Using Collaboration to Make Application Vulnerability Management a Team Sport

© 2020 Denim Group – All Rights Reserved
Building a world where technology is trusted.
Dan Cornell | CTO
Kyle Pippin | ThreadFix Product Manager
Using Collaboration to
Make Application
Vulnerability Management a
Team Sport
May 28, 2020

1
Advisory
Services
Assessment
Services
Remediation
Services
Vulnerability Resolution
Platform
Building a world where technology is trusted
How we can help:
Denim Group is solely focused on helping build
resilient software that will withstand attacks.
• Since 2001, helping secure software
• Development background
• Tools + services model

Agenda
• Application Vulnerability Management
Challenges
• ThreadFix Overview
• Security Team Collaboration
• Security and Development Team
Collaboration
• Questions
2

Application Vulnerability
Management Challenges

An Observation
• Traditional vulnerability
management seems to do this
better
• Organizations more mature
• Server patches are
typically more
straightforward than
custom software changes
[But lots of servers still don’t get
patched…]
4

This is Hard
• Lots of players
involved
• Application
Security
• Development
• GRC
5

This is Hard
• Everyone has different
incentives and goals
• Development: Features,
functions, timelines
• Application Security:
address risk
• GRC: Address risk,
reach/maintain
compliance, implement
controls
6

This is Hard
• Access to Developers’ time is
a zero-sum game
• If you’re fixing security
bugs, you’re not developing
features
• If you’re developing
features, you’re not fixing
security bugs
• Viewing it like this creates
winners. And losers…
7

Typical Outcome
• Application security “requires” that certain
vulnerabilities get fixed
• Development teams try to put this off as long
as possible
• The group with the best executive support
gets their way
• But everyone is actually a loser
8

Stop Fighting
9

Start Playing on the Same Team
10

Critical Elements of Teamwork
• Respect
• Roles
• Communication
11

Critical Elements of Teamwork
• Respect
• Roles
• Communication (and Collaboration)
12

ThreadFix Overview

ThreadFix Origin Story

ThreadFix Overview
• Create a consolidated view of your applications and
vulnerabilities
• Prioritize application risk decisions based on data
• Translate vulnerabilities to developers in the tools they are
already using
• Provide access to powerful analytics
• Drive efficiency with automation and orchestration
15
44% Reduction
in Time-To-Fix
Vulnerabilities
Up To 5x Increase in
AppSec Assessment
Productivity

ThreadFix Data Flow
16

ThreadFix Pipeline
17
i.o.
SecurityCenter
De-Dupe
Merge
Correlate
History
Settings
Policy
False Positives
Risk Triage
Consolidate
Remediation
Profiles
Templates
Actionable
Tracked
Insights
Verification
HotSpots
Alerting
Findings & Vulnerability Management Pipeline
Automated/Orchestrated
Pre-Processing
Reduce Vulns to Manage
Manage by Policy & Settings
Single Portal
for:
ITAO’s
Dev’s
SME’s
SecChamps
Dev’s &
SME’s
Work in daily
tools, and
existing
workflows
Security
Program &
Policy
Managemen
t and
reporting
Tableau
Business
Object
Power BI
Archer
Custom
Reporting
External
System
Integration
Manua
l

Who Benefits and How?
• Security Team
• Run more efficient and effective application security programs
(200-500% increase in testing throughput, up to 35% reduction in
findings that require triage)
• Development Teams
• Direct testing and receive results via tools and platforms already in use
(Jenkins, JIRA, etc)
• Risk-management (GRC) Team
• Faster resolution of key vulnerabilities (up to 44% reduction in mean-
time-to-fix)
18

Security Team Collaboration

Security Decisions
• Which vulnerabilities will you
fix?
• Hard enough for an
application
• Even harder across your
portfolio
• What is your remediation
“budget?”
• How do you justify more?
20

Critical Decisions
• Is this vulnerability a true or false positive?
• How serious is this vulnerability, actually?
• Which of these do we need to fix?
21

Critical Communications
• “This is better/worse than it seems (and why)”
• “This has an impact on GRC concerns”
• “I need help making a decision about this
issue”
22

ThreadFix Demo
• Vulnerability comments for triage
• Vulnerability comments for compliance
• Vulnerability statuses for workflow

Additional Resources
• Blog post: Effective
Security Team
Collaboration
https://threadfix.it/resources/applied-threadfix-
effective-security-team-collaboration/
24

Security and Development Team
Collaboration

Developers Don’t Speak PDF

(They Don’t Speak Excel Either)
27

Effective Dev/Sec Collaboration
• Talk to developers in the tools they’re
already using: Defect Trackers (ALM, etc)
• Empathy and understanding
• Take advantage of sunk-cost investments
• 44% reduction in Mean-Time-To-Fix
28

Bundling Strategies
• Turning vulnerabilities into defects
• 1:1 approach?
• More time spent administering defects than fixing
issues
• Bundling
• By vulnerability type
• By severity (more mature applications)
• Other approaches
29

ThreadFix Demo
• Bundling vulnerabilities to create defects
• Tracking development team progress

• Blog post: Security
Teams Collaborating
with Development
Teams
https://threadfix.it/resources/applied-
threadfix-effective-security-team-
collaboration/
31

• Videos: Introduction to ThreadFix Tagging
https://threadfix.it/resources/introduction-to-tagging/
https://threadfix.it/resources/introduction-to-tagging-part-2/
32

Questions

Security Champions Webinar
• When champions spend time on security
stuff they’re not doing development stuff
• Pushing security expertise out into
development teams helps
https://www.denimgroup.com/resources/webinar/security-champions-pushing-security-expertise-to-the-edges-of-your-organization/

@denimgroup
www.denimgroup.com

Using Collaboration to Make Application Vulnerability Management a Team Sport

More Related Content

What's hot

Similar to Using Collaboration to Make Application Vulnerability Management a Team Sport

More from Denim Group

Recently uploaded

Using Collaboration to Make Application Vulnerability Management a Team Sport