1. Who is at the Helm?
An Agile Assurance Case Study
A particular instance of Agile Assurance analyzed to
illustrate Sustainable Security Practices
October 31, 2012
David Brown
Peter Woodhull
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012

2. "The most difficult thing is the decision
to act,
the rest is merely tenacity.
The fears are paper tigers,
and the procedures, the process are
their own reward.“Amelia Earhart
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012

3. An Exercise in Contrast
Concepts
Issue Resolution
Evolution of the Analyst
New Techniques
Virtual SSP
Agile Management
Goals
Agenda
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

4. Compare & Contrast
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

5. Key Concepts
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
ownership sustainable
program value
cost, schedule,
capability trade-off
upfront assurance
near real-time
decision support
cross-cutting
concerns visualization
information →
decision → action
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

6. Action Based Management
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals
Do we care?
Dependable?Actionable?

7. Deep Environmental
UnderstandingThe evolution of the Analyst into
a Nexus
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

8. New Techniques
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Shared Ownership →
Modified Assurance
Capability →
Education →
Best Practice, Tools,
Deputized Project Team →
Education Leads…
Results Follow!
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

9. Virtual SSP
• Requirements
• Control Point
• Intersections of
Accountability and Authority
• Tooling
• Auditing
• Visualization
• Traceability Matrix
• Validation & Verification
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
→
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

10. Agile Management Workstreams
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

11. Agile Management
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

12. Task Management
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Sprints - User Stories - Control Work Items - Workflow
Sprint
Backlog
Project Backlog
Grooming
Feedback
Working
IncrementTest-driven
Development
N-1
Testing
Product Owner
Delivery
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

13. Agile Goals
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Validation & verification
Replace emotions with facts
Empirical metrics
Collaboration
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

14. “Education is a better
safeguard of security
than a standing army.”
Edward Everett
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals

15. Target IA Commitment
29-31 Oct 2012 International Conference on Software Quality - ICSQ 2012
the kanban Assurance Manifesto
We are uncovering better ways of providing Assurance by doing it and helping others.
Through this work we have come to value:
Explicit communications
Over intuitive abilities
Small steps
Over big changes
Quality systems
Over heroic individuals
Requirements driving our understanding
Over assumptions in which we must trust
While we appreciate the standard concepts below,
we value the bold principle above.
Contrast | Concepts | Resolution | Analyst | Techniques | Virtual SSP | Management | Goals