Last night I presented to the Calgary Agile Methods Users Group on "Agile Appsec: Why we Suck at Building Secure Software, and what we can do about it". This is an outline of the problems that we have as an industry building secure software - why we fail at it, why Agile development is blamed for insecure software - and what we can do to build more secure software while still being Agile. I look at different approaches to injecting application security into Agile development: security stories, evil user stories, abuse cases and abuse stories; security sprints; and building security into development, using Microsoft's SDL Agile as a guide.
Friday, November 8, 2013
Agile Appsec: Why we Suck at Building Secure Software, and what we can do about it
Subscribe to:
Post Comments (Atom)
2 comments:
Be it 39% or 79%, a frighteningly large percentage of developer have little to no security steps in place when they are developing code. No wonder it sucks! Going back and trying to find the loopholes after they have been buried under more and more layers of new code is a tall order.
Going through the pain of Agile and application security. Great content in your presentation. Thanks for posting.
Post a Comment