Introduction to the TestGuild Security Testing Podcast

Five, four, three, two, one.

Drop that.

Welcome to the Test Guild Security Podcast. We're all getting together to learn more about security testing with your host, Joe Calantonio.

Hey and welcome to the new Test Guild security testing podcast, episode 00. For those that don't know, I'm Joe Calantonio, founder of Test Guild, which is a blog, podcast and online conferences dedicated to helping software engineers succeed with end to end full stack testing. I'm also the host of the Test Guild Automation Podcast, formerly known as Test Talks, which I've been running since 2014, and also the Test Guild Performance Podcast, which I started a few months back. So a few people have asked me why I broke out the Test Talks. Now Test Guild podcasts into these different niches. I just felt from past episodes that I did all under Test Talks before I renamed to Test Guild. People didn't always listen to the performance ones or the security ones. Even though it's important, I think for everyone to know all types of testing, especially as we move towards the DevOps DevSecOps type world, I think testers need to be able to test from beginning to end all the way through end to end Full stack. I thought it'd be easier for folks to get the episodes they wanted if I broke them out into three distinct categories. So I have now Test Guild Automation Podcasts, Test Guild Performance Podcasts, and Site reliability. And also this is the Test Guild Security Podcast. So what can you expect from this podcast? Basically, I plan on releasing a new episode on security and security testing every Thursday and based on feedback from my other podcast, most people tend to like 30 minutes, so I'm gonna probably keep most episodes to 30 minutes or less and the format will mainly be me doing an interview style speaking with some of the top testing experts in the field. So for example, I currently have interviews lined up with Kevin E. Green, who who's a cybersecurity expert and researcher all about the Software Assurance Marketplace. Also, I have an interview set up with Jeff Martin from White Source on their latest survey about the state of software security, and also Francesca Buehler on OWASP Core Rules. So I have a bunch more lined up, but those are the ones I definitely have in my schedule for interviews, so you don't want to miss those. As I said, I'll be releasing every Thursday, but I'll be honest with you and tell you that I'm also new to security testing myself. So many of these episodes are going to be really geared towards beginners. So if you're new to security as well, it'd be like we're taking an audio learning journey together. So this is great because I'm going to totally avoid the curse of knowledge because I'm starting off fresh. But over time, as I gain experience, of course we'll probably have more and more technical sessions with experts on as well. It all depends on what you want basically. So, so I plan for this more to be the listener led podcast. So you know, if, if you want more expert type interviews, let me know and I'll line those up. Are there specific topics, speakers you want to know about? Not a problem. So anything to make the show better. All you need to do is feel free to drop me a line anytime@joestguild.com with any idea you might have to make this podcast more helpful to you because that's all that matters is you and value that you may be getting or not getting. If you're not getting value, let me know. I want to make this as a valuable resource to you. Also, as I mentioned earlier, I run online conferences. So I have one for automation called Automation Guild, one for performance called Perf Guild, one for testing called Testing Guild, and one for security called Secure Guild. So this podcast will help me know which subjects and topics and speakers are resonating with people, which ones are being downloaded more. And then based on that, I create better sessions around security topics that you need to know to help you with your day to day job. So you might be asking why then another podcast dedicated to security or security testing? Well, one thing I think I'm coming from this with a beginner's mind, so really new to the field. So you get to see how I grow over time as I learn more and more about security. So I think that's one difference than what is probably already out there. Also, you know, I feel very passionately that security is going to be the next hot topic. As I mentioned, I have a automation podcast that I run that I've been running for over almost six years now. I've interviewed over 280 folks. But the past year or so more and more people are bringing up the topic of security and, and I'm hearing more and more about DevSecOps. So I really think this is going to be a growing trend. And if you're a tester, I think it's a skill that you need to know more about or if you're a software engineer, you know, as part of our definition of done, it's going to be another activity you're going to have to know as you're creating software and trying to release it faster and quicker into production. Also, according to an article I recently read in the latest SD Times, security has hit an all time low point this year as 2019 saw the second, third and seventh biggest breaches of all time, measured by number of people that were affected. And I've been hearing more and more that it's becoming more common, especially with open source. So I feel that we're getting to a breaking point here where if you're not dealing with security, I think 2020, you're going to be dealing with security for sure. Also recently, I don't know how familiar you are with Disney, but Disney was recently released and according to a Washington Post article, thousands of Disney plus accounts were hacked. And basically they were hacked by hackers commandeering user accounts, locking out owners, changing login credentials, and in many cases selling them for as little as $3 apiece. I actually was speaking to someone last week and they were one of the folks that signed up for Disney plus and during Thanksgiving they had to lock down their credit cards because someone got a hold of it and they believe the reason why they got hold of it is directly to this Disney plus hack. So because of this and some other things, I really want to help raise the awareness for the need for more security testing and this podcast is my small contribution to this effort. Also, I worked for a large enterprise company for many years and although security was always on our team's definition of done, no one really know what it meant or what to do about it. Also, we had a separate security team, like a highly secretive security team somewhere in the company that supposedly handled everything, but we didn't know what they did, we never interacted with them. And so this caused issues because I feel that just like you can't test quality into already developed code, I don't believe you could test security into code that wasn't built for security to begin with. So you can't test what isn't testable. I don't think you can build security into code that is not secure from the start. And as more companies shift left in the software development lifecycle, I believe we need to start baking security into our code way before we get into any sort of testing scenario. And in fact this recently came up. I hosted a online event last week for a company called Vivint, and Vivint is a user group for mainly folks that use micro Focus tools. But most of the topics were generic enough to apply to anything, and so we had a lot of experts on speaking with Us a lot of experts from large companies that do consulting. And what came up over and over again was security and security testing, which I was kind of surprised by because usually, you know, this type of conference focuses more on functional test automation. So I just want to share a quick clip from a live Q and A I did from Vivint. So to learn more about Vivint, all you need to do is go to Vivint Worldwide.org and this was for their virtual days for their ADM Application Development Management solutions. So this excerpt is from a live keynote speaking with Rick Sullivan, who is the VP and GM of Application Services at DXC Technology, and Steven Dimitrov, who is a director of Application Solutions and Moretto Solutions. So two experts, they deal with a lot of customers, a lot of enterprise scenarios, so they have some great insight. And I just wanted to share with that really quickly because it kind of help validate why I'm releasing a new podcast dedicated just to security and security testing. So let's listen in really quick to see what they have to say about security. So one of the first questions I asked was in one of the sessions, Rick brought up the point that there's a talent war going on within companies trying to find people that have the right skills. So my question was what are some skills that are in demand right now that he sees? Which led to his following response.

From a talent perspective, yeah, there's a significant talent war that's out there. I think all companies, certainly our customers, all companies are struggling with that. There's a heavy focus on security and today's security isn't what it had been from decades ago. Security, I believe today is heavily about the applications layer and it is very much so akin to testing. Right. It has to do with understanding vulnerabilities that can be introduced as we're trying to deliver on faster and faster cycles. Okay. Of software with quality and so a heavy focus around application security, data security and security across that life cycle. Agile methods and agile experiences, I think are two areas that we heavily focus on and then through very hands on, practical work experiences.

So Rick, you did mention security. I've been hearing a lot of folks for some reason the last half of 2019 on my podcast, talking more and more about security. I've been aware of security. It's been on a backlog, so definition of done for a while. Just curious to know, Stephen, is this something you've been hearing as well? Is this something your company deals with or helps companies with their transformations, helping them with their security efforts?

Also yeah, absolutely. And if you look at my organization, we're a relatively small organization that focuses once again on testing. I would say about 60% of our business is on the traditional testing of applications and the remaining 40% is on security testing for those applications. If you looked at those numbers just one or two years ago, it would have been more skewed towards an 80, 20 type percentage. So we're seeing a lot of that. We're still seeing a lot of siloed perspective on security testing versus application testing. So we're trying to help our customers understand the benefits of bringing that all together and integrating that throughout their SDLC with something like DevSecOps, which Rick was talking about in detail in his keynote. But yeah, absolutely, it's something that all of our customers need. Everybody knows about it. It's a much more popular dialogue these days than traditional application testing. However, we're still working very hard with our customers to make sure that they view that as something that should be integrated across that life cycle.

Steven, I think that's really, there's a key word that you just mentioned about integrated right across that life cycle because historically, historically it's usually been a particular gate or it's been a checkpoint. I come from, I spent half my career in the public sector, space security and highly regulated industries has been critical for years. Having that integrated across the software development life cycle we found is key. And doing as much of a shift left approach to try and address security earlier in the lifecycle, even as early in the requirements in the architecture. Because as Steven had mentioned, in a traditional testing landscape, if we think about security and the vulnerabilities as just additional defects, potentially, as those defects potentially live on further downstream and if they were to go into production, the cost, the time and the effort in order to alleviate and address those vulnerabilities only become more costly and more time consuming and the risks open up much greater within there. So as much as one can bring that earlier on into say, the integrated life cycle, we find is key. And so looking at static application security testing, SAS early on and then even earlier to that from a requirement standpoint, the great thing is all of our favorite Fan Micro Focus, they've got a world class security engine in the form of Fortify. And the capabilities we've found within Fortify are extensional. And so we've integrated that into how we ourselves deliver and perform services for our customers. And then often we'll inject that into the continuous life cycle so that security is looked at as an integrated part Stephen, as you said, rather than either a bolt on or a checkpoint along the way.

Yeah, I mean it's a lot of common themes with DevOps. Right. So the shift left, the integration, the removal of silos certainly applies to the security world and those organizations that are able to to start with that approach, with that perspective and really focus on populating those different parts of their SDLC with those different things like security. Those are the ones that are really able to get off the ground quicker and get some real momentum with their DevOps transformations.

So that's exactly how I feel. Rick and Steven said it better than I could. So that's why I just wanted to give you a small flavor for what other experts are seeing out in the field and wanted to share with you and give more reasons why I feel there's a need for more security information, more security testing, education, and hopefully this podcast will be a small part of that. And funny enough, that live Q and A excerpt I just played back was totally unscripted. And Rick mentioned Micro Focus, which just so happens to be who is going to be the exclusive sponsor for the Test Guild Security podcast. So really excited to have them on board. There's a lot of knowledge there Micro Focus around security. And this is not going to be a Micro Focus podcast, but I'm just really excited to have a sponsor that understands security, knows about security and is a product that I can recommend to other folks, is a solution I can recommend wholeheartedly to other people because it's a company, as people I know and trust. Here's actually the first time hearing ever the sponsor spot for Micro Focus.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out, head on over to micro focus.com app security and lastly, if I'm being up front, I was laid off from my full time corporate gig a few months ago. So now I have all the time to do all kinds of cool things like this new podcast. And that's the last reason why I thought I'd start a new podcast all around Security Testing. So I'm really excited about this new security journey we're going to go on together. I really want this to add value to. So like I said, any suggestions, any comments? Send me an email anytime@joestgill.com for full show notes. Head on over to test guild.com slicksecurity S00 and while you're there, make sure to click on the Try for Free link under the Exclusive Sponsor section to learn all about Micro Focus's testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security podcast. Head on over to test guild.com for full show notes, amazing blog articles, and online testing conferences. Make sure to subscribe to join the Guild and continue your testing journey. This has been a Joe Calantonio production.