The document discusses building product security through a secure software development lifecycle (SDLC). It recommends that engineers be involved throughout the development process to implement security best practices. These include defining security requirements, developing coding guidelines, implementing static code analysis, performing security testing and vulnerability testing. Following an SDLC can help avoid common failures like claiming vulnerabilities are features or installing applications in vulnerable environments. While rigorous, such a proactive approach can ultimately save a business by catching and fixing issues early.

1. Building better product security
an engineering approach

2. Who we are

3. Client was hacked

4. Security Assessment of
completed product…

5. …is not good enough sometimes either

6. Secure Development Lifecycle

7. Engineer becomes a part of team

8. How security process looks in reality
Than start process of re-Coding, re-Building, re-Testing, re-Auditing
3rd party or internal audit
Tone of
security
defects
BACK to re-Coding, re-Building, re-Testing, re-Auditing

9. Generic Approach for Security
Design Build Test Production
security
requirements / risk
and threat analysis
coding guidelines
/code reviews/
static analysis
security testing /
dynamic analysis
vulnerability
scanning / WAF
Reactive ApproachProactive Approach
Secure SDLC

10. Defining security requirements for a project

11. Developing coding guidelines
and static code analysis

12. Security testing

13. Vulnerabilty testing

14. Common SDLC fails

15. CODE

16. It is not a vulnerability, it is a feature

17. Installling application after SDLC on vulnerable environment

18. SDLC makes everyone happy

19. Such approach eventually may save one’s business

20. Questions?

21. Thanks!
http://owasp-lviv.blogspot.com