Resources for Talk: Prioritizing Trust while Creating Applications
Tags: devops, security
Published: 2019-11-06 12:11:21

---
title: Resources for Talk: Prioritizing Trust while Creating Applications 
published: true
description: Time and money are generally the resources we focus on when building applications. Yet we can’t buy trust; it builds slowly and can be broken quickly when we don’t factor it in to our development process. In this talk, I examined how to leverage security practices to enable an all-team approach to security. In this post, I share resources from that talk.
tags: devops, security
cover_image: https://thepracticaldev.s3.amazonaws.com/i/ikqo9n6ksadidvhid5jo.jpg
---

Time and money are generally the resources we focus on when building applications. Yet we can’t buy trust; it builds slowly and can be broken quickly when we don’t factor it in to our development process. In this talk, I examined how to leverage security practices to enable an all-team approach to security to help maintain and build that valuable but intangible resource of trust.

I've given this talk at a few conferences including Create Startup Tour, Toronto, devopsdays Portland, devopsdays London, SRECon EU, and Velocity. Over this time, I've updated the slides and the resources. Here are the up-to-date resources in an easily accessible list. This is by no means an exhaustive list of the quality resources in this space. 

You can find the current slides on [Speaker Deck](https://speakerdeck.com/iennae/prioritizing-trust-while-creating-applications-devopsdays-chattanooga-2019). Earlier versions of this talk are here:

* [DevOpsDays London version of slides](https://speakerdeck.com/iennae/prioritizing-trust-while-creating-applications) 
* [SRECon EU slides and video](https://www.usenix.org/conference/srecon19emea/presentation/davis)
* [Velocity slides](https://speakerdeck.com/iennae/prioritizing-trust-while-creating-applications-c0e11d1d-235a-4d73-99c1-ef03492aa877)
* [DevOpsDays Chattanooga 2019 slides](https://speakerdeck.com/iennae/prioritizing-trust-while-creating-applications-devopsdays-chattanooga-2019)

## Websites

* [Check whether an account has been compromised in a data breach on https://haveibeenpwned.com.](https://haveibeenpwned.com/)
![Example output from compromised account on https://haveibeenpwned.com/ with details about Apollo, Cafe Press, and Canva compromised data.](https://thepracticaldev.s3.amazonaws.com/i/gss438tsvymxajslheuj.png)
* [Verizon Data Breach Report](https://enterprise.verizon.com/resources/reports/dbir/)
* [Example of attack.](https://www.reuters.com/article/us-thyssenkrupp-cyber-idUSKBN13X0VW)
* [Snyk State of Open Source Security Report - 2019](https://snyk.io/opensourcesecurity-2019/)
* [Pushing left series from Tanya Janca](https://dev.to/azure/pushing-left-like-a-boss-part-1-4d9i)

### Designing with Security Focus

* [OWASP Application Security Verification Standard Project](https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project)
* [Microsoft Threat Modeling Tool](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling/?WT.mc_id=devto-blog-jedavis)
* [OWASP Threat Model Project](https://www.owasp.org/index.php/OWASP_Threat_Model_Project)

### Testing 

* [Example of issue that could have been prevented with linting]( https://www.imperialviolet.org/2014/02/22/applebug.html)
* [Compliance as Code](https://www.inspec.io/)
* [Microsoft Security Risk Detection - Fuzz Testing](https://www.microsoft.com/en-us/security-risk-detection/?WT.mc_id=devto-blog-jedavis)
* [Learn all about testing with the Test Automation University](https://testautomationu.applitools.com/)

### Incident Response

* [Minimum Viable Response Plan by Jason Hand](https://jhand.co/CreateResponsePlan)

### Leverage your platform's features and understand limitations

* Azure
 * [Azure Security Foundations Benchmark (DRAFT)](https://azure.microsoft.com/en-us/blog/cis-azure-security-foundations-benchmark-open-for-comment/?WT.mc_id=devto-blog-jedavis) 
The [Azure Security Center](https://docs.microsoft.com/en-us/azure/security-center/?WT.mc_id=devto-blog-jedavis) has a _free tier_ that is automatically enabled on all Azure subscriptions and provides security policy, continuous security assessment, and actionable security recommendations to help you protect your Azure resources. 
 * [Central documentation for Azure Security Center](https://docs.microsoft.com/en-us/azure/security-center/?WT.mc_id=devto-blog-jedavis)
 * [Azure Learn Module for Azure Security Center](https://docs.microsoft.com/en-us/learn/modules/identify-threats-with-azure-security-center/?WT.mc_id=devto-blog-jedavis)

### Level up Security Skills

* Capture the Flag Resources
 * [CTF with Google](https://capturetheflag.withgoogle.com/)
 * [CTF Circle](https://twitter.com/CTF_Circle) - CTF distributed team for Nonbinary Folks and Women
* [OWASP Juice Shop Project](https://www.owasp.org/index.php/OWASP_Juice_Shop_Project)
* [Azure Learn Modules for Security Operations](https://docs.microsoft.com/en-us/learn/paths/manage-security-operations/?WT.mc_id=devto-blog-jedavis)

## Twitter 

These are a few interesting accounts on Twitter of folks that care about security and privacy. 

* [Jam](https://twitter.com/jamfish728)
* [Ian Coldwater](https://twitter.com/IanColdwater)
* [Tinker Fairy](https://twitter.com/TinkerFairy_Net)
* [Teri Radichel](https://twitter.com/TeriRadichel)
* [Tanya Janca](https://twitter.com/shehackspurple)
* [Cariad](https://twitter.com/KateLibc)
* [Jenessa Petersen](https://twitter.com/JPinTech)
* [Sarai Rosenberg](https://twitter.com/saraislet)
* [Victoria Drake](https://twitter.com/victoriadotdev)
* [Christopher Harrell](https://twitter.com/0x636e68)
* [Yolonda Smith](https://twitter.com/ysmithnd)
* [Luis Saiz Gimeno](https://twitter.com/lsaiz)
* [Christina Morillo](https://twitter.com/divinetechygirl)
* [Quiessence Phillips](https://twitter.com/itsquiessence)
* [Alison Gianotto](https://twitter.com/snipeyhead)
* [Pamela Dingle](https://twitter.com/pamelarosiedee)
* [Victoria Drake](https://twitter.com/victoriadotdev)
* [Kelly Shortridge](https://twitter.com/swagitda_)
* [Ana Oprea](https://twitter.com/0xa6ea)
* Contact [CTF Circle](https://twitter.com/CTF_Circle) to get access to the CTF distributed team Slack for Nonbinary Folks and Women 
* [OWASP](https://twitter.com/owasp)
* [WoSEC](https://twitter.com/WoSECtweets)

## Slack

* [CTF Circle](https://twitter.com/CTF_Circle), a CTF distributed team Slack for Nonbinary Folks and Women 

## What's Next?

I've shared some different practices, technologies, and examples of specific tools that can help you adopt security within each phase of the development lifecycle in my presentation. What do you do next? 

* **Identify** your team's strengths and weaknesses. How much security is in each part of the development lifecycle. 
* **Assess** where the biggest value is for you now; for example red teaming your application might not be a great use of people's time if you don't have adequate response processes in play to handle incident. 
* **Level up security knowledge** across the team. The earlier that security flaws and bugs are discovered in implementation the easier that it will be to repair them. No matter how much prevention you invest in, there will be vulnerabilities discovered after deployment so make sure that your response process is carefully thought out.
* **Incorporate feedback from each phase.** 
* **Update the threat models** you have to reflect the knowledge you gain from the systems in use. 

Do you have resources that you'd recommend? Please share below and I'll update this page to include them.