{"id":50,"date":"2011-02-08T11:25:54","date_gmt":"2011-02-08T19:25:54","guid":{"rendered":"http:\/\/blog.mozilla.org\/webappsec\/?p=50"},"modified":"2011-02-08T11:25:54","modified_gmt":"2011-02-08T19:25:54","slug":"scaling-security","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/","title":{"rendered":"Scaling Security"},"content":{"rendered":"<p><span>The <span>AppSec<\/span> space is an extremely challenging field to work in, largely  due to asymmetry; when you play defence you have to work to stay on top  of each emerging threat, vulnerability, and development that falls into  your scope.\u00a0 Working to protect a system or application where there is  fixed number of resources to spend on protecting a set of assets,  choices have to be made about how to best spend those resources to  prevent the attackers from winning.\u00a0 The best way to do that is by  applying risk analysis techniques and focusing on the highest risk  assets.\u00a0 Once those assets are identified, a decision has to be made  about how to invest time and effort in design vs. implementation, static  vs. dynamic analysis, and automated vs. manual testing.\u00a0 Regardless of  the goal of continuous engagement within the SDLC, decisions are made  based on the risk and the pool of limited resources must be split up to work  towards a solid defence.<br \/>\n<\/span><\/p>\n<p>The biggest challenge is that we have  a rapidly growing  development community; while the security team is  growing to meet our  needs, we need to find better ways to scale  testing and analysis  to get the same results with better efficiency.\u00a0 Out of the gate, I am going to deal with one important issue by casually  tossing it off to the side.\u00a0 Tooling is a really important part of the  discussion, but the bottom line is that tools won&#8217;t make a difference in  your organization if you don&#8217;t have the right people to use them.\u00a0 Good  tools <em>might<\/em> help unskilled workers get good results, but skilled workers  with suboptimal tools will still get great results.\u00a0 The adage &#8220;It&#8217;s a  poor craftsman who blames his tools&#8221; sums it up neatly.<\/p>\n<p>In order to scale up a team with limited resources (time, people,  money), there are a number of things that can be done.<\/p>\n<ul>\n<li>Threat Modeling\/SDL activities are the best investment; you can fix  many problems early, and eliminate extremely costly design weaknesses<\/li>\n<li><span>Bug Bounties\u00a0 are a great way to reward the efforts of community  contributors, but many contributions don&#8217;t come until the target is in  production (i.e. the worst time to find bugs) <\/span><\/li>\n<li>Automated tools for dynamic and static analysis allow you to trade  time and money for results, but you still have to invest in the people  to use them properly<\/li>\n<li>Manual analysis consumes time and people; it takes a great deal of  time and effort by skilled people to fix the problems<\/li>\n<li>Training and Education requires investment of time, people, and money,  and although valuable, is rarely as effective as working through threat  modelling and SDL activities with your development team<\/li>\n<\/ul>\n<p><span>Each of these types of activities are already in place in Mozilla, but  there is still more we can do.\u00a0 We perform a great deal of manual  testing because once we have reached that point in the development  life cycle, it is the best way to find implementation or design issues  that slipped through the cracks.\u00a0\u00a0 One area we are investigating is how to make our manual testing and  analysis repeatable and reusable. <\/span><\/p>\n<p>Some things we plan to do to move in this direction include:<\/p>\n<ul>\n<li><span> Building repeatable security test cases using tools like <a href=\"https:\/\/developer.mozilla.org\/en\/Mozmill\"><span>MozMill<\/span><\/a>, <a href=\"http:\/\/seleniumhq.org\/\"> Selenium<\/a>, etc. where possible, and develop highly specific, but reusable  guidance where it isn&#8217;t. <\/span><\/li>\n<li> Run repeatable test cases as regression testing against apps in  development and production<\/li>\n<li> Identify high risk applications, frameworks, and components, and  regularly review changes to them outside of releases and milestones<\/li>\n<li> Investigate how to use static and dynamic analysis tools to  supplement regression and manual testing to bring the best value<\/li>\n<\/ul>\n<p>As we get these activities up and running, we will keep the community  updated on how we are progressing.<\/p>\n<p><span><span>Yvan<\/span> <span>Boily<\/span> <\/span><br \/>\nProtocol Prowler<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The AppSec space is an extremely challenging field to work in, largely due to asymmetry; when you play defence you have to work to stay on top of each emerging &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/\">Read more<\/a><\/p>\n","protected":false},"author":1438,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[121],"tags":[],"coauthors":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Scaling Security - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"mozilla\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/\",\"name\":\"Scaling Security - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"datePublished\":\"2011-02-08T19:25:54+00:00\",\"dateModified\":\"2011-02-08T19:25:54+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/70ae25c16f09d053c6d8b5eac29dbda9\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Scaling Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/70ae25c16f09d053c6d8b5eac29dbda9\",\"name\":\"mozilla\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/98138a294cb6e19a68b02ef8ca9be2dc\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/75d2017e019c87560fe5d148a64659dc?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/75d2017e019c87560fe5d148a64659dc?s=96&d=identicon&r=g\",\"caption\":\"mozilla\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Scaling Security - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/","twitter_misc":{"Written by":"mozilla","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/","url":"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/","name":"Scaling Security - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"datePublished":"2011-02-08T19:25:54+00:00","dateModified":"2011-02-08T19:25:54+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/70ae25c16f09d053c6d8b5eac29dbda9"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2011\/02\/08\/scaling-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Scaling Security"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/70ae25c16f09d053c6d8b5eac29dbda9","name":"mozilla","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/98138a294cb6e19a68b02ef8ca9be2dc","url":"https:\/\/secure.gravatar.com\/avatar\/75d2017e019c87560fe5d148a64659dc?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/75d2017e019c87560fe5d148a64659dc?s=96&d=identicon&r=g","caption":"mozilla"}}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/50"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/1438"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=50"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/50\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=50"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}