6

I visited a client today. The manager I was talking to wanted me to perform a security assessment for his team.

He put lots effort in saying "We only need one security assessment, as we need to tick off a box from our checklist."

I got a feeling this was not right, but I can not quite put up an argument yet. I am meeting him again next week, how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick?

Improve this question
3
  • 5
    If they're doing it because they want to tick off a box, then they're correct in saying they only need to do it once in order to tick off the box once. Now, if they want to actually be secure...
    – user253751
    Mar 21, 2017 at 4:36
  • 3
    There's a saying among the security community: "Security is a process, not a product". What your manager is saying is that he doesn't want a security assessment, he wants a checkbox.
    – Mark
    Mar 21, 2017 at 6:36
  • A security assessment is a one time task even if not a good practice.. A security process however would be on-going. I might mention this to make sure that the one-time nature is ok with them. It often comes down to time and money, not just the 'best' solution which make take longer and cost more, despite its advantages.
    – Michael Durrant
    Jul 26, 2017 at 13:14

4 Answers 4

Reset to default
3

Typically, for products that are in the market, security assessment is done using a Secure Development Life-cycle (SDLC).

What I do is pretty simple:

  • Annual External Penetration Test using a crowd-sourced security testing service.
  • Weekly static and dynamic scans on the code
  • Security analysts review new user stories for security impact

Your client may be asking for just the Penetration test for now. Depending on those results, you might be able to convince them to be more holistic and use an SDLC.

Another example of an SDLC is available at OWASP

Good luck.

Improve this answer
4

how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick?

  • A security assessment is never a one-off task. Any security assessment is nothing but a screenshot of an ever-changing process. Saying one security assessment is enough is like to say watching a frame of a film is as good as watching a movie.

I will argue:

  • Depends on how much risk there is, for a company, it is a good practice to perform a risk assessment every 3 to 6 months, or at least once every year.
  • A security assessment will never find all the security issues. It is unrealistic to think one assessment is sufficient.
Improve this answer
2

As said above, security assessment is never a one off, it should be periodically.

The reason for this (when this manager undoubtedly asks) is that new threats are emerging all the time.

These threats are both external (new virus/hacker/zero day discovered) and internal (disgruntled employee potentially) or introduced (company brings in new software or hardware).

All of these things introduce new risk to the existing security structure.

The manager needs to understand that whilst he may well 'tick the box' now, he needs to revalidate periodically to ensure that his systems haven't become unsecured through no fault of his.

I would try in any discussions to gently emphasize that any negative changes to the secuurity are likely to come about because of change in the world, not because of something he has done. The system becoming unsecured isn't going to be his fault, but it will be something that needs addressing.

Improve this answer
0

A security assessment in 2017 should be part of the ongoing DevOps cycle in any organization today. As DevOps is focused on continuous integration (CI) and continuous delivery/deployment (CD), security assessments (and QA for that matter) should be conducted regularly to maximize positive outcomes for your clients' end-users.

This makes a "security assessment" as an "event" irrelevant, as server or app security is constantly being implemented, improved, and checked.

For instance, starting with security in mind, you can ensure new API endpoints require proper authentication as developers add them, instead of waiting until a data breach and then doing a large audit of everything to fix security holes. This is something that a "security assessment" might uncover later, except when it's more costly or less time-effective to implement.

It’s about automating as much of your IT security processes as possible and cutting down on wasted time later in the feedback loop. Additionally, security personnel needs to be involved in the development process, helping to plan system architecture along the way. They will generally be eager to get involved as well.

More about implementing security into an agile DevOps process so it isn't an annual "assessment". For more details check here.

Disclosure: The above link is from our own blog.

Additional Reference: Continuous Security: Implementing the Critical Controls in a DevOps Environment (PDF)

Improve this answer
2
  • 2
    Please properly edit in your affiliation with that blog.
    – rene
    Jul 26, 2017 at 13:11
  • 3
    Please note if you want to promote your own product/blog you must disclose your affiliation, otherwise your answer may be flagged as spam. Please read How to not be a spammer
    – DavidPostill
    Jul 26, 2017 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.