Proposed Cyber Test and Evaluation Process across the Software Development Lifecycle

Size: px

Start display at page:

Download "Proposed Cyber Test and Evaluation Process across the Software Development Lifecycle"

Annis Rodgers
10 years ago
Views:

1 Proposed Cyber Test and Evaluation Process across the Software Development Lifecycle Carolyn R. Keith MSIA, CISSP-ISSEP, CISA, CTEP November 2013 ITEA 30th Annual Symposium

2 Introduction DDT&E suggestion Shift-Left for Cyber Security Testing Current cyber threat requires better and cheaper security solutions Response Move initial Cyber Security Testing activities earlier in the Software Development Life Cycle (SDLC) Test Cyber Security throughout the entire SDLC

Response Move initial Cyber Security Testing activities earlier in the

3 DOD Acquisition Life Cycle 3

4 Security Testing Functionality requirements Initial user interface Technology platform selection Technical architecture Project plan Detailed specifications Finalize user interface Application architecture System interface design Test plans Installation on production Production testing Transition to operations Post deployment support Maintain Plan Deploy Design Develop Application code development System interface design Integration with existing apps Unit and integration testing OPERATIONAL TESTING (OT) SECURITY TESTING System testing User interface testing Installation staging environment DEVELOPMENTAL TESTING (DT) 4

Post deployment support Maintain Plan Deploy Design Develop Application code development System interface design Integration with existing apps Unit and

5 Issue Cost of Fixing Vulnerabilities Later Stage Critical Bugs Identified Cost of Fixing 1 Bug Cost of Fixing All Bugs Cost of Fixing Vulnerabilities Early Stage Critical Bugs Identified Cost of Fixing 1 Bug Cost of Fixing All Bugs Requirements $139 Requirements $139 Design $455 Design $455 Coding $977 Coding 150 $977 $146,550 Testing 50 $7,136 $356,800 Testing 50 $7,136 $356,800 Maintenance 150 $14,102 $2,115,300 Maintenance $14,102 Total 200 $2,472,100 Total 200 $503,350 Source: 5

$139 Requirements $139 Design $455 Design $455 Coding $977 Coding 150 $977 $146,550 Testing 50 $7,136 $356,800 Testing 50

6 Response Pre-Milestone A Perform a Security Risk Assessment Conduct Threat Modeling Execute a Tabletop Contingency Exercise Execute a Hypothetical Penetration/Exploitation Exercise 6

7 Response (continued) Pre-Milestone B Add Granular Security Requirements to Critical Design Documents Conduct Hack the Design reviews 7

8 Response (continued) Pre-Milestone C Perform Code Reviews Earlier and Continuously Apply STIG and Current Information Assurance Vulnerability Management (IAVM) Notice Requirements to the Code and Applications Incorporate Vulnerability Scanning and Security Fix or Mitigation Activities Initiate Penetration Activities Earlier Change the mindset - Authorization to Operate (ATO) is not the end of operational security, it is the beginning 8

Incorporate Vulnerability Scanning and Security Fix or Mitigation Activities Initiate Penetration Activities

9 Response (continued) Deployment Phase Continue to apply STIGs and IAVM notices Perform final Code Review Continue Vulnerability Scanning Execute a full Penetration/Exploitation Test Maintenance Phase Continue to apply STIGs and IAVM notices Continue Vulnerability Scanning Execute random, unannounced Penetration/Exploitation Tests 9

Penetration/Exploitation Test Maintenance Phase Continue to apply STIGs and IAVM

10 Proposed Schedule Historical Schedule Summary Activity Plan Design Develop Deploy Maintain Security Risk Assessment Threat Modeling Security Penetration Exercise Contingency Tabletop Exercise Security Design Security Code Reviews Implement STIGs and IAVAs Vulnerability Scanning and Security Reviews Risk Assessment Threat Modeling Security Penetration Exercise Contingency Tabletop Exercise Security Design Security Code Reviews Implement STIGs and IAVAs Vulnerability Scanning and Security Reviews 10

and IAVAs Vulnerability Scanning and Security Reviews Risk Assessment Threat and IAVAs Vulnerability Scanning and Security

11 Questions 11

12 12

Overview TECHIS60241. Carry out risk assessment and management activities

Overview TECHIS60241. Carry out risk assessment and management activities Overview Information in all its forms is a vital component of the digital environment in which we live and work. The protection of information in its physical form is well understood but the protection