Veracode Base Camp — Shuning, Veracode Community Manager (Veracode) asked a question.
Hi community! This morning, @Mark_M (Community Member) will be speaking at the monthly customer webinar and will be sharing "The Human Side of DevSecOps" and how to tie Agile’s Definition of Done (DoD) to each tenet (find the recording of this webinars as with others in the past here; you can also find the deck in the Customer Lounge group) The foundational requirement for applying any of these security principles is having “Security Champions” on the dev team. We’re excited to keep the conversation going through this Ask Me Anything session with Mark.
- Date: Now through 6/25
- How to participate: Post a question below
- Ask Mark anything about the security champion programs, such as:
- How do I get started with security champion programs?
- I’m a developer, what are the benefits of becoming a security champion? What skills or experience do I need?
- What are the content recommendations for Role-Based Secure SDLC training for security champions?
- How do I measure the success of the security champion programs?
- 🎁 We’ll raffle off one of Mark’s books to one lucky community member who posted a question below by 6/25.
Start submitting questions now!
About @Mark_M (Community Member) |
Mark is a security professional with over two decades of experience in IT Security and Application Security. As a strong advocate for “Shift Left,” Mark practices what he preaches by helping companies across multiple industries build Security into the SDLC. He’s also author/co-author of 14 published books on IT and IT Security, two of which are specific to software security. He was selected as a Star Member of the Veracode Community in 2021. Learn more about him in the Star Member Spotlight interview.
.png){kind=logo}
Really great presentation today!
Thank you @ScottyGoSW (Community Member) for the feedback! If there's anything you'd like to learn more about from today's webinar - not necessarily related to security champion is fine! - feel free to post it here!
Thank you ScottyGo! I appreciate you taking your time out of your busy schedule to listen in! I'm thankful to Veracode for making it happen!
Best regards,
Mark Merkow
Hey @Mark_M (Community Member) , I have a lot of respect for your dedication to the community and your experience. I'd love to know how to measure the success of the security champion programs? What sort of metrics do you find useful for showing value?
Hello EGertis!
Thanks for your kind words!
You asked a great question! Measurements and metrics for the sec champion program is tricky. Most people are there as 'volunteers' so without broad management support from all teams that have a sec champion, we can't really 'force' them to attend and participate in events and meetings. That being said, one option that we found helpful is to give the network of sec champions a multitude of opportunities to engage, participate, and contribute.
A minimum of one activity each quarter opens these doors and gives us some insight on what the network wants or needs to be successful. A bi-monthly All Hands Meeting of the network, with encouragement from the AppSec Team to find a member (or two) willing to present a topic of interest to all sec champions - could be an improvement on how Veracode SAST scans are triaged or how Veracode defects can be easily moved to Jira, ADO, or other tool developers use for defect tracking, or any other topic that's current and relevant. Sometimes, these sec champions have some reusable code that's a possible candidate for a custom cleanser in Veracode to reduce the work of running scans and remediating defects. As network members share with other members in a public forum, they tend to become stronger security champions.
Other engagement ideas include Brown Bag Lunches where an external expert comes in to talk and share with the network. Veracode has done this a few times for us already to great reception! Other ideas are Cyber Ranges where individuals or teams compete to earn prizes, but more importantly - earn recognition and bragging rights!
In each of these engagements, there's an opportunity to measure some aspect of it - participation, attendance, number of reusable code solutions presented or shared among the network, number of network members who complete advanced courses in AppSec (like through Veracode learning, Pluralsight, SANS, etc.), and those who earn certifications (like CSSLP, GIAC certs, etc.)
The main point is that counting things is nice (and easy), but the most impactful measures involve those that give the network opportunities to engage and succeed, and making sure EVERYONE knows about it when it happens. People tend to become your best advocates when they're recognized as they shine!
Is this helpful at all?
Thanks for your question!!!
Mark Merkow
Hi @Mark_M (Community Member) ,
Indeed it was great informative session that covers all the different aspects. I managed to see the recorded session.
During the session you mentioned that not all the applications require Threat Modeling, can you please explain on what bases you choose when to do Threat Modeling and when not to do? Also, Microsoft Threat Modeling tool doesn't have templates for AWS - how would you prefer to model AWS based application with the use of Microsoft TMT.
Regards,
Hemant
Hi Hemant!
Thanks for your questions.
Right - not every application needs to be threat modeled. Here's a few considerations of what the application is intending to do or currently does that might suggest a threat model is useful. It might also help you decide when mitigating a defect is a better choice than remediating the defect:
As far as tooling for threat modeling, mostly it's a personal choice or a budgetary choice. For the free tools, you do get what you pay for. There are several other threat modeling tools in the marketplace that take care of virtually any internal or cloud-based operating environment. ThreatModeler is one of them. OWASP's Threat Dragon is another (even if it's free!). The best way to get started with threat modeling, IMHO, is using a face-to-face group meeting that does not rely on anything more than existing system flows, data flows, architectural designs, or even use cases to get the discussion going. Like building a user story, the true value of the effort is getting everyone talking and putting themselves in the shoes of an attacker to try to see what assets they can compromise, even using simple tools like STRIDE and DREAD to get things going. Once people 'get it' and experience threat modeling through a couple of rounds conducting one, then automating it makes more sense. Coming in fresh and unaware of what threat modeling expects to accomplish by using a tool off the bat is an almost certain recipe for failure.
Was this helpful?
Thanks!
Mark Merkow
Thanks Mark for the response, this is really useful.
@Mark_M (Community Member)
Is it essential to stick to a particular threat modelling methodology or use a combination of one or two ?
What determines the type of methodology an organization should use ?