOM) is a critical product information
Strategic Sourcing & B2B E Commerce Solutions for ASEAN Purchasing Professionals. Bill Kohnen
2015 PASIAWorld Annual Conference 2020 Vision: Competitive Procurement, Logistics and Supply Chain Strategic Sourcing & B2B E Commerce Solutions for ASEAN Purchasing Professionals Bill Kohnen ASEAN As
Managing Web & Application Security with OWASP bringing it all together. Tobias Gondrom (OWASP Project Leader)
Managing Web & Application Security with OWASP bringing it all together Tobias Gondrom (OWASP Project Leader) OWASP World OWASP is a worldwide free and open community focused on improving the security
Interactive Application Security Testing (IAST)
WHITEPAPER Interactive Application Security Testing (IAST) The World s Fastest Application Security Software Software affects virtually every aspect of an individual s finances, safety, government, communication,
EMA Services for IT Vendors
Services to Help You Achieve Your Goals Founded in 1996, Enterprise Management Associates (EMA) is a leading industry analyst and consulting firm that specializes in going beyond the surface to provide
Italy. EY s Global Information Security Survey 2013
Italy EY s Global Information Security Survey 2013 EY s Global Information Security Survey 2013 This year s survey our 16th edition captures the responses of 1,909 C-suite and senior level IT and information
Why You Need to Test All Your Cloud, Mobile and Web Applications
Why You Need to Test All Your Cloud, Introduction In a recent survey of security executives, more than 70 percent of respondents acknowledged that they are performing vulnerability tests on fewer than
Case Study. SNW Asset Management. [email protected] (866) 796-0310. www.os33.com
[email protected] (866) 796-0310 www.os33.com Case Study Highlights Country: United States Industry: More Info: http://www.snwam.com Business Situation: Move a spin-off company to a new IT infrastructure in
Guideline on Implementing Cloud Identity and Access Management
CMSGu2013-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Implementing Cloud Identity and Access Management National
How To Understand The Benefits Of Cloud Computing
Issue in Focus: Assessing the Cloud PLM Opportunity Evaluating Benefits, Requirements, and Considerations Tech-Clarity, Inc. 2012 Table of Contents Introducing the Issue... 3 The Cloud Meets PLM... 3 Evaluating
Columbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirements
WHITE PAPER TAKING THE NEXT STEP IN CTRM CLOUD SOLUTIONS
WHITE PAPER TAKING THE NEXT STEP IN CTRM CLOUD SOLUTIONS Introduction IN THE LAST DECADE, A QUIET REVOLUTION HAS OC- CURRED WITHIN THE E/CTRM (ENERGY/COMMODITY TRADING AND RISK MANAGEMENT) SOFTWARE CATE-
Cloud Security Fails & How the SDLC could (not?) have prevented them
Cloud Security Fails & How the SDLC could (not?) have prevented them CSA CEE Summit 2015, Ljubjana By Christopher Scheuring, ERNW Germany #2 /whoami Christopher Scheuring Security Analyst @ ERNW Since
Beyond Mandates: Getting to Sustainable IT Governance Best Practices. Steve Romero PMP, CISSP, CPM IT Governance Evangelist
Beyond Mandates: Getting to Sustainable IT Governance Best Practices Steve Romero PMP, CISSP, CPM IT Governance Evangelist Agenda > IT Governance Definition > IT Governance Principles > IT Governance Decisions
Accenture Technology Consulting. Clearing the Path for Business Growth
Accenture Technology Consulting Clearing the Path for Business Growth Mega technology waves are impacting and shaping organizations in a profound way When a company s executive management team considers
Securely Outsourcing to the Cloud: Five Key Questions to Ask
WHITE PAPER JULY 2014 Securely Outsourcing to the Cloud: Five Key Questions to Ask Russell Miller Tyson Whitten CA Technologies, Security Management 2 WHITE PAPER: SECURELY OUTSOURCING TO THE CLOUD: FIVE
Software Code Quality Checking (SCQC) No Clearance for This Secret: Information Assurance is MORE Than Security
Software Code Quality Checking (SCQC) No Clearance for This Secret: Information Assurance is MORE Than Security Nominee International Security Executives (ISE ) Information Security Project of the Year
OpenSAMM Software Assurance Maturity Model
Libre Software Meeting Brussels 10-July-2013 The OWASP Foundation http://www.owasp.org Open Software Assurance Maturity Model Seba Deleersnyder [email protected] OWASP Foundation Board Member OWASP Belgium
BSM for IT Governance, Risk and Compliance: NERC CIP
BSM for IT Governance, Risk and Compliance: NERC CIP Addressing NERC CIP Security Program Requirements SOLUTION WHITE PAPER Table of Contents INTRODUCTION...................................................
How to Build a Trusted Application. John Dickson, CISSP
How to Build a Trusted Application John Dickson, CISSP Overview What is Application Security? Examples of Potential Vulnerabilities Strategies to Build Secure Apps Questions and Answers Denim Group, Ltd.
PASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013
2013 PASTA Abstract Process for Attack S imulation & Threat Assessment Abstract VerSprite, LLC Copyright 2013 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright