Evil User Stories - Improve Your Application Security - Anne Oikarinen
Are you tired of fixing security bugs afterwards in a hurry? Have you gone through depressing penetration testing reports too many times? Evil user stories are a way of addressing security threats in the planning and implementation phase.
The idea of evil user stories is simple: First, identify important data and assets in the application you are protecting. Then, identify threat scenarios by completing the sentence "An attacker should not be able to...".
You can use evil user stories in development by putting them in the backlog and adding mitigations as acceptance criteria. This helps in implementing security together with functionality. In addition, they are a good starting point for test planning and getting testers involved in design.
You will learn to create evil user stories from different attacker perspectives and will be able to make security efforts visible in the backlog which is a step closer to building security in.
- How to create evil user stories to find potential threats on the system you are protecting
- Evil user stories make security work visible on the backlog and security features get implemented alongside functionality
- Evil user stories can be used as test planning aid
- Different methods of finding attacker perspectives
Revisited: The Tester’s Survival Guide to Joining a Continuous Delivery Project - Amy Phillips01:00:32
Live Coaching - Exploring the Black Box Puzzles00:36:37
Inspiration ...and Burnout - Maryam Umar00:44:52
TestBash Panel: Leadership00:45:42
The Only Good Quality Metric is Morale - Jenny Bramble00:45:27
Revisited: What's In a Name? Experimenting With Testing Job Titles - Martin Hynie01:04:03
TestBash Home Part 6 - 99 Second Talks00:26:22