10 IoT Cyber Security
483
• Every-Sprint Requirements: These requirements are included within each sprint.
They reduce your team’s velocity. An example of an “every-sprint” user story
is: As a user I can expect that my software is free from known vulnerabilities
identified in the OWASP Top 10. This user story ensures code is analyzed each
sprint and cannot be deemed complete until all OWASP Top 10 vulnerabilities are
remediated. Alternatively, a development team might consider adding this type
of requirement to their “definition of done.” Either way, the team’s velocity is
decreased as these important security requirements must be handled each sprint.
• Bucket Requirements: These requirements are allocated to sprint backlogs as
velocity permits over the course of product development. The “bucket” that
contains each of these requirements must be emptied by the end of the project.
Proper management of these bucket requirements is essential to ensure that
there is a manageable amount of work left as the project completion nears.
Considerations regarding the release schedule of the project must also be taken
into account. If an IoT system continuously releases new features, then these
requirements should be incorporated during each release.
• One-Time Requirements: These requirements are included in a sprint one-time
only. Activities such as setting up a secure configuration management repository
or designing the security architecture can be included as one-time requirements.
Although these requirements are only included in a single sprint, they are usually
critically important to the cyber security posture of the product or system.
An example of a one-time user story that drives architectural decision making
might be: As a device administrator, I can be assured that my device’s private
key material is stored in protected hardware at all times, so that potential
compromise of device cryptographic keys is mitigated.
10.3.1.3 Establishing a Cyber Security Culture
The cyber security of an IoT product or system is everyone’s responsibility.
Members of the DevOps team must understand this, and all staff must be on the
lookout for poor security hygiene and bad operational security (OPSEC) practices.
There are a number of ways to instill a culture of cyber security within your
organization. This begins with appointing an executive to be accountable for the
security of the system. This executive must be given the authority to ensure that
sufficient investments are made to provide the team with the resources they need to
properly execute their cyber security responsibilities. There should also be security
evangelists identified within an organization. In some cases, these are funded
security professionals. In constrained environments, developers with an interest in
cyber security can be identified and trained in secure software development. The
role of the evangelist is to motivate the rest of the team to take security seriously
and to work with executive leadership to identify gaps in the secure development
process.
Best practices traditionally advocated within Extreme Programming (XP) are
useful for establishing cyber security processes across the development team. Pair
483
• Every-Sprint Requirements: These requirements are included within each sprint.
They reduce your team’s velocity. An example of an “every-sprint” user story
is: As a user I can expect that my software is free from known vulnerabilities
identified in the OWASP Top 10. This user story ensures code is analyzed each
sprint and cannot be deemed complete until all OWASP Top 10 vulnerabilities are
remediated. Alternatively, a development team might consider adding this type
of requirement to their “definition of done.” Either way, the team’s velocity is
decreased as these important security requirements must be handled each sprint.
• Bucket Requirements: These requirements are allocated to sprint backlogs as
velocity permits over the course of product development. The “bucket” that
contains each of these requirements must be emptied by the end of the project.
Proper management of these bucket requirements is essential to ensure that
there is a manageable amount of work left as the project completion nears.
Considerations regarding the release schedule of the project must also be taken
into account. If an IoT system continuously releases new features, then these
requirements should be incorporated during each release.
• One-Time Requirements: These requirements are included in a sprint one-time
only. Activities such as setting up a secure configuration management repository
or designing the security architecture can be included as one-time requirements.
Although these requirements are only included in a single sprint, they are usually
critically important to the cyber security posture of the product or system.
An example of a one-time user story that drives architectural decision making
might be: As a device administrator, I can be assured that my device’s private
key material is stored in protected hardware at all times, so that potential
compromise of device cryptographic keys is mitigated.
10.3.1.3 Establishing a Cyber Security Culture
The cyber security of an IoT product or system is everyone’s responsibility.
Members of the DevOps team must understand this, and all staff must be on the
lookout for poor security hygiene and bad operational security (OPSEC) practices.
There are a number of ways to instill a culture of cyber security within your
organization. This begins with appointing an executive to be accountable for the
security of the system. This executive must be given the authority to ensure that
sufficient investments are made to provide the team with the resources they need to
properly execute their cyber security responsibilities. There should also be security
evangelists identified within an organization. In some cases, these are funded
security professionals. In constrained environments, developers with an interest in
cyber security can be identified and trained in secure software development. The
role of the evangelist is to motivate the rest of the team to take security seriously
and to work with executive leadership to identify gaps in the secure development
process.
Best practices traditionally advocated within Extreme Programming (XP) are
useful for establishing cyber security processes across the development team. Pair