Austin OWASP Chapter Meeting: Learn to Fight Wounded

Vern Williams presented at the Austin OWASP chapter meeting today on "Process and Architecture" in software development.  He advocates an engineering approach to security in software and systems, and suggests "engineering better management in." rather than reacting later.

In terms of software, architecture means designing something that meets the needs of the customer, but is also resilient, robust (resistant to failure) and secure.  This means that even when the system does fail, it will be gradual rather than catastrophic, and recovery will be rapid when something bad happens.

Vern also spoke about users and the importance of training.  He suggested warning users to notice when there are problems and alert IT.  Then again, it has been said that a user and his mouse can be viewed as a "malicious rodent on the desktop."









Vern also spoke about defense-in-depth, and used a few examples from his days in the navy, working on nuclear subs.  He described life about the nuclear sub as "the only place people run toward fires."

To the audience of mainly application developers, pen testers and security professional, Vern made a very interesting observation: We need to learn how to fight wounded.  Everyone in the audience agreed that it is foolish to assume that your company is impenetrable.  The best thing to do is figure out how to architect your systems and applications  in a way that is attack-resistant.