orange
is the newpurple
how and why to integrate software
teams with red and blue teams
aprilwrightAgenda:Terminology and concepts
Explore the current "gap" impacting software security
New ideas for bridging the divide
Ways to create change
Pragmatism about process maturity

orange is the new purple

We have different primary directives
Security's goals:

Builder's goals:

Create it securely

Time to market

Maintain it properly
Prove it’s protected
Document everything

Correctness
Minimal defects
Optimization ** (Chuck Norris writes codethat optimizes itself)orange is the new purple

current status:orange is the new purple

Can we overcome:• Lack of communication?
• Non-matching goals?
• Speaking different"languages" & "jargon"?
• Siloes of knowledge?
Can we work together?

orange is the new purple@APRILWRIGHTInfoSec Generalist, Security Expositor @Verizon~25 years, advanced Management and Defense,
Offensive Testing, Defensive SDLC, Change, eGRC,
Detection, DF/IR, Coding, Hacking, Gaming, SecOps (Blue Team), Soft Skills, Unix Ops, SQL, Risk,
Web App Dev, Graphic Design, Photography

@aprilwrightorange is the new purple

Software challenges: Security's view
§ Unknown scope of applications, libraries (Builders know this!)§ Everyone is averse to testing in production§ Why doesn't everyone just 'get it'?
§ Bugs are being remediated reactively, not proactively§ Inability to sustain iterative release testing§ “Organizational and communications silos between security,application development and the rest of the organization”--SANS: 2016 State of Application Security: Closing the Gap

orange is the new purple

Everyone contributes to thesecurity of an organization( we are on the same team )There is hope forcreating moresecure software
Builders want to learn
about security!
Security wants toshare knowledge!

orange is the new purple

Bob Cat the Builder by CaptainScratch

Organizations
embrace crosstraining (generally)Because#infosec
loves
triadsBreakers(Red Team)

Guardians(Blue Team)

Builders(Yellow Team)#0F0 green

orange is the new purple#FF0
yellow#F00
blue#FFA500
orange#F00
purple#F00 redHEXorange is the new purple

purplegreen

orange#PURPLEteam(#800080)
purpleteam?

security teams
working
together ops security: coverage, detection
focus
on improving
identifying known exploits in an environment
finding unknown integration problems
vulnerabilities are lessened over time, but not iforange is the new@aprilwrightpurple

orange is the new purple

Introducing…
#ORANGETEAM#GREENTEAM^^ this is an actual photo!

Unity is strength;
when there is
teamwork andcollaboration,
wonderful things
can be achieved-- Mattie Stepanekorange is the new purple

orange is the new purple#ORANGETEAM (#FFA500)
Breakers + Builders
Developing a threat-mindset•

Builders benefit from current, relevant exposure to evolving
security threats•

Ongoing insight into the breaker mindset•

Open-door policy between teams•

Red team finds less of the same bugs over timeorange is the new purple#ORANGETEAM (#FFA500)
Goals:•Collaboration leads to identification of related problems•

Offensive critical thinking included in builder's personalframe of "correctness" + "accuracy"•Can avoid "misuse cases"•Decrease in overall security bug counts over timeorange is the new purple#GREENTEAM - #0F0
Guardians + BuildersImproving Defenses• Address issues related to Forensics and Incident Response• Tune and improve detection capability• Gain better visibility built into important functions• Standardize and enhance logging

orange is the new purple#GREENTEAM - #0F0
Goals:• Gaps in detection are closed• Known-insecure code is more closely watched• Improve introspection capabilities• Thorough, standardized audit trails• Software integrates with Security tools and automation

orange is the new purple

Practical introductory SDLC
§ Start with a checklist§ Think backwards from launch§ What needs to be done?
§ Who needs to be involved?
§ What does Security need to see?
§ Create gating conditions for each phase§ Cloud Security Alliance has great resources!
§ …Even if you're not doing cloud, many same principles applyorange is the new purple

Project Managers can help you achieve your goals§ Present your checklist to the PMO as "requirements for launch"§ Work closely with PMO on expectations§ PMO can plan to incorporate checklist items into the timeline§ Policy should mandate Security become engaged as early aspossible§ Explain the value of "misuse" cases (vs "use cases")Privacy Questionnaire- Identify stakeholders- What sensitive data will be stored?
- Where will sensitive data be stored and transmitted?
- What mitigations will be used to protect that data?
- What is the risk if the data is exposed?
- What needs to happen if there is exposure?

orange is the new purple

Each SDLC phase needs a checklist§ Requirements§ Design and Architecture§ Development andImplementation

orange is the new purple

Sample "Requirements" Checklist§ Step One: Engage security to participate in project§ Define project scope§ Identify target compliance goals and determine a compliance timeline§ Contribute security to Use Cases§ Security approval on all other Use Cases§ PM generates concept, timeline, budget, everyone agrees or makeschanges as-needed§ Obtain Security's approval to proceed.

orange is the new purple

Use Cases and Misuse Cases
USE Case:"As an admin, I need to be able to change one of our users' passwords"
Acceptance Criteria:
Administrators are able to change another user's password under the same
security context/accountMISUSE Case:"As a non-admin, I want to be able to change another user's password"
Acceptance Criteria:
Non-administrators are not able to change any other user's password.

Ideas for reusable Use Cases
The Cloud Security Alliance CCM (Cloud Controls Matrix)

orange is the new purple

Tailoring the CCM
Control Specification:
Internal corporate or customer (tenant) user account credentials shall be restricted as per
the following, ensuring appropriate identity, entitlement, and access management and inaccordance with established policies and procedures:• Identity trust verification and service-to-service application (API) and information
processing interoperability (e.g., SSO and Federation)• Account credential lifecycle management from instantiation through revocation• Account credential and/or identity store minimization or re-use when feasible• Adherence to industry acceptable and/or regulatory compliant authentication,authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-sharedauthentication secrets)orange is the new purple

Tailoring the CCM
Use Case:
As an Administrator, I want to ensure that my user account credentials are restricted as
per the following, ensuring appropriate identity, entitlement, and access management andin accordance with established policies and procedures:
Acceptance Criteria:• Identity trust verification and service-to-service application (API) and information
processing interoperability (e.g., SSO and Federation)• Account credential lifecycle management from instantiation through revocation• Account credential and/or identity store minimization or re-use when feasible• Adherence to industry acceptable and/or regulatory compliant authentication,authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-sharedauthentication secrets)orange is the new purple

Sample "Design/Architecture" Checklist§ Develop prototype design that addresses both Security Requirements
and Functional Requirements§ Create network diagrams§ Create data flow diagrams§ Review diagrams with Security§ Incorporate Security's feedback, as-needed§ Ensure capacity is allocated for Security-related functions (e.g. SIEM
server, span ports available on a switch, separate VLANs for storage andadmin traffic.
§ Security review for selection of vendors, supply-chain§ Obtain Security's approval to proceedPerform agap assessment
on all vendors
Vendor security
should beas good as
your security(or better)orange is the new purple

Sample "Development/Implementation" Checklist§ Users created within the Application for authenticated penetration testing§ SNMP traps setup, Logging to centralized SIEM
§ Secure Baseline is used for all O/S and supporting applications§ Procedural and Process documentation is created§ A patch management process and procedure is created§ Monitoring and related Access Control Lists are put in place§ NIDS, HIDS, HIPS are configured and tested§ Vulnerability scanning and Internal Pen Testing have been performed§ Remediation has occurred, based on Testingorange is the new purple

Handling the Checklists§ Provide ALL checklists up-front to the PMO§ Be prepared to explain HOW to initiate each process you arerequiring§ Completed checklists are Compliance Artifacts§ Store in a backed-up repository§ Store for an adequate amount of time
§ Protect based on Privacy requirements§ Tailor the checklists to each project – not every control will apply

Your first attempts will be incomplete, but it's
okay… All programs have to start somewhereorange is the new purple

orange is the new pCULTURE
CHANGE
DOES NOTHAPPENOVERNIGHT

orange is the new purple

Initiate change, be patient• Solidify your goals with organizational policy (it all starts there!)• Foster a "one team" mentality (it is not "us vs. them")• Facilitate frequent opportunities for communication• Eliminate obstacles to sharing (collaborative systems, politics)• Allocate time for ongoing, practical interaction and training• Positive reinforcement for software builders' good choicesorange is the new purple

Gaining management buy-in•

Objectively gathered Metrics / Statistics are influential•

We need to communicate risks:••

Bug found in requirements phase may cost $1 to fix. Samebug may cost $5 during design, $50 during development,$500 during testing, and $Millions if found by an attacker•

Harm to the brand•

Legal implications

Risk Management Program results and scoringorange is the new purple“The geography we havecreated is all about speed,
convenience, and scale;
Security is an afterthought.”— General Michael Hayden,
retired head of CIA, NSA

orange is the new purple

Remember…
• Security should never be an afterthought• Application builders and defenders should be a team• Orange and Green teams do not need to be formal activities• Teach, learn & connect with each other• Make every interaction as positive as possible• Use policy, process, procedures to formalize requirement• Be patient – security initiatives can require perseverance

#ORANGETEAM
ArchitectSecurity.org
aprilwright
Please provide
feedback to BlackHat
for this session! Jorange is the new purple

enjoytheconJ