Many people agree the best way to avoid security problems in an application is to design security into the architecture from the beginning instead of doing blackbox testing after development is finished. But what does that actually look like in a real-world application development lifecycle? Checklists like the OWASP Top 10 do not tell architects how to best work with infosec professionals or singlehandedly build an application on a secure foundation. Where should a developer even begin? How do you design security into applications based on next week's JavaScript framework, for which no "best practices" exist? The Information Security Practice Principles, developed by Indiana University’s Center for Applied Cybersecurity Research, provide both a foundation for application security independent of specific technology decisions as well as a means for establishing a common language between designers and defenders. We will work through an example of how to apply the principles build a threat model and an application design, and what this looks like in an "agile" software development lifecycle. Security teams can be an enabler for good design, not just a gateway to block mistakes!

I am a software engineer living software engineer and a lifelong student of computer science, with specific interests in programming languages, type theory, compilers, and math. I am Technical Director at Improving in Columbus, OH and co-founded the Columbus branch of Papers We Love, a reading group for people interested in academic computer science research. In my spare time, I play Irish traditional music on the wooden flute and tin whistle.

@craigstuntz

Back to BSides Columbus Ohio 2018 video list