Secure Product Lifecycle (SPLC) In Practice© 2016 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. Secure Product Lifecycle (SPLC) In Practice Mohit Kalra | Senior

© 2016 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential.

Secure Product Lifecycle (SPLC) In PracticeMohit Kalra | Senior Manager, Secure Software Engineering (Adobe)


Introduction

Senior Manager @ Adobe’s Secure Software Engineering Team (ASSET) I lead the proactive security efforts. @adobesecurity / @mohitkalra


ADVANCINGSTATE OF THE ART

FOR CONTENT

Adobe’s Strategy

HARNESSINGTHE POWER

OF DATA

DRIVING DIGITALTRANSFORMATION

OF INDUSTRIES


ADOBE.IOADOBE.IO

PRIVATE, PUBLIC OR HYBRID CLOUDPRIVATE, PUBLIC OR HYBRID CLOUD

CORE TECHNOLOGIESCORE TECHNOLOGIES

ADOBE CLOUD PLATFORM

CONTENT DATA

Adobe Document Cloud Adobe Creative Cloud Adobe Marketing Cloud


Secure Product Lifecycle

Credit:http://www.cisco.com/c/en/us/about/security-center/security-programs/secure-development-lifecycle.htmlhttps://technet.microsoft.com/en-us/security/gg622918.aspx


Does a diagram capture everything?

Secure Product Lifecycle (SPLC) is a set of processes designed to help product teams engineer secure software.


For our team, the approach to security is much more complex

7


Security is all about making choices

8


… and balance

9


Implementing security is about providing high ROI and business alignment

10


…. while trying to fix the weak links

11


The challenges in this complex world.

12


A central security team’s challenge #1

13

Scaling the security work with a small team.

- Hiring skilled security professionals is difficult.

- Team needs to learn continuously.- Time spent => high premium $$$.



14

A growing and diverse company product portfolio.



15

The business critical products vs the legacy applications.


Security team’s

bandwidthDiverse

technologyVarying

business criticality

The challenges for a security team

16


How can a security team overcome these challenges?

17


Security team’s

bandwidthDiverse

technologyVarying

business criticality


18


Security teams @ Adobe

Product Team

Product Team

EngineeringChampionsResearchers

& PMs

ASSET

(Adobe Secure

Software Engineering

Team)

Products


Establish the minimum bar

20

- Create a SPLC standard that the product teams need to follow- Standardize the tool chain

SPLC Baseline Tasks for every teamTrainingStatic analysis of codeSecurity testing3rd party component trackingCode reviewsSecurity requirements reviewThreat modellingReview of high risk findings and sign-off


Security is a shared responsibility

21


Split and share responsibilities

22

Spend premium security skill mindshare where it matters.

SPLC Tasks Product team ownership

Central securityteam driven

Training ✔Static analysis of code ✔Security testing ✔3rd party component tracking ✔Code reviews ✔Security requirements review ✔Threat modelling ✔Review of high risk findings and sign-off

✔


Set up product teams for security success with their security practices

23

Onboard Team

Review ProductGather intel

Automation onboarding

Train team Routine SPLC tasks


Security team’s

bandwidthDiverse

technologyBusiness criticality


24


Implementing Security Measures for a wide technology spectrum

25


A product may be offered on one or many platforms.

26


Extend the baseline SPLC requirements

27

Baseline SPLC

Services SPLC

Mobile SPLC

Desktop SPLC


Extend the baseline SPLC requirements (web)

28


Extend the baseline SPLC requirements (mobile)

29


Extend the baseline SPLC requirements (desktop)

30


Security team’s

bandwidthDiverse

technologyBusiness criticality


31


Tune for business criticality

32


Factor in business criticality for a security engagement

33


Summary

We presented you with the real world experiences of running a SPLC program at Adobe

At a minimum, a product should get access to a baseline SPLC guidance

A SPLC program : Scales premium security bandwidth through shared

responsibility. Evolves continuously as the company evolves and

innovates. Is flexible and adapts to the business needs of an

organization.

34

Documents

Secure Product Lifecycle (SPLC) In Practice© 2016 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. Secure Product Lifecycle (SPLC) In Practice Mohit Kalra | Senior