Be part of the Intuity Army
Send your application to careers@intuity.it.
By submitting your application, you confirm that you have read the privacy policy regarding the processing of your personal data for recruitment purposes.
In the same way that happens for any IT system, the main goals are:
- Assess risk
- Protect assets and reduce risk through mitigation strategy
This, in the most cost-efficient and business enabling way.
To assess a cloud-based system architecture security posture we need to identify and structure well-defined set dimensions (metrics) that can be measured against such cloud system. Having that risk assessment will drive the development and risk governance strategy including refactoring efforts in a more efficient and coherent way. This is true whether we are considering a single system or, especially, a set of independent systems. This is key in larger, more structured, organizations.
Frameworks like OWASP SAMM (Software Assurance Maturity Models) shows us a way to approach such an assessment challenge. Nevertheless having cloud-specific metrics and the right incentives in the organization hierarchy is a must-have to successfully deploy and drive such a security enhancement strategy.
The programme
We call “programme” that long term strategy and it encompass periodic assessment against the specific metrics to measure the progress and the effectiveness of the resources allocated to the programme. Having a single, central programme for maturity enhancement with clear goals will also boost technical resource reuse, experience sharing and wish to be more security-mature form the owners of the project itself.
The extreme quality of the biggest cloud providers platforms and documentation falsify the dichotomy of security VSs speed (cost) of development, at least in the longer term.</p> <p>Leveraging the vendor tools and best practices, but also applying security and quality principles to the software project fro the very beginning the lifecycle will always sooner show the advantages in terms of ease of development of new features and operational costs of maintenance. Continuous delivery of new software features is key for most companies and shortcuts in security and quality are traps for the business itself.
This is clearly shown in Martin Fowler in the “Is High Quality Software Worth the Cost?” graph:
High levelPersonally, I like the approach to OWASP SAMM framework, but it (rightly, being generic) lacks practices definition for the specific architecture, in our case cloud. The “practices” term in the previous sentence can be declined in: entry-level, medium and state of the art/best practices. Those practices, when implemented in the project would be associated to level 1, 2 or 3 of the maturity assessment.Maturity proposal Programme Implementation Strategy for multi-project