OWASP Helsinki chapter meeting #39

Time: 17:30-21:00

Agenda
17:30 Welcome coffee
18:00 Opening words, Chapter leader - OWASP Helsinki
18:05 Words from the sponsor, Juho Ranta, CTO, Second Nature Security (2NS)
18:15 OWASP SAMM2 - your dynamic software security journey, Sebastien Deleersnyder, OWASP SAMM project leader, Managing partner Application Security, Toreon
19:15 Break
19:30 Scaling up threat modeling, Mikko Saario, Security Architect, KONE Corporation
20:15 Trusted Computing - beyond the TPM, Ian Oliver, Senior Security Researcher, Nokia Bell Labs
21:00-> Discussions continue with Snacks, Refreshments and Sauna sponsored by 2NS.

Abstracts:

OWASP SAMM2 - your dynamic software security journey

• Sebastien Deleersnyder, OWASP SAMM project leader, Managing partner

OWASP SAMM (https://owaspsamm.org) is the prime maturity model for software assurance that provides an effective and measurable way for all types of organizations to analyse and improve their software security posture. Building security into the software development and management practices of a company can be a daunting task. There are many elements to the equation: company structure, different stakeholders, technology stacks, tools and processes, and so forth. Implementing software assurance will have a significant impact on the organisation. Yet, trying to achieve this without a good framework is most likely leading to just marginal and unsustainable improvements. OWASP Software Assurance Maturity Model (SAMM) gives you a structural and measurable framework to do just that. It enables you to formulate and implement a strategy for software security that is tailored to the risk profile of your organisation. In this talk, we give an overview of the new release of the SAMM model. After 10 years since its first conception, it was important to align it with today’s development practices. We will cover a number of topics in the talk: (i) the core structure of the model, which was redesigned and extended to align with modern development practices, (ii) the measurement model which was setup to cover both coverage and quality and (iii) the new security practice streams where the SAMM activities are grouped in maturity levels. We will demonstrate the new SAMM2 toolbox to measure the maturity of an example DevOps team and how you can create a roadmap of activities.

Seba started the Belgian OWASP chapter, was member of OWASP Foundation Board and co-founded the BruCON conference.

---
Scaling up threat modeling

• Mikko Saario, Security Architect, KONE Corporation

Threat modeling (TM) or threat analysis is a great way to identify what controls should be put in place. However, scaling up can be hard. You need people who can facilitate TM sessions and it is easy to spend a lot of time on the process and documentation instead of the actual issues. Additionally, if you have dozens of projects to worry about, this can be a heavy burden. Not to worry, Gartner buzzword to the rescue: "Application Security Requirements and Threat Management"!

DevSecOps handles a good chunk of your HOW part via automation, but what about the WHAT part? This is where ASRTM steps in: Enable dev teams to do the right thing correctly from the start. I will demo two different solutions that try to address the issue, one free (goSDL) and another commercial (IriusRisk which has a rather limited Community Edition).

---

Trusted Computing - beyond the TPM

• Ian Oliver, Senior Security Researcher, Nokia Bell Labs

While trusted computing technologies, especially the TPM, have concentrated on the BIOS and boot-time integrity, in this presentation we show how having this trusted base allows a large number of other interesting capabilities from supply-chain security, to dynamic systems, run-time monitoring and so on. We present four themes where TPM and trusted computing capabilities provide core functionality and explore from there.

---

Free of charge, welcome!