Great Security Is One Question Away

Speaker 1 [00:02]

Thank you for coming. I was not expecting so many people, especially that we are finishing the conference, so thank you. But without further ado, let's just start. Oh, someone is coming? Okay. No, no, no, no problem. Thank you for being here. Okay, imagine this. It's Monday, the last sprint of your project. You just had a planning and you agreed with your team that you have just two bags to fix and documentation to finish. And you're done. And you'll be done. You'll be ready for the release. You feel good. It's Monday, but you feel good. You feel excited about the release, about putting stuff out there, about the new project that is approaching. You feel good. You feel that this is achievable, this is achievable. It's Monday, but it's a good day. On Tuesday, an engineering manager comes to your room or Zoom, and she says, look, I think it would be great if we just ran this project through security before the release. And in this context, it would be great means we must do it. So you go to the meeting with security team and they ask you so many questions. And even more questions. And questions based on the documentation that you haven't finished yet. And after this one-hour meeting, you end up with this, tons of bugs to fix. And if you ask me, I also have no idea what the snail is doing up there. So I've been in this situation way too many times, way too many times. And every time after releasing a project, we would have this wonderful meeting in my team called project retrospective. Does it ring a bell? Raise your hands. Yeah, we love those project retrospectives, don't we? And every time someone would raise this problem that, hey, we're having the security review just before the release. so stressful and yet the moment the door closes we would all completely forget about this problem and we would repeat the circle over and over again. For the context my name is Victoria Dallach I've been working in tech for over 10 years and mostly on the back end but two years ago I changed teams and I moved to security and I had this great opportunity of staying in the same organization but in a different role. And suddenly I realized a lot of things changed. So I would go to meetings with engineers who were my peers like a week ago. And then I would be considered as this person who brings troubles and problems. And, you know, I would even be considered as a stakeholder, which is something that I would never like to be considered as since I'm a vegetarian. So, you know, working on this different side of Moon, side of Moon, I realised that there are some things that you can do as an engineer to improve your life and improve the security of the application or product you're working on. Today I will bring something what I find the most powerful and something that I wish I had known before when I was a software engineer. By the way, all of the notes for this talk are available on this website, which is my website, slash security, and so... Oh, okay, people are taking photos. Oh, wow. Okay. So, yeah, no worries about taking notes, anyway. Okay. So there are many problems with security, I think. We can agree about that. But the The main, I think, is that security, how we think about security in a product team. So first, we have designers and product managers, product owners, however, you call product people who think about security solely as an engineering problem. And engineers, we as engineers, we are so focused on delivery and we're so focused on scoping the solution so that it's deliverable and we're so focused on finding the most valuable product that we see the security features and we all label them as nice to have. They We never cut the first release and we just put it on this beautiful shelf, nice to have, we never look at it. But, to be completely fair, security itself is a huge challenge and it's a problem, basically. I like to think about security as an ocean because it's big. It's huge. Have you ever stand in front of an ocean or a big sea? Raise your hand. OK. So I don't know if we have the same experience, but when I was 11, I saw the Baltic Sea for the first time. And it was a big sea for me. And I was like, wow, there is a lot of water here. So security is just that. It's like you have application security, infrastructure security, you have cloud security, you have IT security, in application security itself you have threats, you have vulnerabilities. Where do you start? And it's really a big problem. I guess that if I ask each of you separately, how do you know that your product is secure, each of you would present a different answer. Because how do you approach ocean? Do you start with one drop? Or do you start with the beach? I don't know. But here's what I bring you today, the Hope Street. Because, look, security experts that are much more smarter than I am agree that security is this big, dangerous thing. And we agree that there is an infinite amount of threats. For each of your products, for each of the things you're doing, there is an infinite amount of threads. We cannot just list all of the threads and all of the vulnerabilities that your application has, because every day we don't know about some zero-day vulnerabilities, et cetera. But even if the amount of threads is infinite, All of them can be assigned to one of three categories. And when I first learned about it, I was like, what? Because basically what it means, it means that you can put the whole freaking ocean into three buckets. And that will be enough. Those categories are called confidentiality, integrity, and availability, which is known in security theory as the CIA triad. And I could use this opportunity to make a joke about Spice, but I don't do that because the only Spice I like are Spice Girls. So here we have the most artistic photo of three buckets that I could find in the internet. And yeah, the CIA triad is such a powerful, easy, simple idea, but so powerful. And let me just explain why. But before I say that, let's be on the same page what confidentiality, integrity, and availability mean. Confidentiality means that we want secrets to be secret. when we are exchanging emails in the future, because you want to tell me that you really liked my talk and... Okay, that was a long stretch, I know. Okay, if we exchange emails for whatever reason, or you exchange emails with whatever person you want, I'm sorry, this is, like, tiring. You want only you both to be able to read it. You don't want anyone else to be able to intercept and read your emails, right? This is what we know. And this is confidentiality. Secrets to be secret. Integrity means that we want to get what we expect. So every time you log into your, I don't know, Instagram account, you want to see your posts, your followings, your followers, your DMs. if they disappeared one day you would be at least concerned right integrity and availability is means that we can always access the information um we can send the said email 2 a.m in the morning or 11 o'clock p.m it doesn't matter it's always available. So how is it helpful? You know now what the CIA trial stands for, but how is it helpful for you? How is it, how it will impact your work in the future? So it is helpful because it transforms the way you can think about security. Because right, because right now if you like think about the ocean, you don't have to think about the ocean anymore you don't have to focus oh do we are we protecting against this vulnerability or that vulnerability no instead you ask the question and the question is how can the caa of this project that i work on be broken and i want you to to to step back and think about the project that you're working on right now think about it do you all have it in your mind say yeah sadly oh I'm sorry but do you have it right yeah say yes I know you can ask this the CIA question for this project so you can ask how the CIA how the confidentiality, integrity and availability of your thoughts here be broken. Of course one question will lead to other questions and for each confidentiality, integrity and availability you will ask different questions but the thing is that this is beautiful because it will work for you no matter the project you're working on, no matter the technology you're working on, no matter if you're a junior developer, senior developer, product manager, it doesn't matter if you work on mobile devices or you work in DevOps or you work on backend, it doesn't matter, you can always ask this question. As I said, this one question will lead to another, and for each you will ask different questions. For confidentiality, You can ask who can see this resource, how do we store secrets, do we log sensitive data? It will of course depend on what problem you're trying to solve. For integrity, you ask who can create, update and remove a resource, what happens when malicious data is sent, is the input sanitised, are we protecting against cross-site scripting. So availability, of course, when we think about availability, the thread is DDoS attack and most developers are very comfortable ignoring availability when I talk about it. And they say, oh, this is like availability infrastructure group. But in reality, you as a developer, when you introduce a new service to your product or new library, like you are introducing a dependency. So you need to ask the question, what happens when this dependency for some reason is unavailable? Does it mean that, oh, when this beautiful software that we bought for, I don't know, managing feature flags is down, does it mean that our whole product is completely useless, right? You need to think about this. You need to... And what I want... I'm weirdly passionate about availability, I must admit, and you need to think about it too. So when should you do this? You know already what the CIA it is. Why is it so powerful? Okay. But life is life. Developers' life is busy. You have already so much things to care about. When should you do it? So I cannot answer this question without mentioning shift security left. Shift security left is this, oh, how hot this trend is in application security right now. Like, you touch it and you have blisters, basically. Shift security left, what does it mean? So, we live as developers in software development life cycle. Do we know this? Do you know this? Like, say, yeah, Ah, my favourite. Honestly, software development life cycle have this five phases, analysis, design, implementation, testing, and evolution, but it's also called maintenance and release. The thing is, I don't know about you, but after a decade in tech, I know that this is because have you ever experienced living in like working this software development life cycle from my experience friends we live in software development timeline where you also where you obviously have analyzed design develop test maintain but then the moment a project is released you move on to a next project and you never look at your project again unless there is some bug or company decided to invest more money because oh it's selling right so when we look at this timeline wink wink um then what happens what what i uh what i tell you at the beginning Like, we had this security review already on the right side of this timeline, right? Very close, basically, to maintain slash release phase, right? So shifting security left means, hey, this is terrible for everyone. This is terrible for developers because it makes us more stressed, it adds work, it's Having to make changes on that side of timeline is extremely expensive. It requires more time. Let's not do it this way. Let's shift security left, which means let's talk about security in the basically analyse and design phase. So what you can do, you can ask the CIA questions in the design phase. And why is it so amazing, and I encourage you to do it, because you take this, I don't know, graph of something you want to design, of something you want to build, and you ask these questions, and these questions, the answer will require some changes, right? But the changes you make, you make on a piece of paper. They cost you basically nothing. very fast to implement because they are on a piece of paper or some digital version of a piece of paper right that is beautiful and have emojis so when you do that it it opens a new door to you it opens to it it develops your security mindset and you have a better confidence in shipping something and building something that is safe. So how can you implement the CIA triad? So we already know what the CIA triad is, we know when to do it, the sooner the better, but how do you do that? So first of all, if you work in a team, talk about it with your team. I think there's frustration about security review in the, like, very close to release will be shared among your peers. So present this idea to your team, discuss it with them, like, discuss how you can, you know, fit this, the CIA triad into your practice. And it can be like an hour meeting or something. And don't do it alone. I encourage it to be like a cross-functional discussion. Also with designers, also with product people. Because security is in reality everyone's problem, I'm sorry. And make it part of your process. it visible for other developers. So what I did at Contentful, my previous company, I added the security part as CI triad in solution brief, enhancement proposals, requests for comments, so people were fully aware when they were creating this, a new proposal, like Like that the security is an important part of it and they need to think about it and design with security in mind. There is no week without a breach. There is no week without a new vulnerability found. I think it was fun when tech companies were built in garages, but we're past that phase, I would say. And I would love to see our industry taking responsibility of what we're building, because move fast and break thing is over. Using security with security in mind will be a winning factor for your business, for your product, and I encourage you to start with the CIA triad and with the CIA questions to build with more confidence more secure products. That's it. Thank you.

Speaker 2 [22:05]

Thanks very much, Victoria. One of the most entertaining talks of this conference. There are a few questions on Slido. If you haven't added yours yet, feel free to do so now. We have a few minutes left.

Speaker 1 [22:17]

I answer I just want to say that I may look confident I'm not so I'm a little bit nervous so if I if if my answer don't satisfy you pardon my brain oh please reach out on LinkedIn so we can discuss more okay so it's a safe and friendly space I believe right

Speaker 2 [22:40]

You're doing great Now I lost my questions now, I'm getting nervous, okay Does your security team take part in each back-end project to help with CIA or do you do work on dedicated security projects?

Speaker 1 [22:53]

So, back at my previous company, we were basically, we had a security team, and we didn't have backend teams, we had product teams that were cross-functional. And, basically, the flow would be that at the kickoff of, I mean, the design phase, we would come to have a session with the product team. And we would just do some kind of like this, the CIA triad or threat modeling. Yeah. And I if you have security team in your or security someone in your company I encourage you to add to engage with them early on

Speaker 2 [23:42]

Any specific tools we can look into as a beginner or junior dev to introduce security to our projects?

Speaker 1 [23:47]

projects? Yeah, I love this question. Everyone wants to know the tool. The tool is anything you are comfortable with. Like this can be because I like you we I saw it way too often that we have like we let's buy this tool so we have a better culture around security for example right but it doesn't like every every new tool creates a fraction because our people need to learn how to use it. There are people need to learn how to use it and implement it. So if you, for example, I don't know, use Miro for designing a system, then Miro will be fine for doing this CIE session. If you... There are specialised tools for thread modelling. Thread modelling, of them is called but like don't stress too much about tools it can be done on a like on a whiteboard with some sticky notes it doesn't matter like just start doing it and then maybe add a tool when you find value in it

Speaker 2 [24:59]

Thanks. This question I don't understand. Maybe you can make sense of it. Did security to the left improve your relationship with your old peers?

Speaker 1 [25:07]

Old peers. Yes, yes, yes.

Speaker 2 [25:25]

Great talk, but this is not a new problem, this person is asking. Why do you think it's so hard to sustainably include security? What structures have to change?

Speaker 1 [25:37]

security is a cost do we care about quality in this industry do we like it's like a matter of principles I think it's more like philosophical question I'd be happy to have a like a longer chat over it over a beer about it

Speaker 2 [26:00]

Where to start if there's no security team?

Speaker 1 [26:04]

That's an excellent question. Start with your peers and just ask this question. Ask questions, the CIA question, I mean. And even if you cannot answer all questions, it's fine. sometimes just and also by the way I should have mentioned that that even if you know the risk or that your your design will introduce some risk sometimes there are risks it's called risk management we agree to some risks it doesn't mean that you have to build a flawless flawless secure maybe it's a recording so I will maybe not but it doesn't have to be like oh the best software ever from the get-go but not just the like exercising this idea is very important so if you don't know if you don't have a security team or engineers in your company just start yourself ask this question and it will open some doors for you anyway

Speaker 2 [27:13]

follow up to that, I guess, how do you convince the management of the importance of security so to allow time being spent on it?

Speaker 1 [27:19]

mostly, you know, you don't do that, and then this happens, you know, and I think about Uber, you know, how they had this a few months ago, this security breach, and next day they have six open positions for security team, you know, I mean, I understand that sometimes it's you know a cost and you just want to ship also there but again culture in this industry you know like if if your investors require you to just deliver features new features and new shiny and even more brilliant features but always new then of course security will be considered cost Quality will be considered at as cost And you don't fight this you cannot find fight this as a developer alone yet, I believe that shifting security left when you when you think about when you Invest an hour of your time in the design session to think about to think about security. I think it will in Return as a big investment for you At least you have confidence that what you're building is secure.

Speaker 2 [28:40]

Wonderful closing statement. Thanks very much again. Thank you. Please give another hand of applause. Thank you. And I think you mentioned all your materials are on your website. Yes. Will you also be uploading the slides for anybody interested? Yes, we can. You can upload them to the schedule. Yeah. All right. Thanks very much. And I think this was the last talk, regular talk. Now it's the closing session. So thanks, everybody, for showing up, participating. and enjoy the rest of the day.

Speaker 1 [29:12]

Thank you.