Developing a High Performance Security Focussed Agile Team (2 hr workshop)

Quality (security included) does not have to be neglected when you're planning, building and running a high performance development team.

Kim will set the stage with how and why Agile development teams fail, explained with a familiar anecdote taken from his new book "Holistic Info-Sec for Web Developers", coupled with how you can change this.

Kim will then discuss and demo a set of light weight processes, practises and tools, that when combined have proven their value in:
(1) Aiding high throughput (reducing time to market)
(2) Significantly increasing quality (finding and removing bugs)
(3) Without de-scoping
and all while reducing total project cost (fact).
If this sounds like breaking the laws of physics, or to good to be true, then this workshop is for you.

Kim will finish off with the habits of top developers and how we can make them part of our lives.

Transcript

1. Join the conversation #devseccon Developing a High Performance Security Focussed Agile Team By Kim Carter @binarymist
2. 5: Risks? https://leanpub.com/b/holisticinfosecforwebdevelopers
3. Step #1 How Development Teams fail
5. Step #2 How to Succeed with Security as a Development Team
6. Step #2 How to Succeed with Security as a Development Team Caveat Emptor
7. Step #2 How to Succeed with Security as a Development Team
8. 5: Risks? https://leanpub.com/b/holisticinfosecforwebdevelopers
9. Red Team
10. Red Team -> Blue Team
11. Pen testing @ go live -> within each Sprint
12. The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Definition of Done Cheapest Place to Deal with Defects Establish a Security Champion Hand-crafted Penetration Testing Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Security Focussed TDD Security Regression Testing
13. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Hand-crafted Penetration Testing Security Regression Testing Cheapest Place to Deal with Defects
14. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Hand-crafted Penetration Testing Security Regression Testing Cheapest Place to Deal with Defects
15. 5: Risks? This is madness! How can we do that?
16. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Security Focussed TDD Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Security Regression Testing Establish a Security Champion
17. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Security Regression Testing Hand-crafted Penetration Testing
18. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Security Regression Testing Pair Programming
20. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Security Regression Testing Code Review
21. Code Review, Static & Dynamic Analysis
22. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Code Review Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Security Regression Testing Techniques for Asserting Discipline
23. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Code Review Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Security Regression Testing Techniques for Asserting Discipline Static Type Checking DbC https://blog.binarymist.net/2010/10/11/lsp-dbc-and-nets-support/
24. The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Definition of Done Cheapest Place to Deal with Defects Establish a Security Champion Hand-crafted Penetration Testing Consuming Free and Open Source Evil Test Conditions Security Focussed TDD Security Regression Testing Pair Programming Code Review Techniques for Asserting Discipline R isk
25. The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Definition of Done Cheapest Place to Deal with Defects Establish a Security Champion Hand-crafted Penetration Testing Consuming Free and Open Source Evil Test Conditions Security Focussed TDD Security Regression Testing Pair Programming Code Review Techniques for Asserting Discipline C ounterm easure
26. Consuming Free and Open Source curl -sL https://deb.nodesource.com/setup_4.x | sudo -E bash - sudo apt-get install -y nodejs R isk
27. Consuming Free and Open Source • Npm-outdated • Npm-check • David • RetireJS • NSP • Snyk Tooling
28. The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Definition of Done Establish a Security Champion Hand-crafted Penetration Testing Security Focussed TDD Security Regression Testing Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects
29. 5:
30. 5:
31. 5:
32. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Security Regression Testing Evil Test Conditions
33. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Security Regression Testing Security Focussed TDD
34. Definition of Done The Sprint Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Security Regression Testing
35. Requirements or design defect found via Product Backlog Item (PBI) collaboration Length of Feedback Cycle Cost Requirements or design defect found in Test Conditions Workshop Programming or design defect found via Pair Programming Programming defect found via Continuous Integration Programming or design defect found via Test Driven Development (T(B)DD) Requirements or design defect found via Stakeholder Participation Defect found via pair Developer Testing Defect found via Independent Review Requirements defect found via traditional Acceptance Testing Programming or design defect found via Pair Review Design defect found via traditional System Testing Programming defect found via traditional System Testing Security defect found via traditional external Penetration Testing
36. Requirements or design defect found via Product Backlog Item (PBI) collaboration Length of Feedback Cycle Cost Requirements or design defect found in Test Conditions Workshop Programming or design defect found via Pair Programming Programming defect found via Continuous Integration Programming or design defect found via Test Driven Development (T(B)DD) Requirements or design defect found via Stakeholder Participation Defect found via pair Developer Testing Defect found via Independent Review Requirements defect found via traditional Acceptance Testing Programming or design defect found via Pair Review Design defect found via traditional System Testing Programming defect found via traditional System Testing Security defect found via Security Test Driven Development (STDD) or regression testing
37. 5: Risks? OK I’m starting to get it But what now?
38. Definition of Done The Sprint Security Regression Testing Sprint Planning Daily Scrum Sprint Review Retrospective Product Backlog Sprint Backlog Sprint Increment Establish a Security Champion Security Focussed TDD Pair Programming Code Review Techniques for Asserting Discipline Consuming Free and Open Source Evil Test Conditions Cheapest Place to Deal with Defects Hand-crafted Penetration Testing Zap-Api & NodeGoat
39. Step #3 Habits of Top Developers How to make them part of our lives All details of this workshop were sorced from part 2 of the Process and Practises chapter of my first book: https://leanpub.com/holistic-infosec-for-web-developers
40. Join the conversation #devseccon @binarymist