Hey @DinisCruz have you done a @wardleymaps for implementing a full #AppSec program? Or seen one that worked well? In particular looking for info on @swardley's #PST model applied for this.
@_tony_richards @VirtualTal how about you?
-
-
Odgovor korisnicima @sec_tigger @DinisCruz i sljedećem broju korisnika:
thanks
@secfigo twitching on expert *cough*
@sec_tigger I haven't done it specifically for Appsec, but how I've approached it generically before was follow a SABSA-like structure for the map itself (as attached) as it provides a good logical breakup from biz objectives 1/npic.twitter.com/ygBYCjyhjU
1 reply 0 proslijeđenih tweetova 2 korisnika označavaju da im se sviđa -
Odgovor korisnicima @madplatt @sec_tigger i sljedećem broju korisnika:
which I then connect to logical services (things the security/ops team provide) and the actual mechanisms and components used. I've planned for ages to integrate this blog post with Wardley mapping but have too much WIP :) https://zinatullin.com/2017/02/14/using-sabsa-for-application-security/ … with that approach integrated 2/3
0 proslijeđenih tweetova 5 korisnika označava da im se sviđa -
Odgovor korisnicima @madplatt @sec_tigger i sljedećem broju korisnika:
into maturity levels, make it really interesting as input to the map and the breakdown between activities (how we do it) from the components (what we use)
0 proslijeđenih tweetova 0 korisnika označava da im se sviđa -
Odgovor korisnicima @madplatt @sec_tigger i sljedećem broju korisnika:
In many ways the issues with DevSecOps are anthropological and taxonomical in nature. If one peels back the onion, the reality is that DevOps goal of "immutability" and SecOps goal of "security" are essentially the same.
0 proslijeđenih tweetova 2 korisnika označavaju da im se sviđa -
Odgovor korisnicima @VirtualTal @sec_tigger i sljedećem broju korisnika:
I think that’s 1/3 of it. Integrity relates to Immutability, Confidentiality can equate to Ephemerality (including of design patterns) and Distributed to Availability, tracing back to the CIA roots
1 reply 0 proslijeđenih tweetova 2 korisnika označavaju da im se sviđa -
Odgovor korisnicima @madplatt @VirtualTal i sljedećem broju korisnika:
Is this about shared taxonomy (which is of course a very good thing!), or are you thinking of any other tangible consequence?
1 reply 0 proslijeđenih tweetova 1 korisnik označava da mu se sviđa -
Odgovor korisnicima @sec_tigger @VirtualTal i sljedećem broju korisnika:
Tangible
would reference @sounilyu https://www.slideshare.net/mobile/sounilyu/distributed-immutable-ephemeral-new-paradigms-for-the-next-era-of-security … and@swagitda_ https://swagitda.com/speaking/us-19-Shortridge-Forsgren-Controlled-Chaos-the-Inevitable-Marriage-of-DevOps-and-Security.pdf …1 reply 1 proslijeđeni tweet 2 korisnika označavaju da im se sviđa
I also wrote an opinion and inquisitive piece on how that paradigm shift could inform particular focus for threat modelling herehttps://link.medium.com/hQmcr70UC3
-
-
Odgovor korisnicima @madplatt @VirtualTal i sljedećem broju korisnika:
awesome, thanks for these!
0 replies 0 proslijeđenih tweetova 1 korisnik označava da mu se sviđaHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.