BUILDING A PRODUCTSECURITY INCIDENTRESPONSE TEAM: LEARNINGSFROM THE HIVEMINDKYMBERLEE PRICESENIOR DIRECTOR OF RESEARCHER OPERATIONSWHOAMI?
• Senior	  Director	  of	  a	  Red	  Team• PSIRT	  Case	  Manager• Data	  Analyst• Internet	  Crime	  Investigator• Security	  Evangelist• Behavioral	  Psychologist• Lawful	  Good@kym_possible

AGENDA• People• Process• Infrastructure	  and	  Technology• Pitfalls• Free	  ResourcesBUT WHAT ABOUT ISO STANDARDS!?
• In	  April	  2016	  ISO	  29147 on	  Vulnerability	  Disclosure	  techniques	  was	  made	  free	  to	  the	  public.	  
• This	  is	  awesome• The	  related	  standard	  on	  vulnerability	  handling	  processes, ISO	  30111 costs	  approx$60	  USD.	  	  PEOPLECOMMON SIRT STRUCTURES• Technology•

User	  Action	  Not	  Required

Tech	  Program	  Manager

Tech	  Program	  Manager	  (optional)

Security	  Engineer

Security	  Engineer

Cloud/Service	  or	  Installed	  Software?

• Resources•User	  Action	  Required$$$Comms(optional)

T YPICAL ROLE RESPONSIBILITIESTech	  Program	  ManagerTriage

Documentation

Prioritization

ReportingWrite	  Advisories

Security	  Engineer

Technical	  Repro

POC	  Exploit

Code	  Review	  &	  Variant	  Hunting

Validate	  Fix

Review	  Advisories

Comms

Review	  Advisories

Customer	  Support	  Liaison	  Press	  Releases	  &	  Response

PROCESSSDL OVERVIEW

Training

Requirements

DesignImplementation

Verification

ReleaseResponse

INCIDENT RESPONSE PROCESS

1

Identify	  Issue

2

Assess	  Impact&	  Test	  3 Dev	  Fix

So	  you’re	  a	  software	  vendor…

4Release	  w/	  CVE	  5Post	  Release

1

Identify	  Issue

2

Assess	  Impact&	  Test	  3 Dev	  Fix

Release	  fix	  4 (+advisory?)

5Post	  Release

INTERNAL POLICY• Define	  your	  Vulnerability	  Prioritization	  model	  ••CVSS	  or	  something	  else?
What	  are	  your	  acceptable	  business	  risks?

• What	  are	  your	  remediation	  SLAs?	  Escalation	  paths?
• When	  do	  you	  release	  a	  public	  advisory?
• When	  is	  emergency	  response	  indicated?

INFRASTRUCTURE & TECHNOLOGYPUBLIC DOCUMENTATION• Vulnerability	  Disclosure	  Policy	  ••Critical	  for	  expectation	  setting
Tells	  researchers	  how	  to	  report	  a	  vulnerability	  to	  you• Security	  Advisory	  Knowledge	  Base•

Where	  do	  customers	  go	  to	  quickly	  learn	  about	  security	  updates• Researcher	  Acknowledgements•

Recognize	  positive	  behavior	  and	  build	  community

TOOLKIT• How	  do	  you	  want	  to	  receive	  external	  vulnerability	  reports?
• Unstructured:	  encrypted	  email• Structured:	  secure	  web	  form

• How	  do	  you	  want	  to	  capture	  investigation	  details?
• Case	  management	  db (doesn’t	  have	  to	  be	  complicated,	  can	  be	  specific	  fields	  captured	  in	  Jira)TOOLKIT• Do	  you	  use	  third	  party	  code?
• Source	  code	  scanning	  tool	  to	  track	  what	  you	  use,	  where• Vulnerability	  Intelligence	  sources• HIGHLY	  RECOMMENDED:	  OSS	  SECURITY	  MATURITY:	  TIME	  TO	  PUT	  ON	  YOUR	  BIG	  BOY	  PANTS!
Jake	  Kouns & Christine	  Gadsby,	  Jasmine	  Ballroom,	  2:30	  pm

DATA MANAGEMENT FOR SIRTS• What	  Developers	  need	  to	  know	  to	  fix	  vulnerability• What	  Leadership	  needs	  to	  know	  about	  business	  risk	  • What	  Customers	  need	  to	  know	  about	  product	  security• DOCUMENT	  at	  time	  of	  investigation	  even	  if	  you	  don’t	  use	  the	  data	  until	  much	  laterPITFALLSPITFALLS• Failure	  to	  thoroughly	  document	  vulnerability	  details	  during	  investigation,	  leading	  to	  re-­‐investigation	  just	  prior	  to	  fix	  release	  to	  remember	  what	  the	  issue	  was• Failure	  to	  prioritize	  effectively••

Adopt	  a	  prioritization	  model	  that	  considers	  both	  technical	  and	  business	  impact
Define	  your	  acceptable	  business	  risks• Failure	  to	  define	  clear	  stakeholders	  and	  roles	  in	  Incident	  Response	  Process• Failure	  to	  communicate	  effectively	  with	  product	  development

PITFALLS• Failure	  to	  communicate	  with	  external	  researchers	  about	  status	  of	  their	  vuln reports•Trust	  problems	  lead	  to	  conflict,	  conflict	  costs	  money• Failure	  to	  prioritize	  effectively•

Adopt	  a	  prioritization	  model	  that	  considers	  both	  technical	  and	  business	  impact• Failure	  to	  define	  clear	  stakeholders	  and	  roles	  in	  Incident	  Response	  Process•

Trust	  but	  verify• Failure	  to	  communicate	  effectively	  with	  product	  development

FREE RESOURCES• Disclosure	  policy	  basic	  template:	  • Investigative	  data	  collection	  checklist• Advisory	  checklist• ISO	  29147	  https://pages.bugcrowd.com/best-­‐practices-­‐for-­‐security-­‐incident-­‐
response-­‐teams

QUESTIONS
Thanks	  for	  attending!

@kym_possible
kymberlee@bugcrowd.com