Security and Certifications with Nancy Gariché

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Nancy Garrick, all about cybersecurity certifications, DevOps, dev slots, all kinds of cool topics. In the early 2000s, Nancy joined the Canadian Federal government as a computer science student and never left. And in 2009 she moved to Ottawa from Montreal, her beloved hometown, to land her first IT security job as a security analyst. This multi hat role gave her the opportunity to take on duties in multiple disciplines ranging from incident handling to project and risk management. She's involved in a bunch of local infosec communities and has inspired to welcome and empower a new generation of industry professionals into the workspace. She is currently leading her Federal Department Security Assessment and and Authorization program and she's the co founder of Secure that Cert, a community that helps cybersecurity professionals and enthusiasts obtain the skills and certifications required to kickstart or level up their career. You don't want to miss this episode. Check it out.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits and against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components, components and scale. As your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey Nancy, welcome to the Guild.

Hey Joe, thank you for having me.

It's awesome to have you on the show I guess. Before we get into it, can you tell us a little bit more about yourself that I may have missed in your intro?

Oh, you covered pretty much everything.

That was a really good summary. I'm currently part of the Security Assessment and Authorization team of my department in the Government of Canada. So I work as more in a compliance role right now and shifting. I joined recently the Cloud Security group so I'm learning a bunch of new stuff so that's awesome.

Cool. So you did mention that you started your career within security, but you had a background in computer science. That was your degree. What made you out of all the different areas of computer science you get into. Why. Why were you drawn to security?

Actually, it was an accident because I work with a really, really cool department for the rcmp, which is the Royal Canadian Mountain Police, kind of your FBI in the usa, but for Canada, cool. And yeah, we made investigations and we created the solutions that we needed to investigate. So it was really fun. But I also felt like.

I didn't specialize in anything. I was figuring out things but never really going deep into anything. And I didn't feel like a specialist in anything. So that's where I, I started to find opportunities to see where can I go and specialize. And the security role, because I was working in investigation, security was always in the back of my mind, but never a priority.

And then there was a security posting that I saw that I looked at the requirements and I realized, oh, I've been doing this for a while, so let's go into that department. And that's what happened.

So you said right now you're mostly working on compliance and a compliance role. And actually this is the first time I've spoken to someone in that particular role. What does that role entail?

Well, depending on where you work and what industry you work in, there are rules that you need to be compliant with, right? Usually it's a compliance framework. So I don't know if you heard of PCI dss, for example, that's if you deal with processing credit card information, then if your company deals with that kind of information, it has to comply to a bunch of controls. And I'm someone in my department that would make sure that before we go to an auditor, make sure that we comply to those rules. So PCI DSS is one of the framework, but if you're working in the medical field, it's HIPAA. In Canada we have what is called its G33. That's our own framework for the government of Canada. So we just kind of make sure we accompany projects from the beginning. So we try at least give them the security requirement based on the solution that they're going to build and then make sure that they, while they're building the application or the system that they comply to those frameworks.

So this might be a good segue in that if you're going to be audited, and I guess a lot of companies can be audited. So does someone need to be or does a team need to be certified in order to be able to be prepared for what they could possibly potentially be audited for from a security compliance type perspective?

Well, depending on the framework that you need to be audited for, but definitely for PCI dss, for example, that I mentioned, there are certification. Not anybody can do those audits, but there are people like myself, for example, in my own department, within my own organization. Before we go through that audit, you want to make sure that you're right, ready for it. So you, you kind of internally want to know what is required before you go through the audit. Because going through an audit is, is quite difficult, lengthy and can be expensive. So you don't want to do that and fail. So there are people like me within the organization that get the organization ready for that audit.

So I, I do have a healthcare background and we were audited by the US fda and so there was different rules and, and things that, that you know, you always had to follow. Is there anything at a high level you think most people aren't ready for from a security perspective when they're being audited?

Sometimes I feel like people don't have visibility into what.

They need to comply to. It's more of it's really hard in security to have clear security requirement from the beginning. I feel like we often come at the end and say you're not compliant, you're not compliant to this and that. But while we're building, dev teams are building their application, building their system, they were not aware of these requirements and we're always kind of having to reverse engineer solutions and find what needed to be dealt with from the beginning. So that's what I found. It's clear security requirements from the beginning is really rare and that's what makes it difficult because when you do have those requirements from the beginning, it's then super easy to audit them. Right? Because at the end you just go back to whatever you implemented from the beginning. But when you start so late, you have to go back and understand what was implemented. Understand, understand the solution that you're, you're building. And that brings me to, when I meet a team, I often ask them, okay, so tell me, you've been working on this project, what are you building? And there's a lack of documentation sometime and lack of, they build their solution, it's an idea, they go really fast. Now DevOps is really a trend that people want to build fast and be agile, but they don't necessarily take the time to document what they're doing and take the time to understand the threat that are possible to affect their system.

How can folks avoid that? Is there anything part of owasp? I know OWASP has a whole Bunch of different projects about starting up early, baking security into your requirements so that it's not like a last minute documentation type deal.

Yes, OWASP is a bunch of things, but one of my favorite project is the asvs, which stands for Application Security Verification Standard. That's it's not a compliance standard, but you can use it to make your own for your own organization. So it's a bunch of controls and depending on how sensitive is the information you're dealing with, you can select the level of protection you want for your information and from there you can select the controls that you need and implement them within your application and solution. So everybody knows, not everybody, but when people are introduced to OWASP, they're introduced to the OWASP top 10, which are 10 vulnerabilities, the most common vulnerabilities that you'll find in software. But it's not a complete. It's more of an awareness piece to let people know that software is vulnerable and that they should look into what they're building and once they're aware, they go to something like ASVs to be more specific into what they need to implement. Another nice project is the Proactive Controls. So that is okay, you know that you need to build a program. Let's see, what do you need to do to start a security program? So I think from memory, I think number one on that list is secure, having your security requirements. And as I was saying, that's something that sometimes doesn't happen very early on at. It's always at the end that we're like, oh, did you do this? Instead of telling people upfront while they're building what they need to implement.

So you did mention controls. Are there any common security tools folks should know or have their teams know about?

Well, I feel in security it's a lot about iam, a lot of identity and access management. That's a really big part of security. Making sure that everybody and every system, not only people but also services within your application, are authenticated properly and authorized properly. That's a very big piece. Once you have IAM implemented properly, I find that a solution starts well and then I would say protecting your data in motion when it goes from one system to another, your data at rest, like using encryption.

Encryption is a great control. However, it's also a vulnerability to your availability because what we use for encryptions are keys. And if you lose the key to your data, you lose access to your data. So that's why key management is also something that's really, really important because if we were going to tell people to encrypt everything, we need to make sure that they have a really good key management system. So IAM encryption key management, I feel like are those big categories that we.

Focus a lot in security, so these type of concepts. You do have a company called Secure Cert. What is Secure that Cert, what's that about? And then maybe talk about maybe. Are there any certifications that can help people learn some basics of security to get them up and running quickly?

Yeah, absolutely. So Secure that Cert is a nonprofit I started locally in Ottawa, Ontario, Canada where I wanted to give opportunities to people to get involved, to meet and learn together. Cybersecurity training can be very expensive. You can go on a boot camp for five days for $5,000 and it's really quick and you don't get to learn that much. The information is valuable, but learning that quickly is not a good way to learn for everybody. So with Secured at cert, we're able to take our time and, and put together study groups for the community. We get people interested in one certification in particular and we get together once or twice a week for, you know, six, 12 or 18 weeks, depending on the certification, and go through the material together. Then people are, if they want or not, go for the exam. Because that's something I often find that people don't realize. It's not because you study for a certification that you have to go for the exam. Certification are expensive to maintain, to acquire and maintain. So if you're going after the knowledge and nobody's your employer is not really asking for the paper, for the certification itself, it's okay to just get the knowledge, go through the information and not go for the exam. So that's what we try to do at Secured Ad Cert. We just get together, get the information required, give people the plan and schedule to go through the material. Because doing it alone, sometimes it's hard. There's a lot of great materials. We're not into content creation. Creation. There's a lot of courses on udemy, there's a lot of training online, there's learning platforms. But what they don't tell you is that a lot of people buy those training and never go through them. Because yeah, it's not, not everybody is a self starter, not everybody is a self learner. And when we're together, we, we get to, to move along and to have a support system to go through the, the certification process.

I love that idea. It's almost like you can hack a learning plan like you Said you don't necessarily need to take the exam, but it's a good maybe outline to go. Okay, here's, here's a. Something I can follow that from beginning to end kind of makes sense. It gives me some sort of direction or path that I can learn on my own.

Yeah, a structure. A structure. It's definitely. You have a syllabus. All, all certification have learning objectives from the start and you can skip. I find that people see certification as a binary, like it's good or not. And it's basically you go through the learning objectives and if you know half of them, skip them and go to what you don't know and focus on that. It's really, it's often an introduction to the area that you want to learn about. So if you have gaps in your knowledge, then that's a great way to see if you have good coverage. I like to go for the exam because it feels like I finished something and I feel accomplished. But that's just me. If you, you're okay to go through the knowledge and not necessarily go for the exam. And like I said, if your employer is not asking for it, that's fine.

Where I'm from, I come from a functional automation type background and certifications are kind of not taboo. But yet people have really strong opinions like, oh, certifications are worthless, some are not. Is that the same with security or security certs may be required?

Yes. Well, it all depends in what area, but the same insecurity. You'll see people saying, oh, I don't have a certification at all. I don't have any certification and I'm successful in my career and other people who swear by certification. And it's not that there's a good or bad answer, it's basically what works for you. Right. If you can't afford to go to college, if you don't have the time to go to college, what is another way for you to learn? Maybe certification is an option for you. And if, if that's the way you can learn you. That is easier for you to learn, then that's your path. But even a college degree, it's not the end of it. All right? It's not like you have a college degree and then you're ready for anything on the market. You still need to work on your skills. And it's the same for certification. You, you get them, it gives you a start and then shows people that you're committed, you're committed. You can focus on one thing and accomplish something. It's a proof that you can focus on something and then yes, you still have to have hands on experience to get yourself a lab and show and demonstrate that you can do what you've learned. But I also find that certifications are getting better and better at that. Meaning that it's no longer, not all of them, but quite a few of them are starting to implement labs within the exam. It's no longer a multiple choice exam. There, there are scenarios, there's a platform where you can, they can test you and say, yeah, if you had to do this, how would you do it? And they test you on, on accomplishing those tasks. So you can't go through the exam without really just studying your way there. You really have to practice. But not all certifications are made equal, right? Some certifications are still very high level and it's all about memorization and others are more hands on. So I would say do your research. There are a lot of certification out there and not all of them are equal. I would say see what the market wants and see which one will make you learn what you need to learn and what you want to learn as well. So you have the power, you need to decide what you want to get out of your certification.

So that's another great point. Also in functional automation there's competing bodies or certifications.

So is that the same security and if so, are there any leaders or ones like a clear ones that folks should focus in on?

No, it's been everywhere. We have competing bodies as well. A big one at the CISSP certification is from ISC Square and that's. You'll see that in most job posting for IT Security professional. But this is a manager type certification, right? There's no hands on. You cannot, you can spend six months studying and not open a computer at all and be certified as a cissp. Does it mean it's bad? No, there's really a lot of information in there that is, that is important for you to know, to think properly, to understand that security is a business requirement. But it's not what you would ask from somebody managing your network, for example. Right. So IC Square management, I find they're more geared towards management. But then you have COMPTIA that has certification like A plus network plus Security plus. Those are meant for practitioner people that are going to be hands on and not all of them. But this is a body, a certification body that is starting to implement more and more hands on testing to make sure that folks that are going through their certification journey actually have the hands on knowledge to support what the certification is about. So I feel like those two and I would say a third one that I see a lot in penetration testing. For example, the OSCP and eLearning both are certification bodies that are specific for network penetration testing and even web application penetration testing. And they are, they're great because they have proctored exam that are 24 hours that you can take at home. And it's basically a challenge. And for you to pass that exam, you need to go through the challenge and accumulate enough points for you to obtain your certification. And it's not unusual for people to fail at first and to go through the exam once, twice, even three times before they get to it. So it's no longer. Memorizing for these exams won't help you. You really need to take the time to, to understand the skill required.

Absolutely. So I guess another roadblock people say is a lot of times these certs aren't practical. But I'm just curious to know, in your day to day job, have you ever come across anything you're like, oh, I learned that in this cert and I actually can apply it. What I learned from the cert to my day to day activities.

Yes, absolutely. Because I work in compliance, I get to see different projects from different technologies. Right. So certification have been really great for me because as somebody who sees those technology but don't implement them and I have to evaluate them and provide advice on them without actually building them. Certification has been a great way for me to get an understanding, a level of understanding of what's going through. Because one day they're building a system on the cloud and if I haven't seen the cloud before, I need to get ramped up really, really quickly. So certification helps me to say, okay, what is important in that solution and how am I supposed to protect it? If they're now using kubernetes or containers, then I need to get ramped up and understand.

What I need to protect in those solutions.

I definitely leverage certification a lot to make sure that I can focus on the right things.

Nice. So just to switch gears again, we talked a little bit about owasp, but I know you're also a big contributor to Dev Slop. One is what is Dev slop? And then I thought it'd be fun to find out what part of dev slop you actually work on.

Yes, well, OWAS SLOP stands for Sloppy DevOps. It's a project that was created by Tanya Janka and Nicole Becker. So they met and they were discussing. They're both security practitioner at the time. I would say like five, six years ago, Security was not part or not part of DevOps. The DevOps movements were moving along, but security was not part of it. And they wanted to experiment with it and see how security could be part of DevOps. And they created a project called Dev Slot. And within that project we have multiple modules. One is a vulnerable application that Nicole Becker created that's called Pixie. We also have pipelines and a waf. Well, not the WAF itself, but the rules that are the configuration rules for the waf. And that part of the project is called Pixie crs, and that's led by Francisco Buhler that was on your podcast, and Nicole Becker as well, and Tanya Janka as well. I'm more on the education part, I guess. We have a show called the Desklop show that we stream on YouTube where we meet up with folks from the community and we ask them to teach us something new. It's video, because we always want to include a demo and make sure that people get a skill, even if it's a small skill. Like, we stream usually on Sunday afternoon Eastern time. And my idea is always that, okay, so on Monday morning, someone who watch our show on Sunday can actually try it out at work and get a new skill. So that's what we try to do. So we've been testing different things. Security testing, how to implement, testing in a pipeline, how with francisca, how to integrate the WAF into your pipeline. We're discussing serverless architecture, anything related to the cloud, and we go through a bunch of tools as well. Tooling is really, is not the only thing in DevOps, but is really important in DevOps. So therefore, understanding the different tools or kind of tools that are available to us and how we can leverage them to integrate security into DevOp practices.

I am addicted to tools. Are there any tools in your toolkit you love to use for security?

There are so many. I have in mind a graph that I saw recently with all the different tools that could be part of your CICD pipeline. And it's hundreds and hundreds of tools. But I would say something that I really like is a tool like Snyk or White Source. That because software right now is. When you build software, you leverage other tools, sometimes open source tools within your software. But if these parts are vulnerable, that also means that whatever you're building is also vulnerable. So having that kind of tool that can scan your application and understand if it has vulnerable components and make you aware that they are vulnerable to either remove them from your application or upgrade them or patch them so that your application is not vulnerable. Those are really tools that have very low false positive. Right. So it's either vulnerable or it's not. I find that other tools like SAS and das, I think that you've talked on the show before are valuable as well and necessary, but still they're not as clear in their result. There's a lot of false positive and they're really high touch kind of tools.

So Nancy, are there any resources you think everyone in security should know more about or know about whether it's a certification that they're getting ready for or basically just getting up to speed with anything to do with security testing type related activities?

I always want to encourage people to learn about OAS. I'm always surprised how little people know about OWASP. Sometimes they know like I've mentioned before about the OAuth top 10, but there's a lot more to know. We moved to a new website@oauth.org, a new platform so it's a lot easier to find what you need. But there are hundreds of projects that can help you build secure software. And one I mentioned ASVs and the ASVs project top 10 and proactive controls. But there's also a project called the Cheat Sheets series. Cheat Sheets series. And basically you can find a cheat sheet for about anything that you're trying to build. And I think that's, I would encourage everybody to go check it out and, and I'm sure that they'll be impressed of what they find.

Okay, Nancy, before we go, is there one piece of actionable advice you can give someone to help someone to help them with their security testing efforts or security efforts for certification and what's the best way to find or contact you?

So for certification I suggest people to really be in charge of their learning, understand, have a clear understanding of what they want to learn and then go explore what's available out there and find a certification that fits their needs. And if you're hesitating between one, two or three certification, try to find the one that will give you the most hands on experience. And it's not just about learning things by heart but that are able to give you hands on experience, that you're able to provide value to your future employer or demonstrate your skills. And if you want to reach me, I'm again the project leader of the OWASP project. We're everywhere on Twitter.

Was devslop on LinkedIn and, and our YouTube channel. So owasdevslop, if you search in the search bar on all these platform you will find us and we stream at least once a month and if you want to learn something with us I invite you to join us.

Thank you Nancy for your security testing awesomeness the links to everything of value we covered in this episode. Head on over to testguild.com S15 and while you're there make sure to click on the Try It Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.