退屈なPCI-DSSコンプライアンスを誰にとっても有意義な取り組みに変える：パート2-CISOと開発者の意識
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
これは、組織内のPCI-DSSコンプライアンスに関するミニシリーズのパート2です。この最終章では、サイバーリスクを軽減し、プロセスをシームレスで成功させるために、CTOとCISOがトップからどのように指導できるかを詳しく説明します。開発者にとってはちょっと楽しいかもしれません。
マティアス・マドゥ博士は、セキュリティ専門家、研究者、CTO、セキュア・コード・ウォリアーの共同創設者です。Matias はゲント大学で静的分析ソリューションを中心にアプリケーションセキュリティの博士号を取得しました。その後、米国のFortifyに入社し、開発者が安全なコードを書くのを手伝わずに、コードの問題を検出するだけでは不十分であることに気づきました。これがきっかけで、開発者を支援し、セキュリティの負担を軽減し、顧客の期待を超える製品を開発するようになりました。Team Awesome の一員としてデスクにいないときは、RSA カンファレンス、BlackHat、DefCon などのカンファレンスでプレゼンテーションを行うステージでのプレゼンテーションを楽しんでいます。
Secure Code Warriorは、ソフトウェア開発ライフサイクル全体にわたってコードを保護し、サイバーセキュリティを最優先とする文化を築くお手伝いをします。アプリケーションセキュリティマネージャ、開発者、CISO、またはセキュリティ関係者のいずれであっても、安全でないコードに関連するリスクを軽減するお手伝いをします。
デモを予約
マティアス・マドゥ博士は、セキュリティ専門家、研究者、CTO、セキュア・コード・ウォリアーの共同創設者です。Matias はゲント大学で静的分析ソリューションを中心にアプリケーションセキュリティの博士号を取得しました。その後、米国のFortifyに入社し、開発者が安全なコードを書くのを手伝わずに、コードの問題を検出するだけでは不十分であることに気づきました。これがきっかけで、開発者を支援し、セキュリティの負担を軽減し、顧客の期待を超える製品を開発するようになりました。Team Awesome の一員としてデスクにいないときは、RSA カンファレンス、BlackHat、DefCon などのカンファレンスでプレゼンテーションを行うステージでのプレゼンテーションを楽しんでいます。
Matiasは、15年以上のソフトウェアセキュリティの実務経験を持つ研究者および開発者です。フォーティファイ・ソフトウェアや自身の会社であるセンセイ・セキュリティなどの企業向けにソリューションを開発してきました。マティアスはキャリアを通じて、複数のアプリケーションセキュリティ研究プロジェクトを主導し、それが商用製品につながり、10件以上の特許を取得しています。デスクから離れているときには、マティアスは上級アプリケーション・セキュリティ・トレーニング・コースの講師を務め、RSA Conference、Black Hat、DefCon、BSIMM、OWASP AppSec、BruConなどのグローバルカンファレンスで定期的に講演を行っています。
マティアスはゲント大学でコンピューター工学の博士号を取得し、そこでアプリケーションの内部動作を隠すためのプログラムの難読化によるアプリケーションセキュリティを学びました。
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
以下のリンクをクリックして、このリソースのPDFをダウンロードしてください。
Secure Code Warriorは、ソフトウェア開発ライフサイクル全体にわたってコードを保護し、サイバーセキュリティを最優先とする文化を築くお手伝いをします。アプリケーションセキュリティマネージャ、開発者、CISO、またはセキュリティ関係者のいずれであっても、安全でないコードに関連するリスクを軽減するお手伝いをします。
レポートを表示デモを予約
マティアス・マドゥ博士は、セキュリティ専門家、研究者、CTO、セキュア・コード・ウォリアーの共同創設者です。Matias はゲント大学で静的分析ソリューションを中心にアプリケーションセキュリティの博士号を取得しました。その後、米国のFortifyに入社し、開発者が安全なコードを書くのを手伝わずに、コードの問題を検出するだけでは不十分であることに気づきました。これがきっかけで、開発者を支援し、セキュリティの負担を軽減し、顧客の期待を超える製品を開発するようになりました。Team Awesome の一員としてデスクにいないときは、RSA カンファレンス、BlackHat、DefCon などのカンファレンスでプレゼンテーションを行うステージでのプレゼンテーションを楽しんでいます。
Matiasは、15年以上のソフトウェアセキュリティの実務経験を持つ研究者および開発者です。フォーティファイ・ソフトウェアや自身の会社であるセンセイ・セキュリティなどの企業向けにソリューションを開発してきました。マティアスはキャリアを通じて、複数のアプリケーションセキュリティ研究プロジェクトを主導し、それが商用製品につながり、10件以上の特許を取得しています。デスクから離れているときには、マティアスは上級アプリケーション・セキュリティ・トレーニング・コースの講師を務め、RSA Conference、Black Hat、DefCon、BSIMM、OWASP AppSec、BruConなどのグローバルカンファレンスで定期的に講演を行っています。
マティアスはゲント大学でコンピューター工学の博士号を取得し、そこでアプリケーションの内部動作を隠すためのプログラムの難読化によるアプリケーションセキュリティを学びました。
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
目次
マティアス・マドゥ博士は、セキュリティ専門家、研究者、CTO、セキュア・コード・ウォリアーの共同創設者です。Matias はゲント大学で静的分析ソリューションを中心にアプリケーションセキュリティの博士号を取得しました。その後、米国のFortifyに入社し、開発者が安全なコードを書くのを手伝わずに、コードの問題を検出するだけでは不十分であることに気づきました。これがきっかけで、開発者を支援し、セキュリティの負担を軽減し、顧客の期待を超える製品を開発するようになりました。Team Awesome の一員としてデスクにいないときは、RSA カンファレンス、BlackHat、DefCon などのカンファレンスでプレゼンテーションを行うステージでのプレゼンテーションを楽しんでいます。
Secure Code Warriorは、ソフトウェア開発ライフサイクル全体にわたってコードを保護し、サイバーセキュリティを最優先とする文化を築くお手伝いをします。アプリケーションセキュリティマネージャ、開発者、CISO、またはセキュリティ関係者のいずれであっても、安全でないコードに関連するリスクを軽減するお手伝いをします。
デモを予約[ダウンロード]始めるためのリソース
%20(1).avif)
.avif)
Threat Modeling with AI: Turning Every Developer into a Threat Modeler
Walk away better equipped to help developers combine threat modeling ideas and techniques with the AI tools they're already using to strengthen security, improve collaboration, and build more resilient software from the start.
