Michael Brunton-Spall Lead Security Architect Government Digital - - PowerPoint PPT Presentation

▶
michael brunton spall lead security architect government
SMART_READER_LITE
LIVE PREVIEW

Michael Brunton-Spall Lead Security Architect Government Digital - - PowerPoint PPT Presentation

May 13, 2023 141 likes •1.03k views

Michael Brunton-Spall Lead Security Architect Government Digital Service @bruntonspall Being secure and agile GOTO Amsterdam 2016 Michael Brunton-Spall GDS Michael Brunton-Spall @bruntonspall He/His/Him Michael Brunton-Spall GDS Lead

slide-1
SLIDE 1

Michael Brunton-Spall Lead Security Architect Government Digital Service @bruntonspall

slide-2
SLIDE 2

Being secure and agile

GDS Michael Brunton-Spall

GOTO Amsterdam 2016

slide-3
SLIDE 3

Michael Brunton-Spall @bruntonspall He/His/Him

GDS Michael Brunton-Spall

slide-4
SLIDE 4

Lead Security Architect Cabinet Office UK Government

GDS Michael Brunton-Spall

slide-5
SLIDE 5

I'm from the Government, and I'm here to help

GDS Michael Brunton-Spall

slide-6
SLIDE 6

I'm from security, and I'm here to help

GDS Michael Brunton-Spall

slide-7
SLIDE 7

The state of security

GDS Michael Brunton-Spall

slide-8
SLIDE 8

Certification
 Accreditation PCI
 ISO27001

GDS Michael Brunton-Spall

slide-9
SLIDE 9

GDS Michael Brunton-Spall

slide-10
SLIDE 10

Change control boards

GDS Michael Brunton-Spall

slide-11
SLIDE 11

GDS Michael Brunton-Spall

slide-12
SLIDE 12

Agile changes everything

GDS Michael Brunton-Spall

slide-13
SLIDE 13

What is agile?

GDS Michael Brunton-Spall

slide-14
SLIDE 14

GDS Michael Brunton-Spall

slide-15
SLIDE 15

While the things on the right have value

GDS Michael Brunton-Spall

slide-16
SLIDE 16

The things on the left have more value

GDS Michael Brunton-Spall

slide-17
SLIDE 17

Individuals and interactions over processes and tools

GDS Michael Brunton-Spall

slide-18
SLIDE 18

Working software over comprehensive documentation

GDS Michael Brunton-Spall

slide-19
SLIDE 19

Responding to change

  • ver following a plan

GDS Michael Brunton-Spall

slide-20
SLIDE 20

Customer collaboration

  • ver contract negotiation

GDS Michael Brunton-Spall

slide-21
SLIDE 21

Contracts, Planning, Documentation, Processes and Tools

GDS Michael Brunton-Spall

slide-22
SLIDE 22

Collaboration, Change, Deliverables, People

GDS Michael Brunton-Spall

slide-23
SLIDE 23

Building software together

GDS Michael Brunton-Spall

slide-24
SLIDE 24

Support and trust

GDS Michael Brunton-Spall

slide-25
SLIDE 25

Simplicity

GDS Michael Brunton-Spall

slide-26
SLIDE 26

Maximising work not done

GDS Michael Brunton-Spall

slide-27
SLIDE 27

"Minimising the lead time for delivering business value" @tastapod

GDS Michael Brunton-Spall

slide-28
SLIDE 28

What does this mean today?

GDS Michael Brunton-Spall

slide-29
SLIDE 29

Minimum viable product or service

GDS Michael Brunton-Spall

slide-30
SLIDE 30

Iterate

GDS Michael Brunton-Spall

slide-31
SLIDE 31

Release early, release often

GDS Michael Brunton-Spall

slide-32
SLIDE 32

GDS Michael Brunton-Spall

slide-33
SLIDE 33

Principles

GDS Michael Brunton-Spall

slide-34
SLIDE 34

Protect personal data

GDS Michael Brunton-Spall

https://www.cesg.gov.uk/guidance/protecting-bulk-personal-data

slide-35
SLIDE 35

Security design principles

GDS Michael Brunton-Spall

https://www.cesg.gov.uk/guidance/security-design-principles-digital-services-0

slide-36
SLIDE 36

8 Principles of risk management

GDS Michael Brunton-Spall

https://www.gov.uk/government/publications/principles-of-effective-cyber-security-risk-management

slide-37
SLIDE 37

Accept uncertainty
 Security as part of the team
 Understand the risks

GDS Michael Brunton-Spall

slide-38
SLIDE 38

Trust decision making
 Security is part of everything User experience is important

GDS Michael Brunton-Spall

slide-39
SLIDE 39

Audit decisions
 Understand big picture impact

GDS Michael Brunton-Spall

slide-40
SLIDE 40

How does agile help?

GDS Michael Brunton-Spall

slide-41
SLIDE 41

Continual delivery of business value

GDS Michael Brunton-Spall

slide-42
SLIDE 42

Continual acceptance

  • f risk

GDS Michael Brunton-Spall

slide-43
SLIDE 43

Secure Agile Development

GDS Michael Brunton-Spall

slide-44
SLIDE 44

Security must be an enabler of the team

GDS Michael Brunton-Spall

slide-45
SLIDE 45

Safety engineering and security engineering

GDS Michael Brunton-Spall

slide-46
SLIDE 46

The unit of delivery is the team

GDS Michael Brunton-Spall

slide-47
SLIDE 47

The unit of decision making is the team

GDS Michael Brunton-Spall

slide-48
SLIDE 48

Risk

GDS Michael Brunton-Spall

slide-49
SLIDE 49

Educate the team to the threats

GDS Michael Brunton-Spall

slide-50
SLIDE 50

Keep a running risk log

GDS Michael Brunton-Spall

slide-51
SLIDE 51

Apply risk decisions per story

GDS Michael Brunton-Spall

slide-52
SLIDE 52

Apply controls per story

GDS Michael Brunton-Spall

slide-53
SLIDE 53

Security debt

GDS Michael Brunton-Spall

slide-54
SLIDE 54

Simple systems are more secure

GDS Michael Brunton-Spall

slide-55
SLIDE 55

Choosing the secure method must be the easiest option

GDS Michael Brunton-Spall

slide-56
SLIDE 56

Security as an enabler

GDS Michael Brunton-Spall

slide-57
SLIDE 57

Secure Agile Operations

GDS Michael Brunton-Spall

slide-58
SLIDE 58

Infrastructure as code

GDS Michael Brunton-Spall

slide-59
SLIDE 59

GDS Michael Brunton-Spall

slide-60
SLIDE 60

Infrastructure as testable code

GDS Michael Brunton-Spall

slide-61
SLIDE 61

GDS Michael Brunton-Spall

slide-62
SLIDE 62

GDS Michael Brunton-Spall

slide-63
SLIDE 63

Dealing with patches

GDS Michael Brunton-Spall

slide-64
SLIDE 64

What machines are affected?

GDS Michael Brunton-Spall

slide-65
SLIDE 65

GDS Michael Brunton-Spall

slide-66
SLIDE 66

GDS Michael Brunton-Spall

slide-67
SLIDE 67

Updating machines in test

GDS Michael Brunton-Spall

slide-68
SLIDE 68

GDS Michael Brunton-Spall

slide-69
SLIDE 69

Just some machines?

GDS Michael Brunton-Spall

slide-70
SLIDE 70

GDS Michael Brunton-Spall

slide-71
SLIDE 71

Repeat in production

GDS Michael Brunton-Spall

slide-72
SLIDE 72

What does Agile and DevOps give you?

GDS Michael Brunton-Spall

slide-73
SLIDE 73

Automated Testing

GDS Michael Brunton-Spall

slide-74
SLIDE 74

Infrastructure as code

GDS Michael Brunton-Spall

slide-75
SLIDE 75

Fast repeatable deploys

GDS Michael Brunton-Spall

slide-76
SLIDE 76

Audit logs

GDS Michael Brunton-Spall

slide-77
SLIDE 77

Code review of infrastructure changes

GDS Michael Brunton-Spall

slide-78
SLIDE 78

Confidence!

GDS Michael Brunton-Spall

slide-79
SLIDE 79

Why does that matter?

GDS Michael Brunton-Spall

slide-80
SLIDE 80

Australian Signals Directorate

GDS Michael Brunton-Spall

http://www.asd.gov.au/publications/protect/top_4_mitigations.htm

slide-81
SLIDE 81

Application whitelisting

GDS Michael Brunton-Spall

slide-82
SLIDE 82

Patching

GDS Michael Brunton-Spall

slide-83
SLIDE 83

Patching (again)

GDS Michael Brunton-Spall

slide-84
SLIDE 84

Minimise administrative controls

GDS Michael Brunton-Spall

slide-85
SLIDE 85

Done well, agile techniques mean more secure software

GDS Michael Brunton-Spall

slide-86
SLIDE 86

We're hiring!
 https://gds.blog.gov.uk/jobs

GDS Michael Brunton-Spall

slide-87
SLIDE 87

Michael Brunton-Spall
 Lead Security Architect Government Digital Service
 @bruntonspall