I recently had the honour of presenting a talk at OWASP London at Bank in London. The talk was originally aimed at my company’s ground troops (developers, product managers), but also clearly presents a way of organising a security team; this may sound trivial, but the way a security effort is organised has a big impact on how effective it is. My current project (about 120 people across seven teams) has approached this by nominating security champions in each team, who manage risks using their own separate, cross team project (to avoid workflow issues), and having a unified ‘Security Council’.
The presentation was warmly received, and a number of good questions were asked, so it’s worth viewing the Q&A!
We’ve all been there.
We’re busily going about our work, when suddenly we notice something odd. Maybe it’s a badly thought out permission policy, maybe it’s some unprotected URL configuration that could be used to get an EC2 instance to spill its guts , but whatever it is, it smells.
But you’re knee deep in your own task, so you wearily go to JIRA, click ‘Create New’ and enter in the most perfunctory ticket description possible. And off it goes, your new little ticket, to reside deep within the project backlog, collecting crust with the other non-function-requirement tickets. Hey, business is business, and business needs features!
Or maybe you don’t do anything at all. ‘Cause why bother?
Either way, the problem never gets looked at, never gets evaluated and never gets fixed.