Agile in Cybersecurity at SKILup Days 2024

Hi everyone. Welcome to, uh, nt. Also, welcome to my session.

My session is Cybersecurity in the Agile methodologies. Another name is Agile Security or their SecOps. In this, uh, session, I will, uh, details about the cybersecurity in the agile methodologies.

How can integrate cybersecurity in the agile, uh, project? And what's the best practice of this, uh, uh, integrate cybersecurity in agile, uh, teams and agile project. At first, I want to give a summary about to me, I am, I am founder.

I have cybersecurity companies. I am freelancer cyber consultant, ation test instructor, instructor. I have some cybersecurity courses in the training platforms.

I have 20 years experience about software development and spaces software security. I wrote 17 books about, uh, software security, such a API security, cloud software, supply chain security, blockchain, and blockchain security. This is my, uh, LinkedIn, uh, con connect and email addresses.

At first, I want to introduction the Agile and cybersecurity. What is the agile methodology? Agile methodology is a project management approach that involves, uh, breaking the project interface and point of continuous collaboration and improvement.

Uh, this continuous, uh, collaboration and important topic for cybersecurity because cybersecurity teams need to collaborate another teams like developers, operation teams. Also, it's very important, important part. Another important part, improvement because cybersecurity or security needs the improvement because always new vulnerabilities, uh, adapt in the application or network or system.

There were cybersecurity needs, uh, work together and other teams and always continuous improvement. So why security? Essentially in agile?

At first, cyber, uh, threats, uh, involve as a quickly as a agile project. General agile project is software project. The cyber, uh, threats is involved as quickly they need, uh, release, uh, when the developers, uh, write new code and for the new release, general software project has new vulnerabilities.

Another thing, new security vulnerabilities can produce frequent release. So, uh, therefore ever these new security vulnerabilities can, uh, produce very frequently. It can be, uh, like the security must be, uh, continuous, uh, job and need to collaboration and improvement.

Also, balancing speed and securities essential for the building software. What does this means generally? Um, uh, at the same time, some vulnerabilities in the software application they need to fix immediately.

Especi these findings is critical or high findings. High vulnerabilities is, uh, vulnerabilities have to, uh, fix, uh, immediately and very faster. Therefore, it's balancing speed and securities very important for those security applications.

Uh, at the same time, cybersecurity is challenging in the agile, uh, system ent, security tension, what it means. Agile generally encouraged to repeat delivery because agile makes everything faster, faster. Uh, therefore, uh, agile team try to be very fast about the new release, but it is can need to overlook the security risk because all security risk or security vulnerabilities cannot fix immediately.

The agile team need to extra time to fix these new findings or new vulnerabilities can be challenging for the, uh, securing the agile teams. Another one, uh, change and updates. Uh, more release cycles means more frequent testing and more opportunity for the vulnerabilities.

Generally in the dev SecOps topline, uh, they, uh, security tools integrate adopts pipeline. These tools integrated and they choose scan the software project, uh, continuous load, and automatically, therefore, they have the, uh, when developer teams or agile teams, uh, have new release, these tools can again and find new vulnerabilities. Because of this reason, it can be, uh, a bit, uh, problem for the software developer team because they have to fix the, these vulnerabilities before the release, but they need extra time for the fixed this, uh, finding team dynamic.

Uh, agile teams often prioritize functionality leaving security console for letter because they wanna, uh, release the repeat delivery very fast. They might wanna make the job very fast, but, uh, because of this is, and they said that we can fix these vulnerabilities for this re uh, release for later after we commit the source release. It can be a bit challenging and a problem for the agile team.

Uh, shift light is cyber is agile, is, uh, important and helpful to pitch because shift led in moving sacred concentration in early in the development lifecycle. Uh, when the software, uh, developer start new software project, uh, they, uh, draw the software archite in the plan stage of the software development lifecycle. They have to integrate, uh, security in the, uh, this software architecture, so they can see the, some security risk in the beginning of the dev, uh, software development life cycle.

So they have to work also security team with see this security risk and or any, uh, they maybe sometimes they need security requirement to secure. The software project is, uh, things is started thinking in the beginning of the software development lifecycle. So, and, uh, a jet team is identified vulnerabilities early, reducing the cost we work.

Also, it's very time selling. So like this identified vulnerabilities or, uh, see the security risk about the project in the beginning, the, in the beginning of, uh, development life cycle. They can fix, uh, it very early.

Also, they can collaborate security team or other team to, uh, for this, uh, security requirements to implement. Uh, so, uh, agile project in the beginning of the software development lifecycle also, uh, empower, uh, developers with security responsibilities leading to share accountability. They start to work in be, uh, with another teams like, uh, maybe sometimes security teams, sometime network or operation teams to implement this, uh, security department in the beginning of the project.

So they have collaboration. Also. They shared responsibility.

Another teams. This helps to, uh, collaboration and communication other team. Also, it's help to, uh, create, uh, security culture in the, uh, company or organization generally, uh, organization or companies using the shift left tools and practice for the agile system.

This first one is, uh, uh, general static application security testing tools. It's sa, SA tools is general scanned source code and find vulnerabilities for the source code of software project. Another one, dynamic application security testing is the task tools.

This is scan the software project from the user interface and finding vulnerabilities from the user interface. Uh, also, um, you know that it's, uh, then you, uh, integrate security in the DevOps pipeline. Uh, SecOps, uh, DevSecOps, sorry.

So, uh, when you, any other security tools can I integration, integrate from the con integration and context deployment security integration. So not only a static or dynamic test, security testing tools and other security tools can be integrated ops pipeline and this, uh, deductive vulnerabilities from the Agile project, uh, continuous security testing in the Agile. Uh, after the, uh, teams integrate this, uh, tools from the their DevOps pipeline, these, uh, tools, uh, scanned the project automatic land continuously.

They integrated one times, and then these tools automatically scanned the project with each build of the project or each release. Uh, also, uh, they, some dependencies can important because, uh, recent years, uh, at least 50% of the software project is include third party libraries. It's, uh, commercial or open source components or frameworks.

Therefore, these tools automatic check for the vulnerability vulnerable libraries or packages. Therefore, so these, uh, uh, scanning tools find any vulnerable package libraries or framework. Uh, therefore the developer teams need to fix these, uh, com or libraries.

Another important thing, uh, continuous feedback loops. They like this, uh, higher critical findings or vulnerabilities they need. I immediate feedback on security risk.

Agile teams act faster. Survey, integrate cybersecurity agile team. They have, uh, continuous feedback, continuous work together, continuous collaboration and continue promote, promote about security.

At the same time, developer teams use, uh, learning to how can the fix the, uh, new vulnerabilities. They also learn new vulnerabilities in their software project because always continuously their projects, uh, scan by the tools, security tools. Uh, so how can integrate the cybersecurity in the agile sprint, uh, general at first, uh, sprint planning, and they include, uh, security task.

As a part of the spring planning, it's start to dislike the security test in the beginning of the software development, like, uh, lifecycle, like a planning stage. Then, uh, this task is defined security done criteria for the feature release. So developer, uh, or any HR team member, when they fixed this secure task, they need to secure done feature for the release.

Also, uh, uh, another, uh, things is implementing secure coding practices and vulnerability skin in the definition of the done generally, after the tools is su or dust to scan the, uh, software project, uh, software project, they, uh, take the vulnerabilities and they give severity, like high critical, medium or low. These, uh, findings or vulnerabilities can be adding for the, uh, supreme plan, like a security test. Uh, task and developer teams have to fix the, these, uh, security, uh, finding in the discipline in this part of the planning can be had for the, uh, continuous s uh, limitation, uh, process.

Another one, trading modeling In Agile, this is the general threat. Modeling is hard to, uh, trading potential security risk at the planning stage. So always the planning stage and software architecture, they can, uh, light the threat modeling.

It can be include new feature or changing and threat modeling site. It can be good integrated threat modeling, uh, uh, takes or in the any task in the spring plan and agile. Uh, so with working like this is cyber in agile spring, it's, uh, prioritize security stories.

So, uh, so, uh, agile teams know the, uh, prioritize the which, uh, vulnerability or security risk fix. Uh, also it's very helpful to, uh, take address security needs iteratively. It's help to prioritize, uh, security risk for the agile teams or software developer teams.

Uh, also agile help moving the security, uh, culture in the agile team. Uh, generally agile team has a, a security champion person in the team. He or she's a team member, agile team member.

This persons generally designed the team member, the security support there. Generally, this person have the, the team, agile team about security side and security, uh, support the, uh, agile team need, do anything about security. This persons generally improve the skills about security side.

Also, another important things, ongoing security training because, uh, every police, uh, has generalist scan by the security tools. Therefore, after the detect vulnerabilities, developer teams or agile team member needs to fix this finding vulnerabilities. Therefore, they need to always, uh, train regular workshop or training session for the agile team members, it's good for the dislike training.

For example, a developer or agile team start a new project, then they, uh, write the code or plan site or design site. They remember this information from the previous project. They don't do the same.

Uh, same mistake in the new project. Therefore, ongoing security training is important for the agile team member. Also, collaborative accountability.

It's generally developed by my site ities. In everyone's job, people understand which this agile, uh, integrated security, agile teams, they, uh, understand security job is not only one team job, it's everybody's job. Also continuous, uh, continuous job, continuous process.

Also, they need to collaborate and working together. The, uh, therefore communication with other teams is important because sometimes some vulnerability fix very immediately. Therefore, communication and collaboration is important for the building.

And, uh, building a culture in the companies or organizations. Best practice for the, uh, cybersecurity in Agile. Uh, at first integrate the security, uh, into, uh, DevOps practice.

To support agile, it's means DevOps, it's generally security tools or security departments in there adopts pipeline or software development lifecycle. So it is hard to, for the secure the project in the beginning of the, uh, uh, starting the project and project, uh, project plan in the beginning of the plan, par plan stage of the project. So it means dev SecOps another things prior to risk based, risk based testing.

Generally, it's hard to, uh, focus on the high risk, uh, from the, in the project, in the high security risk in the project. So they, uh, agile team doesn't have the secure everything equally. They only focus high or critical findings in the project.

Another, uh, things is best, best practice of the cybersecurity agile, using secure coding guidelines. These documents is include about, uh, standard, about secured source code. How can the, uh, fix the vulnerabilities in the project?

Also, how can the right secure code, uh, for also not, uh, tools can the project tools cannot find or detect vulnerabilities. These, uh, coding guidelines, like the information and guide developer teams to and all at same time, train the developer team, uh, members to writing to secure code and fixing the vulnerabilities. Also, uh, another best practices, regular secure audits at you.

Uh, they, uh, teams conduct, predict, predict audits, agile environment and assess overall secret tasks. So they need to, uh, follow and control the audit and review site, and they can seek sometimes unexpected security behavior or in secret audit. Audit.

Therefore, agile team needs to integrate, uh, secret audit and reviews in their agile, uh, methodologies or agile management. Uh, what is the benefits of cybersecurity in the Agile at first to reduce vulnerabilities earlier because, uh, uh, detect vulnerabilities, security vulnerabilities in the earlier, and this, uh, vulnerabilities fix in the earlier stage of the software development lifecycle, or, uh, in the beginning of the, uh, project also adaptable the new threats because cybersecurity, agile teams can respond quickly. New vulnerabilities, threat vector teams, uh, learn, uh, new things about cybersecurity.

When they fix the new, uh, vulnerabilities, it's important for their, uh, continuous improvement. Uh, improve, improve collaboration and awareness. When you made it into the, uh, security in the, uh, agile, uh, uh, teams and agile management.

Everybody has, uh, information, uh, about cybersecurity and it's good for the culture of security. Also, they, uh, share the responsibility about, um, security. So it's good for the collaboration for the teams and working together and communication each team to each other.

So they shared their, uh, ideas, information. Uh, so it's good for the improved collaboration and awareness. Also, another one, faster time to market integrate security and agile cycles, uh, can lead, uh, quicker.

You know, that agile generator makes everything fast. So when integrate security, agile, uh, new vulnerabilities can fix very fast and imaging. Yeah.

So, uh, all of this about cybersecurity in the agile methodology or agile teams, they, it's, uh, it's, uh, I think DevSecOps or agile security is important topic pick for the organization and companies in nowadays general organization and companies using the cybersecurity in the edge also, uh, it's very helpful for the teams to improve the, uh, security culture and collaboration and improvement. Uh, also shift left and automating security have the balance, speed, and projection of the project. Uh, uh, so, uh, this one is cybersecurity in Agile.

Thank you for the, listen to me, if you have any question, I, I am happy to answer your question.