With many automotive organizations transforming development efforts towards agile methodologies, the need to redefine and establish security, safety, and quality standards and testing methods is more important than ever. How do we fit safety and security planning and tools into the adaptive development and rapid delivery practices of agile teams? In this second one-hour webinar you'll learn how to: - Integrate security and compliance testing with agile development - Provide context for fast triage and remediation - Create policies for code management in integrated testing environments

1. Navigating Agile
automotive software
development
June 24, 2015

2. Presenters
Jeff Hildreth, Automotive Account Manager
Rogue Wave Software
Ahmed Abdelrahman, Release Engineer
Rogue Wave Software
John Chapman, Solutions Architect
Rogue Wave Software
2© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED

3. Agenda
• A holistic approach to cybersecurity
• Blending DevOps and Agile for security
• How to implement a Jenkins CI system
• Examples of security defects
• Q&A
3© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED

4. A holistic approach to
cybersecurity

5. A holistic approach to cybersecurity
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 5
Information overload
Develop an adaptive threat
model
Threat
Model
External
Data
Internal
Threat
Metric
Action

6. © 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 6
Threat model
Most breaches result from input trust issues
Threat modeling identifies, quantifies, and addresses
security risks by:
1. Understanding the application & environment
2. Identifying & prioritizing threats
3. Determining mitigation actions
Identify
assets
System
overview
Decompose
application
Identify
threats
Prioritize
threats

7. © 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 7
Security overload
News
Blogs, social media
conferences
Security standards
OWASP, CWE, CERT, etc.
Senator Markey report
NVD, White Hat, Black Hat OEMs, internal
Media More and more software running inside
your car
Standards and legislation
Research Requirements
Developers don’t know security
(80% failed security knowledge survey)

8. Developing a threat metric
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 8
Build score
• Automated and functional testing can give you a pass fail metric on every
run of the test suite
• A metric can be generated from penetration testing based on the number
of exploitable paths in your code base
• Software quality tools can give you a count of critical static analysis and
compiler warnings
• A metric can be developed based on the presence of snippets of open
source code previously undetected or open source with new known
vulnerabilities
• All of these metrics can be generated on every build of your software

9. DevOps & Agile for
security

10. Agile development: Integrated
security
© 2015 Rogue Wave Software, Inc. All Rights Reserved. 10
Adaptive
Accept
Sprint 1
Sprint 2
Sprint n
Release
Change
Adjust and Track
Feedback
Review
Next Iteration
No!
Yes!
Release
to
Market
Integrate
and Test
Integrate
and Test
Integrate
and Test
Multiple testing
points
Rapid feedback
required
“Outside” testing
does not meet
Agile needs

11. DevOps SDLC
11
Continuous
Integration
SDLC Step
UAT/
exploratory
testing
Functional
testing
Performance
load security
Release Deploy
Metric
Understand
Needs
Invent
Solution
Develop
Build
Commit
Idea
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED

12. Jenkins CI

13. Jenkins CI
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 13

14. Security example

15. Load, Performance, Security…Testing phase
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 15
Load, Performance,
Security, … Testing

16. Develop, commit & build
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 16

17. Develop, commit & build
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 17

18. DevOps SDLC
18
Continuous
Integration
SDLC Step
UAT/
exploratory
testing
Functional
testing
Performance
load security
Release Deploy
Metric
Understand
Needs
Invent
Solution
Develop
Build
Commit
Idea
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED

19. Conclusions
© 2015 ROGUE WAVE SOFTWARE, INC. ALL RIGHTS RESERVED 19
The application security world is fluid
Create concrete,
actionable strategies
(Threat Metric, analysis & scanning)
Delivery cycles are short
Update regularly with
well-defined process
(Agile, CI)

20. See us in action:
www.roguewave.com
Jeff Hildreth | jeff.hildreth@roguewave.com

21. Q&A