Denim Group, Ltd. Blog

ROOTS Conference Wrap Up

By Dan Cornell

I made it back to the States after the ROOTS conference and wanted to post some comments.  It was a great conference with a lot of interesting folks and I was thrilled to have the opportunity to present.

On Tuesday, Andre Klingsheim and Lars-Helge Netland gave a great talk on Architectural Risk Analysis.  They ran us through a fantastic exercise where we had to work with folks at our tables and rank the most common causes of death in the USA.  My partner and I did all right - we got all the right causes of death but had some of them in the wrong order.  That was useful for examining perceived versus actual risk.  They also discussed the traditional Risk = Probability x Impact formula for quantitative risk analysis and why it is challenging to apply consistently across practitioners and projects so we also looked at qualitative risk analysis.  This is great material for software developers to cover and having more conversations in this area can do nothing but help increase the awareness of software security issues across the industry.

Martin Knobloch and Marinus Kuivenhoven gave a fantastic Application Security Workshop on Wednesday.  They went through an introduction to OWASP tools like WebScarab and WebGoat and then walked through the OWASP Top 10 2007 with examples.  I have been over this material a number of times, but I got a lot of benefit out of a number of the examples and case studies they talked about.  Again - presentations like this can only help to get the software development community more interested in the security implications of the applications they are producing.

Thanks again to the ROOTS committee and all the attendees.

--Dan
dan _at_ denimgroup.com

(The picture is of an extremely well-dressed stick figure crossing the street in Bergen, Norway)

Richard Feynman on Software Security?

By Dan Cornell

Gustavo Duarte had a great post on his blog relating Richard Feynman's thoughts on the Challenger disaster to software engineering.  As the focus is on the engineering and construction of reliable software systems, a lot of the thoughts and techniques also apply to software security - especially his mention of having adversarial teams try to break what the construction teams had put together.

--Dan

(PS - the photo image is Richard Feynman's ID badge photo from the Manhattan Project)

Related books:

• High-Assurance Design: Architecting Secure and Reliable Enterprise Applications - I just picked this up a week or so ago and haven't finished it yet.  However so far it is a great read about how to architect highly reliable, highly secure systems.
• Surely You're Joking, Mr. Feynman! (Adventures of a Curious Character) - This is Richard Feynman's autobiography.  It is a great read that takes you through the major events of his life.
• Genius: The Life and Science of Richard Feynman - James Gleick is an easy to read science and technology writer and this is his biography of Richard Feynman

InnoTech Austin Slide Decks Online

By Dan Cornell

The slide decks from Denim Group presentations at InnoTech Austin last week are now up online.  You can see John Dickson's slide deck about Payment Card Industry (PCI) compliance here and you can see my talk about integrating security into Agile software development methods here.  Thanks to everyone who came out to InnoTech.  Keep an eye on this blog and this space for upcoming Denim Group speaking events.

--Dan

dan _at_ denimgroup.com

AITP Agile and Secure Slide Deck Online

By Dan Cornell

The slide deck from my talk at the San Antonio Association of Information Technology Professionals (AITP) is online here. This talk was a bit more high level than previous ones.  We looked at the evolution of software development processes in general and then talked about the implications of Agile and Secure forces on those processes.

--Dan
dan _at_ denimgroup.com

Speaking at San Antonio AITP Meeting Tonight

By Dan Cornell

I will be speaking at the San Antonio Association of Information Technology Professionals meeting tonight at Gringo's Mexican Kitchen.  RSVP is required.  The topic is "Agile and Secure: Can We Be Both?"

--Dan
dan _at_ denimgroup.com

Agile and Secure Update - Slide Deck Online, Presenting in Chicago

By Dan Cornell

I just posted on the Agile and Secure Blog about my recent presentation to SA-SPIN and my upcoming talks in Chicago.  Check it out.

--Dan
dan _at_ denimgroup.com

Agile and Secure Talk to Chicago Java Users Group

By Dan Cornell

I will be speaking to the Chicago Java Users Group on Tuesday June 19th, 2007 about integrating security into Agile development processes.  This will be a "Downtown" meeting not a "West" meeting so it will be held at the CTI Building of DePaul University's Loop Campus.

I will be following this up with a similar talk to the Chicago chapter of OWASP the following evening at ABN AMRO Plaza.  See the chapter page for more info.

One thing to note: I think both of these venues have building access security requirements so it would probably be best to RSVP and get your name on the building's list.

Hope to see folks there.  I will be up in Chicago around that time so let me know if anyone would like to meet up.

 

--Dan
dan _at_ denimgroup.com