How not to make the news - Build security into your Agile project from the ground up.
When a group of stakeholders and team members come together to plan a new product or feature, they often focus on identifying stories that deliver end user value through solving a business problem, delighting the customer or disrupting a competitor. While these are critical stories, they are not the whole picture. Every product has non-functional or cross-functional stories which must be played.
Security stories are an important part of these but are often not considered at all. When they are considered, they are often an afterthought or are assumed to be part of the project infrastructure. Trying to bolt on security as an afterthought in this way is a mistake that can lead to disaster at one extreme, and compromises to reduce product usability or don't support good end-user security practices at the other.
The challenge, of course, is that from the stakeholder perspective, security is not seen as a priority. This workshop is for software delivery teams who want to learn how to change this perspective and work with their stakeholders to help them to understand more about the importance of security. The goal is to help technical and non-technical stakeholders understand security and why it should be given priority and built into their product from the ground up. We show participants how to facilitate a structured meeting or workshop with their stakeholders where they use a simplified threat modelling technique to identify risks. The outcome is the identification of user stories (or evil user stories) which when played will mitigate identified risks.
Outline/Structure of the Workshop
- The workshop begins with a definition of terms and background to Threat modelling for the participants.
- We introduce the concept of security objectives and why we need them
- We then introduce the project we will be working with and provide a demo.
- A practical exercise is then conducted to identify security objectives, using a structured approach.
- Participants are introduced to the concept of S.T.R.I.D.E. and how it can be used to guide the threat modelling process.
- Participants are then divided into smaller groups and work through the second practical exercise to identify assets and threats and then prioritise them using the S.T.R.I.D.E process initially at the project level and then at the individual story/use case level.
- Teams then work through the process of turning the risk and its identified mitigation into story cards for the project backlog.
Finally, we wrap up by discussing how teams can facilitate their own threat modelling workshops and incorporate the technique into their own processes.
Learning Outcome
- How to facilitate a threat modelling workshop.
- How to identify the most important security risks, especially the not-so-obvious ones.
- How to identify mitigations for security risks and turn them into playable user stories.
Target Audience
Anyone involved in iteration planning
Prerequisites for Attendees
Familiarity with Agile approaches to software development. Specific security knowledge is not required.
Links
Kelsey van Haaster:
- Workshop - Blitz Planning Reimagined - XP2017, Agile Australia 2017
- Panel Mobility Management Challenges and how to overcome them - Oktane17 https://www.okta.com/video/oktane17-mobility-panel-mobility-management-challenges-and-how-to-overcome-them/
Talks
- "Simplify and then Add Lightness" Agile Australia 2017
- "What do you mean you are going to reset my password" Identiverse 2018 https://www.youtube.com/watch?v=P0qZRy5EKqs
- "Remote first is not second best" Pycon Australia 2018 - https://2018.pycon-au.org/talks/45291-remote-first-not-second-best/
Robin Doherty:
Talks
- Breaking Encryption for Dummies [video] at Attacks on Encryption, Brisbane, Oct 2017
- Practical techniques for whistleblowers to defend themselves in a hostile digital world [abstract] [material available on request] at Still Hacking Anyway, Netherlands, Aug 2017
- Functional programming in the enterprise [video] at RedBubble Tech Talk, Melbourne, Aug 2015
Workshop
- Blogging anonymously with Tor [material] [abstract] at BSides Canberra, Apr 2017
https://2018.pycon-au.org/talks/45291-remote-first-not-second-best/
schedule Submitted 3 years ago
People who liked this proposal, also liked:
-
keyboard_arrow_down
Sue Hogg - Context is king! A systems thinking approach to further understand your company context...
45 Mins
Talk
Beginner
Ever wondered what on earth is going in your company? Your team? The system of work? Are people acting crae-crae? Is there conflict? Are there pockets of super awesomeness & pockets of unhappiness? Are people pulling in different directions?
In this talk, I will run through my systems thinking approach and experiences to unpacking and diagnosing a company, it’s context, it’s practices and it’s people.
If nothing else, this talk may help you with making the invisible more visible and may lead you to be even more situationally aware of the context you have found yourself in!
-
keyboard_arrow_down
Daniel Prager / Andi Herman - When at first they don't want to change: Shared lessons from Addiction Therapy and Agile Coaching
Daniel PragerDirector of Coaching & LearningEverestAndi HermanMental Health / Addiction ConsultantCareer breakschedule 4 years ago
45 Mins
Talk
Intermediate
The easy case for coaching looks something like this: a prospective coachee wants to change, can articulate their goals, and is matched up with a suitably experienced and competent coach, the two are a good fit, and they quickly get down to the challenging yet rewarding business of growth and change.
But what if a person (or team) doesn't want to change and would rather not be coached? And despite this an external power deems that change is needed and that coaching will bring this change about. What's a coach to do? What about the coachee(s)? What about the role of the client who's engaged the coach?
This situation is not uncommon, and bears more that a passing resemblance to what often goes on in addiction treatment. A person with a drug addiction (and often other problems) doesn't necessarily welcome therapeutic intervention at the outset. But an external authority has ordered it.
In this session we will explore the parallels between the two modalities of addiction therapy and coaching, including the applicability of the Transtheoretical Model of Change and the related technique of Motivational Interviewing.These approaches offer insights into how to flex and adapt your coaching approach in the face of some of the most common human impediments to change.
-
keyboard_arrow_down
Kelsey van Haaster / Peter Lam - Agile and Management - a conversation
Kelsey van HaasterProduct Owner IdentityThoughtWorksPeter LamPrincipalClaritas Consultingschedule 3 years ago
45 Mins
Talk
Advanced
Agile was coined in 2001, building on techniques and methods from the prior 10 or more years. We know that (smaller) software projects are more successful with agile delivery methods than with staged approaches like the SDLC. So why is it that 18 years after a better was was identified that managers struggle to adopt agile in a meaningful way.
This is a facilitated discussion - there are as many answers as there are people! So with the late afternoon timeslot - let's get together and have an interactive chat - with the intent that we all leave with some useful ideas, tools and techniques that we can apply when we get back to the office ...
-
keyboard_arrow_down
Alexis Stuart / Bob Martin - What Aren't You Seeing in Your Product Organisation? Lesson's Learned on Myer's Digital Journey
Alexis StuartDigital Product OwnerMyerBob MartinAgile Practice Lead, Agile CoachMyerschedule 3 years ago
45 Mins
Case Study
Intermediate
At Myer, we’re well into our digital product journey. Although we still have plenty of work to do, we would like to start sharing our experiences in taking a Product centric approach to ensure we are delighting our customers and leveraging L.A.S.T practices to change behaviour and enable a positive outcome.
In this discussion, we will look at where we started, where we are now, and what our future path might look like. Our hope is that we can help others avoid (or at least identify) some of the more common pitfalls, and to help others develop a proactive approach to navigating their digital product journey.
Some topics for discussion may include:
- How we are working on creating a Product-centric organisation, and why this is so important.
- How focusing on the work that feeds the backlog(s) is just as important as the backlog(s) them self.
- Experimenting with the Google '20% time' practice, and how this helps create a trusting and inclusive environment.
- Constantly questioning the value of ideas, and initiatives. Like many organisations, there is no shortage of great ideas, but how do we make sure we are working on the most valuable at any given time?
- What happens without a strong product organisation? For example, what happens when there is no product guidance for UX. Now that we are working on building out our Product practices - how can we start to develop a healthy tension between UX and Product?
Experiences shared by Alexis Stuart, Digital Product Owner and Bob Martin, Agile Practice Lead. -
keyboard_arrow_down
Mark Pearl - What we've learned around teaching/mentoring graduates to become software developers
45 Mins
Case Study
Intermediate
At MYOB we've been improving our graduate programme for software developers. Today I would like to share some of the insights we've gained over the last few years around how to do this better.
-
keyboard_arrow_down
Jay Hyett / Ruma Dak - 7 Habits of Highly Effective Teams
30 Mins
Talk
Beginner
In this talk Ruma and Jay will share seven habits of highly effective teams, based on their work at Envato. They'll also share some tips to help build the habits.
-
keyboard_arrow_down
Timothy Newbold - Why Objectives and Key Results (OKRs) is one of the worst kept secrets to organisational success
90 Mins
Workshop
Intermediate
Hearing a lot about Objectives & Key Results (OKRs), but still a little unclear what they're about? Maybe you're hearing all the chatter and it's tweaking your interest! Well, join me for a farside chat and all will be revealed.
In this session we'll get under the hood of OKRs to understand the history, the core concepts and cut our teeth in a manner which allows us to take them back to our teams for further exploration.
At minimum, you'll walk out of the session with some clear goals for the coming quarter!
Do we know our stuff?
OKR Quickstart coaches and consults businesses on how to create strategic clarity, achieve audacious goals and build high performing teams. We've helped hundreds of people and businesses introduce OKR so that everyone finds crazy value out of them (not just the exec team). We've made every mistake in the book and this session summarises some of our biggest learnings! -
keyboard_arrow_down
Chris Lewis - The Human Side of a Security Incident
30 Mins
Talk
Beginner
What could it be like to work through a real-life security incident at your company? As awareness about security in our industry improves, we hear much about how to keep our applications secure, but rarely do we consider what happens with your employees when something goes wrong. Allow me to share my story about the emotional highs and lows of working through a security incident, as we look past its technical surface and into the human experience behind it instead.
-
keyboard_arrow_down
Renee Troughton - Agile Consulting with the big end of town
30 Mins
Talk
Beginner
Prepare for a contentious and deeply personal story.
I was an Enterprise Agile Coach. I am now a Consultant. But can I be both?
Discover why I made the leap to "the other side", what I have learnt in the process and why, if we don't do something soon, Agile in Australia risks imploding.
-
keyboard_arrow_down
Charlotte McKinnon / Dirk Driessen - Agile Product Road Mapping - combining strategy, vision, passion and direction
45 Mins
Talk
Beginner
Product Road Mapping can be a challenge for those that are new to this and also for those that are experienced. Conventional product road mapping models have several limitations. We will explore how various Agile Product Road Mapping approaches and models can provide relevant information and direction to different stakeholder groups that are responsible for product development.
-
keyboard_arrow_down
Emily Jaksch - Rise the New Millennial
45 Mins
Talk
Advanced
The current Millennial narrative is getting pretty old and whilst some are still complaining that Millennials are lazy, selfish and entitled most people have started to realise they are shaping the world around us. It’s time to reframe the dialogue and meet the new Millennial and based on a recent study Millennials are not who we think they are. The new Millennial characteristics according to research include Disruptors, Changemakers, Demanding, Ethically and Socially Minded, Progressive thinkers & Entrepreneurial just to name a few. Furthermore, there are plenty of Millennial Rainmakers shining a light on how they are disrupting industries and changing the business world as we know it. Think Ruslan Kogan, 36-year-old Founder of Kogan.com, Nicholas Molner 28-year-old Founder of Afterpay & Kayla Instines 28-year-old Fitness Mogul who is reportedly worth a cool $486M just to name just a few Aussies. It’s time to move over and get out of the way, the new wave of Millennial Entrepreneurs has arrived.
-
keyboard_arrow_down
Cathy Jamshidi - User adoption: selling the story to developers
30 Mins
Talk
Beginner
User adoption is one of the most challenging things about projects. When they are consumer facing applications, you can measure your success through the number of click throughs, time spent by users reading pages or product purchases, money they spend. Consumers want to use your product because it fulfils a need or a want. Conversely, when a product or service is required out of obligation, regulation or to maintain a standard, and it doesn’t necessarily fit a need or a problem they’re trying to solve, then consumers don’t want to use the goods or services.
Welcome to the world of application security. Application security is sexy in theory, hacking at systems, breaking in, being a rebel without a cause, but what happens when you try and roll application security tooling out to hundreds of developers where many of them have less than no interest in embedding another tool into their software delivery lifecycle? How do you keep it sexy, interesting, engaging and make them want to use it?
This is the story of how we rolled out appsec tooling to developers, our wins, our failures, and the rollercoaster journey we went through. The aim is to provide some insight into how different behaviours influence user adoption and hopefully some takeaways you can use when you're involved in such projects, either as part of a delivery team or conversely as an end user
-
keyboard_arrow_down
Beatriz Guevara - Hacking HR: Co-creating Agile Workplaces
30 Mins
Talk
Intermediate
Humanising workplaces in this digital era is only possible if HR and technology leverage from each others' skills and expertise. Let's re-define work together!
-
keyboard_arrow_down
Jessica - Why things fail
30 Mins
Interactive
Beginner
Why did the iPad make it but Google Glass cost google $900million?
In this new world of unicorns, upstarts and silicon roundabouts, it's easy to get caught up it making it, but how do we effectively and responsibly innovate?
In this interactive session, we will look at case studies over the last 80 years of some of the biggest product flops; what went wrong and which companies went on to recover. The intention is to explore what not to do; the untold stories of success and leave with a refreshed understanding of why failure is critical in the pursuit of innovation.
Join me to create you own innovation equation to take into your work, own ideas and everyday life.
-
keyboard_arrow_down
Jochy Reyes / Simone Hambrook - Down the rabbit hole: the 'wonderland' of one of Australia's biggest Agile "transformation"
45 Mins
Talk
Intermediate
“We’re all quite mad here! You’ll fit right in.” - Mad Hatter, Alice in Wonderland
In 2017, ANZ, a 180+ year old bank made an official announcement that it will embark an organisation-wide change program to adopt Agile and transition 13,000 of its employees to this new ways of working. Like many others I found this interesting, commendable and quite frankly a bit crazy.
Fast forward to January 2019, we find ourselves joining the Mad Hatter's tea party and frankly going mad ourselves.
What is it like down the rabbit hole? Who are the interesting characters we have met so far, are they allies or foes? The Queen of spades? the Cheshire cat? What lessons have we learned so far in this adventure?
“Curiouser and curiouser.” - Alice, Alice in Wonderland
Curiouser and curiouser you must be..
If you're curious about coaching at scale, the challenges of breaking down silos and bureaucracy in the bank and a preview of how it is to work with 60+ coaches in one division, this talk is for you.
There will be storytelling, laughter and the rolling of eyes not heads. We will share tools and techniques but more importantly there will be lessons learned.
Here is to ANZ, the rabbit hole and Alice!
-
keyboard_arrow_down
Stephen Morgan - Agilelistics – A Metric Driven Approach
45 Mins
Talk
Intermediate
What if everything we thought we knew about agile was wrong?
The nature of agile continually changes, which means its analysis must also keep pace. Agilelistics is for practitioners, thinkers, and theorists of agile.
The data analytics revolution and agile metrics gather around agile teams, has become agile's new language and currency.
What is Agilelistics? Agilelistics is the practice where metrics is used to drive the entire product development cycle. The use of just-in-time metrics to drive rapid, precise and granular product iterations. In an organisation who uses metrics, where everything from performance to usage patterns is measured. Every single decision is used by the development team is based on metrics.
Steve Morgan helps you to decipher the statistical data, and to use it to uncovering agile's hidden truths.
- How do I know my team is improving?
- How many story points should my team tackle per sprint?
- How can I fix my team’s estimations which are currently not accurate?
- Is velocity a true measure of an agile team’s performance?
Through a blend of entertaining storytelling, agile metrics and analysis, This Agilelistics session will answer common questions about measuring agile team performance.