Evil User Stories - Improve Your Application Security - Anne Oikarinen

  • Locked
Anne Oikarinen's profile
Anne Oikarinen

Senior Security Consultant

Evil User Stories - Improve Your Application Security - Anne Oikarinen image
A free account is required to view this content
Talk Description

Are you tired of fixing security bugs afterwards in a hurry? Have you gone through depressing penetration testing reports too many times? Evil user stories are a way of addressing security threats in the planning and implementation phase.

The idea of evil user stories is simple: First, identify important data and assets in the application you are protecting. Then, identify threat scenarios by completing the sentence "An attacker should not be able to...". 

You can use evil user stories in development by putting them in the backlog and adding mitigations as acceptance criteria. This helps in implementing security together with functionality. In addition, they are a good starting point for test planning and getting testers involved in design. 

You will learn to create evil user stories from different attacker perspectives and will be able to make security efforts visible in the backlog which is a step closer to building security in. 

Takeaways

Key learnings:

  • How to create evil user stories to find potential threats on the system you are protecting
  • Evil user stories make security work visible on the backlog and security features get implemented alongside functionality
  • Evil user stories can be used as test planning aid
  • Different methods of finding attacker perspectives 
What you’ll learn

By the end of this talk, you'll be able to:

  • You will learn to create evil user stories from different attacker perspectives and will be able to make security efforts visible in the backlog which is a step closer to building security in. 
Anne Oikarinen's profile'

Anne Oikarinen

Senior Security Consultant

Anne Oikarinen is a Senior Security Consultant who works with security and software development teams to help them design and develop secure software. Anne believes that cyber security is an essential part of software quality.

After working several years in a security software development team in various duties such as testing, test management, training, network design and product owner tasks, Anne focused her career fully on cyber security. In her current job at Nixu Corporation, Anne divides her time between hacking and threat analysis - although as network geek, she will also ensure that your network architecture is secure. Anne also has experience on incident response and security awareness after working in the National Cyber Security Centre of Finland.

Anne holds a Master of Science (Technology) degree in Communication Networks and Protocols from Tampere University of Technology, Finland.

Suggested Content
FinTech Testing 101
30 Days of Security Testing
Unmasking Security: Seeing Through the Eyes of an Attacker - Saskia Coplans
Employ Feature Mapping to Capture Requirements of a New Feature
Test Leadership In Requirements & Specification Stages
Reviewing Requirements Documents
Explore MoT
TestBash Brighton 2024
Thu, 12 Sep 2024, 9:00 AM
We’re shaking things up and bringing TestBash back to Brighton on September 12th and 13th, 2024.
Web Application Security Testing 101 - Dan Billing
Get started with security testing web application

Tags

  • requirements
  • security