CI Sécurité Agile/en

Accélérer ou permettre l'implémentation de la Sécurité dans des contextes agiles.

Catégorie : Communauté d'intérêt

Diary of the Agile Security WG

On 05/09/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance: New stages proposed for the SDLC, closer to the DevOps philosophy than the traditional scheme. Drafting of V2 document, call for comments.

• Stream Security Champions & SME": Document outline and positioning of each section. Progress is fairly patchy, but some have started writing.

• Stream Technology": Evaluation of each technology at each session, recurring once a week. Call on the community of interest to request RETEX on certain technologies.

The overall objective is to agree on a road map to finalize the various deliverables by the end of the year.

On 06/27/23, the Agile Cybersecurity WG met in plenary to review progress on the various streams:

• Stream Gouvernance : A first draft of the SSLDC deliverable will be finalized in September.

• Stream Security Champions & EMS: Progress on EMS structure. The form of the deliverable will be defined next week. The various sections will be drafted this summer. The questionnaire will be sent out again this week.

• Technology Stream: The structure of the deliverable is taking shape. The mapping of technologies has been completed, and the stream is now working on assessing the relevance of each technology according to various criteria, and prioritizing technologies in order to build the ramp-up strategy. Next meeting scheduled for the end of August to resume work on the deliverable.

Creation of assignable tasks with deadlines for each person working independently during the July/August period.

On 05/30/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance: Finalization of the SSDLC draft, which will continue to be completed. At the same time, 4 major themes were addressed:
  • Scoping: definition and control of risks and impacts (linked to Threat Modeling)
  • Vulnerability prioritization & finding: definition of criteria and means to facilitate tool apprehension.
  • Training awareness
  • Ramp up: facilitating SSDLC deployment practices.

• Stream Security Champions & SME: Review of questionnaire. Discussion on a potential intermediate deliverable that will synthesize the questionnaire responses.

• Stream Technologies: Technology mapping is being finalized, with the first deliverable due by summer.
• Stream Threat Modeling: In view of the low number of participants, this stream will be postponed until the autumn, or merged with the Governance stream.

On 16/05/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance : Finalization of the 1st draft of the SSDLC milestones deliverable.

• Stream Security Champions & SME: Questionnaire to be revised by June 6 and sent to all members of the Agile Security community of interest.

• Stream Technologies": Technology mapping being finalized for first deliverable by summer.

Drafting of an umbrella text for all WG deliverables.

On 02/05/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Governance: Difficult to set up a SSDLC because of framing difficulties. Change of format with small group discussions on the direction to take, then proposal to the larger group. Set up a task force.

• Stream Security Champions & SME: Questionnaire revised, shortened and simplified. To be finalized June 06 in plenary.

• Stream Technologies: Mapping in progress. RETEX in writing.

On 18/04/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance: Definition of the various stages of the SSDLC with its security and input prerequisites. These steps will then be prioritized. The aim is to first produce a v1 of the SSDLC to present it to WG members and obtain feedback.

• Stream Security Champions & SME": Drafting of a questionnaire to be sent to the community of interest to obtain RETEX and identify common practices.
• Stream Threat Modeling: RETEX collection. Deliverables under discussion.

• Stream Technologies": Gathering RETEX on each company's experience of technological deployment. The aim is to establish a technological ramp-up strategy. To do this, it is necessary to list all the technologies to be considered.

On 04/04/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance: Kick off to define the frequency of meetings and the expectations of the various members. Umbrella document to be drawn up, with the various processes and prerequisites. No deliverables defined for the moment. The SSDLC will be a central element of governance.

• Stream Security Champions & SME: Several questions to guide a retex on the Security Champions approach are being written. Send a communication to the community of interest --> Stream Co-leader send the content of the message to the Cyber Campus to relay the message and obtain a wider retex that will benefit all.
• Stream Threat Modeling --> potential deliverables:
  • Threat Modeling process within SSDLC on 3 maturity levels with RACI
  • Attack modeling -> exchange format for information relevant to TM activities.
  • Criteria and pitfalls to avoid in TM tools. Threat pooling
  • Training modules (identify targets, skill families) and mapping.

• Stream Technologies": Production of a technology maturity matrix (where to start for which tools). Next session: mapping technologies and axes to be considered for the matrix, such as risk management, implementation complexity, cost...

On 21/03/23, the Agile Cybersecurity WG worked on:

• Progress and next steps for each stream
• Potential stream deliverables

He made the decisions to:

• Keep the recurrence of bi-weekly plenary meetings.
• Set recurrence for each stream
• Prepare workshops for stream

Please note that the Tooling stream has been renamed "Technology".

Le 21/02/23, le GT Cybersécurité Agile a travaillé sur :

• Le cadrage des streams

Il a pris les décisions de : ​

• Mettre en place deux ateliers avant le prochain GT. Un avec les coordinateurs et les leaders de chaque stream et entre membres de streams.

Il est à noter que le stream Spécificités et contraintes règlementaires a été remplacé par Outillage.

Le 07/02/23, le GT Cybersécurité Agile a travaillé sur :

• La validation des streams : Gouvernance, Security Champions et SME, Threat modeling, Spécificités et contraintes règlementaires
• La répartition des membres du GT sur chaque stream en tant que leaders/contributeurs/relecteurs

Le 24/01/23, le GT Cybersécurité Agile a travaillé sur :

• Présentation des membres​
• Les objectifs du GT ​
• Les livrables ​
• Le calendrier ​

Il a pris les décisions de : ​

• Se réunir tous les 15 jours en plénière ​
• S’organiser sous forme de sous streams à partir des propositions de thématiques, complétées par le GT lors de la prochaine session​
• S’accorder sur les contenus des streams et les rôles de chacun​

​

Il est à noter que la date du prochain GT est à définir.​

Groupes de travail

	Status	Description
Cybersécurité Agile : SSDLC	En cours	Schéma de SSDLC qui intègre le design, l'architecture, le developpement, le testing et la maintenance
Cybersécurité Agile : Security Champions & SME	En cours	Identifier l'intérêt pour les organisations d'avoir des Security Champions et Subject Matter Expert
Cybersécurité Agile : Technologies	En cours	Mise en place d'un ramp-up technologique pour définir une stratégie et un plan de mise en œuvre