Applying Security Engineering Principles to Complex Composite Systems
Talkat OWASP Global AppSec DC 2019 · on Thursday, 2019-09-12· at 13:00· Salon 2, Marriott Wardman Park Hotel·
summary
Engineers get a checklist of 10 principles that drive concrete choices: identify crown‑jewel data, model attacks, assume attackers know internal APIs, and plan for compromise. Examples include a Smart City transit stack with ticketing, vehicle telemetry ingested through a cloud provider and a dependency tree of 700 dependencies across layers, use of ABAC and TLS, Docker and Kubernetes concerns, and the open source Niagara files component; lessons show what to lock down, monitor, and rehearse.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:43Purpose
- 2:43Neals Background
- 5:43Why are Composite Systems Hard to Secure
- 8:50Modern Development Environments
- 10:41Types of Users
- 12:41Smart City Example
- 17:07Inputs and outputs
- 18:02Principles
- 21:05Principle 1 Mission
- 23:25Safety
- 25:18Security
- 30:59Data
- 33:13Smart City
- 34:54Understanding Security
- 42:25Secrets
- 44:08Integrity
- 46:43Secret
- 48:28End user passwords
- 49:20Malicious insiders
- 50:36Transit insiders
- 51:25Cloud providers
- 52:23Example
- 55:26Plan for Failure
- 57:12Maintaining Security
- 58:25Decommissioning
- 59:05Conclusion
related talks
01h 17mSecure by Design - Security Principles for the Working Architect
45mSecurity Architecture, An Adventure?
27mThe Architect's Guide to Fortifying Software Security
43mSecurity By Design
07mSecurity Problems in Software and Attack Patterns
38mPrioritizing Trust While Creating Applications
50mMoving Security Architecture from Art to Engineering
40mDesign Approaches for Security Automation