TribeQonf2024_Dimpy_ShiftingSecurityLeft

Embedding Sewcurity Throughout Agile Workflow

1. Dimpy Adhikary Quality Analyst * Embedding Security Throughout Agile Workflow India's Premium-most and Largest Testing Conference

2. Embedding Security Throughout Agile Workflow Experience On Reactive vs. Proactive Security Approaches. Benefits of Integrating Security Into Team Culture. Context

3. Embedding Security Throughout Agile Workflow Key Statistics: +34 new adversaries 232 total adversaries tracked 75% increase in cloud environment intrusions 76% increase in eCrime victims on dedicated leak sites 110% increase in cloud-conscious cases 84% of cloud-conscious intrusions focused on eCrime CrowdStrike 2024 Global Threat Report

4. Embedding Security Throughout Agile Workflow Agenda The Challenge In Reactive Security Approach Ways Of Shifting Security Left Lessons Learnt

5. Embedding Security Throughout Agile Workflow Security Testing After Deployment Key Challenges: Security Testing Is Deprived Of Needed Attention And Time . No Single Tool for Comprehensive Security In Sprint Security Testing Is Not Feasible Multiple Attack Surfaces Microservices Level Third-Party Dependencies Containers Cloud Infrastructure - Compliance Requirements

6. Embedding Security Throughout Agile Workflow Shifting Security Left Enforcing Security Policies Early Using Tools And Techniques Continuous Monitoring Training And Collaboration

7. Feature - Email Subscription To A Daily Newsletter As a User , I want to Subscribe to the daily newsletter, So that I can stay updated with the latest news and updates. As an Attacker , I want to Exploit the email subscription feature So that I can harvest a large number of valid email addresses For spamming or selling on the black market. Embedding Security Throughout Agile Workflow

8. The First Step - Threat Modelling Map the System: Identify Assets, Actors, Interactions Brainstorm Threats: Consider Vulnerabilities and A ttack vectors . Mitigate & Prioritize: Define Controls and Assess Remaining Risk. Embedding Security Throughout Agile Workflow

9. Map The System Embedding Security Throughout Agile Workflow

10. Embedding Security Throughout Agile Workflow

11. Security In The Code & Build Phase Embedding Security Throughout Agile Workflow

12. Security In The Testing Phase Embedding Security Throughout Agile Workflow

13. Embedding Security Throughout Agile Workflow

14. Security In The Monitoring Phase Application Activity Monitoring Tools New Relic, Datadog, Splunk User Account Monitoring Tools: Okta, Auth0, Microsoft Azure AD Network Traffic Monitoring Tools: Wireshark, SolarWinds, Snort Infrastructure Monitoring Tools: Prometheus, Nagios, Zabbix Compliance Monitoring Tools: Tripwire, Qualys, Rapid7 Embedding Security Throughout Agile Workflow

15. Embedding Security Throughout Agile Workflow Security Tools Landscape

16. Learnings From Shifting Security Left Foster Security Training And Awareness. Incorporate Security From The Planning Phase. Adopt Secure Coding Standards . Promote Automated Security Testing. Continuous Monitoring and Logging. Embedding Security Throughout Agile Workflow

17. Happy Testing ! Dimpy Adhikary dimpyad Embedding Security Throughout Agile Workflow