michael brunton-spall lead security architect government ... · michael brunton-spall lead security...

Michael Brunton-SpallLead Security ArchitectGovernment Digital Service@bruntonspall

Being secure and agile

GDSMichael Brunton-Spall

GOTO Amsterdam 2016

Michael Brunton-Spall@bruntonspallHe/His/Him


Lead Security ArchitectCabinet OfficeUK Government


I'm from the Government, and I'm here to help


I'm from security, and I'm here to help


The state of security


Certification AccreditationPCIISO27001


Change control boards


Agile changes everything


What is agile?


While the things on the right have value


The things on the left have more value


Individuals and interactions over processes and tools


Working software over comprehensive documentation


Responding to change over following a plan


Customer collaboration over contract negotiation


Contracts, Planning, Documentation, Processes and Tools


Collaboration, Change, Deliverables, People


Building software together


Support and trust


Simplicity


Maximising work not done


"Minimising the lead time for delivering business value" @tastapod


What does this mean today?


Minimum viable product or service


Iterate


Release early, release often


Principles


Protect personal data


https://www.cesg.gov.uk/guidance/protecting-bulk-personal-data

Security design principles


https://www.cesg.gov.uk/guidance/security-design-principles-digital-services-0

8 Principles of risk management


https://www.gov.uk/government/publications/principles-of-effective-cyber-security-risk-management

Accept uncertaintySecurity as part of the teamUnderstand the risks


Trust decision making Security is part of everythingUser experience is important


Audit decisionsUnderstand big picture impact


How does agile help?


Continual delivery of business value


Continual acceptance of risk


Secure Agile Development


Security must be an enabler of the team


Safety engineering and security engineering


The unit of delivery is the team


The unit of decision making is the team


Risk


Educate the team to the threats


Keep a running risk log


Apply risk decisions per story


Apply controls per story


Security debt


Simple systems are more secure


Choosing the secure method must be the easiest option


Security as an enabler


Secure Agile Operations


Infrastructure as code


Infrastructure as testable code


Dealing with patches


What machines are affected?


Updating machines in test


Just some machines?


Repeat in production


What does Agile and DevOps give you?


Automated Testing


Infrastructure as code


Fast repeatable deploys


Audit logs


Code review of infrastructure changes


Confidence!


Why does that matter?


Australian Signals Directorate


http://www.asd.gov.au/publications/protect/top_4_mitigations.htm

Application whitelisting


Patching


Patching (again)


Minimise administrative controls


Done well, agile techniques mean more secure software


We're hiring!https://gds.blog.gov.uk/jobs


Michael Brunton-Spall Lead Security ArchitectGovernment Digital Service @bruntonspall

michael brunton-spall lead security architect government ... · michael brunton-spall lead security...

Documents