CI Sécurité Agile/en

Accélérer ou permettre l'implémentation de la Sécurité dans des contextes agiles.

Catégorie : Communauté d'intérêt

Diary of the Agile Security WG

On 05/09/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance: New stages proposed for the SDLC, closer to the DevOps philosophy than the traditional scheme. Drafting of V2 document, call for comments.

• Stream Security Champions & SME": Document outline and positioning of each section. Progress is fairly patchy, but some have started writing.

• Stream Technology": Evaluation of each technology at each session, recurring once a week. Call on the community of interest to request RETEX on certain technologies.

The overall objective is to agree on a road map to finalize the various deliverables by the end of the year.

On 06/27/23, the Agile Cybersecurity WG met in plenary to review progress on the various streams:

• Stream Gouvernance : A first draft of the SSLDC deliverable will be finalized in September.

• Stream Security Champions & EMS: Progress on EMS structure. The form of the deliverable will be defined next week. The various sections will be drafted this summer. The questionnaire will be sent out again this week.

• Technology Stream: The structure of the deliverable is taking shape. The mapping of technologies has been completed, and the stream is now working on assessing the relevance of each technology according to various criteria, and prioritizing technologies in order to build the ramp-up strategy. Next meeting scheduled for the end of August to resume work on the deliverable.

Creation of assignable tasks with deadlines for each person working independently during the July/August period.

On 05/30/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance: Finalization of the SSDLC draft, which will continue to be completed. At the same time, 4 major themes were addressed:
  • Scoping: definition and control of risks and impacts (linked to Threat Modeling)
  • Vulnerability prioritization & finding: definition of criteria and means to facilitate tool apprehension.
  • Training awareness
  • Ramp up: facilitating SSDLC deployment practices.

• Stream Security Champions & SME: Review of questionnaire. Discussion on a potential intermediate deliverable that will synthesize the questionnaire responses.

• Stream Technologies: Technology mapping is being finalized, with the first deliverable due by summer.
• Stream Threat Modeling: In view of the low number of participants, this stream will be postponed until the autumn, or merged with the Governance stream.

On 16/05/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance : Finalization of the 1st draft of the SSDLC milestones deliverable.

• Stream Security Champions & SME: Questionnaire to be revised by June 6 and sent to all members of the Agile Security community of interest.

• Stream Technologies": Technology mapping being finalized for first deliverable by summer.

Drafting of an umbrella text for all WG deliverables.

On 02/05/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Governance: Difficult to set up a SSDLC because of framing difficulties. Change of format with small group discussions on the direction to take, then proposal to the larger group. Set up a task force.

• Stream Security Champions & SME: Questionnaire revised, shortened and simplified. To be finalized June 06 in plenary.

• Stream Technologies: Mapping in progress. RETEX in writing.

On 18/04/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance: Definition of the various stages of the SSDLC with its security and input prerequisites. These steps will then be prioritized. The aim is to first produce a v1 of the SSDLC to present it to WG members and obtain feedback.

• Stream Security Champions & SME": Drafting of a questionnaire to be sent to the community of interest to obtain RETEX and identify common practices.
• Stream Threat Modeling: RETEX collection. Deliverables under discussion.

• Stream Technologies": Gathering RETEX on each company's experience of technological deployment. The aim is to establish a technological ramp-up strategy. To do this, it is necessary to list all the technologies to be considered.

On 04/04/23, the Agile Cybersecurity WG met in plenary to report on the progress of the various streams:

• Stream Gouvernance: Kick off to define the frequency of meetings and the expectations of the various members. Umbrella document to be drawn up, with the various processes and prerequisites. No deliverables defined for the moment. The SSDLC will be a central element of governance.

• Stream Security Champions & SME: Several questions to guide a retex on the Security Champions approach are being written. Send a communication to the community of interest --> Stream Co-leader send the content of the message to the Cyber Campus to relay the message and obtain a wider retex that will benefit all.
• Stream Threat Modeling --> potential deliverables:
  • Threat Modeling process within SSDLC on 3 maturity levels with RACI
  • Attack modeling -> exchange format for information relevant to TM activities.
  • Criteria and pitfalls to avoid in TM tools. Threat pooling
  • Training modules (identify targets, skill families) and mapping.

• Stream Technologies": Production of a technology maturity matrix (where to start for which tools). Next session: mapping technologies and axes to be considered for the matrix, such as risk management, implementation complexity, cost...

On 21/03/23, the Agile Cybersecurity WG worked on:

• Progress and next steps for each stream
• Potential stream deliverables

He made the decisions to:

• Keep the recurrence of bi-weekly plenary meetings.
• Set recurrence for each stream
• Prepare workshops for stream

Please note that the Tooling stream has been renamed "Technology".

On 21/02/23, the Agile Cybersecurity WG worked on:

• Stream framing

He made the decisions to:

• Set up two workshops before the next WG. One with the coordinators and leaders of each stream and between stream members.

Note that the stream Specificities and regulatory constraints has been replaced by Tooling.

On 07/02/23, the Agile Cybersecurity WG worked on:

• Validation of streams: Governance, Security Champions and EMS, Threat modeling, Regulatory specificities and constraints.
• The allocation of WG members to each stream as leaders/contributors/reviewers.

On 24/01/23, the Agile Cybersecurity WG worked on:

• Presentation of members
• WG objectives
• Deliverables
• Timetable

He made the decisions to:

• Meet every 15 days in plenary session.
• Organize into sub-streams based on proposed themes, completed by the WG at the next session.
• Agree on stream content and roles.

Please note that the date of the next WG is still to be determined.

Groupes de travail

	Status	Description
Cybersécurité Agile : SSDLC	En cours	Schéma de SSDLC qui intègre le design, l'architecture, le developpement, le testing et la maintenance
Cybersécurité Agile : Security Champions & SME	En cours	Identifier l'intérêt pour les organisations d'avoir des Security Champions et Subject Matter Expert
Cybersécurité Agile : Technologies	En cours	Mise en place d'un ramp-up technologique pour définir une stratégie et un plan de mise en œuvre