Evil User Stories - Improve Your Application Security - Anne Oikarinen

  • Locked
Anne Oikarinen's profile
Anne Oikarinen

Senior Security Consultant

Evil User Stories - Improve Your Application Security - Anne Oikarinen image
A free account is required to view this content
Talk Description

Are you tired of fixing security bugs afterwards in a hurry? Have you gone through depressing penetration testing reports too many times? Evil user stories are a way of addressing security threats in the planning and implementation phase.

The idea of evil user stories is simple: First, identify important data and assets in the application you are protecting. Then, identify threat scenarios by completing the sentence "An attacker should not be able to...". 

You can use evil user stories in development by putting them in the backlog and adding mitigations as acceptance criteria. This helps in implementing security together with functionality. In addition, they are a good starting point for test planning and getting testers involved in design. 

You will learn to create evil user stories from different attacker perspectives and will be able to make security efforts visible in the backlog which is a step closer to building security in. 

Takeaways

Key learnings:

  • How to create evil user stories to find potential threats on the system you are protecting
  • Evil user stories make security work visible on the backlog and security features get implemented alongside functionality
  • Evil user stories can be used as test planning aid
  • Different methods of finding attacker perspectives 
What you’ll learn

By the end of this talk, you'll be able to:

  • You will learn to create evil user stories from different attacker perspectives and will be able to make security efforts visible in the backlog which is a step closer to building security in. 
Anne Oikarinen's profile'

Anne Oikarinen

Senior Security Consultant

Anne Oikarinen is a Senior Security Consultant who works with security and software development teams to help them design and develop secure software. Anne believes that cyber security is an essential part of software quality.

After working several years in a security software development team in various duties such as testing, test management, training, network design and product owner tasks, Anne focused her career fully on cyber security. In her current job at Nixu Corporation, Anne divides her time between hacking and threat analysis - although as network geek, she will also ensure that your network architecture is secure. Anne also has experience on incident response and security awareness after working in the National Cyber Security Centre of Finland.

Anne holds a Master of Science (Technology) degree in Communication Networks and Protocols from Tampere University of Technology, Finland.

Suggested Content
United by Security : The Test that Divides Us - Jahmel Harris & Claire Reckless
How To Be A Redshirt And Survive! - Dan Billing
Let’s Go Threat Modelling
Test Leadership In Requirements & Specification Stages
My Product: My Friend , My Teacher, My Guide - Anastasia Chicu
What Are Acceptance Criteria
Selenium 4 introduces relative locators. This new feature allows the user to locate an object in relation to another object on the screen! Don't wait, get an instant demo today.
Explore MoT
Episode One: The Companion
A free monthly virtual software testing community gathering
Web Application Security Testing 101 - Dan Billing
Get started with security testing web application

Tags

  • requirements
  • security