Podevcast

CyberSecurity Awareness Month with Troy Vinson - Episode 161

Azure DevOps Podcast

Episode | Podcast

Date: Mon, 04 Oct 2021 08:00:00 +0000

This week, Jeffrey is joined by Troy Vinson; a Principal Software Architect at Clear Measure as a CISSP (Certified Information System Security Professional.) He is an experienced leader, architect, and problem-solver in Information Systems Security and Software Development technologies and has spent the majority of his career integrating computer science, information science, and cognitive science to assist in software development and the management of information. With October being CyberSecurity Awareness Month, Troy gives a rundown on everything that developers and development teams need to know regarding security, how to become more cyber security aware, the top ten web application security risks you need to look out for, how to keep your environment secure regardless or where you’re working from, and what you can putting in place today to improve your cyber security. Topics of Discussion: [:39] About The Azure DevOps Podcast, Clear Measure; the new video podcast Architect Tips; and Jeffrey’s offer to speak at virtual user groups. [1:11] About today’s episode with Troy Vinson! [1:23] Jeffrey welcomes Troy to the podcast. [1:30] What is CISSP? [2:53] Troy shares his career highlights and the path that led him to his current role in cyber security. [4:39] Why is October Cybersecurity Awareness Month? [6:18] What developers should be aware of when setting up a connected environment for themselves at home. [8:47] Troy’s favorite VPN services. [10:08] Best practice: Always work from a VPN, especially as a developer working from a public place. [10:25] What developers should keep in mind about source code when it comes to cyber security. [12:32] How to keep documents (that don’t quite fit in a source control repository) secure. [14:31] Troy highlights important security architecture models of practice. [15:56] How is the STRIDE model applicable? [17:59] A word from The Azure DevOps Podcast’s sponsor: Clear Measure. [18:30] What is repudiation in the STRIDE model referring to? What is it in code changes? When is it necessary? [20:22] Are there test suites that developers can use to augment their functional tests that check for security measures? [23:16] Should development teams hire third parties to do audits versus doing it in-house? [24:36] What OWASP Top Ten is and why all of your engineers should be trained on it. [26:15] Is there a comprehensive list of web application security risks? [27:28] Troy highlights the importance of #6 on the OWASP Top Ten list: vulnerable and outdated components. [29:15] Rules of thumb regarding security for development teams when it comes to deployment and configuring environments [30:56] Free online courses for cyber security awareness that you can share with family members and friends. [33:52] Jeffrey thanks Troy Vinson for joining the podcast! Mentioned in this Episode: <a href="http://architecttips.clearmeasure.com/"> Architect Tips</a> — New video podcast! <a href="https://azure.microsoft.com/en-ca/services/devops/?&OCID=AID736756_SEM_7eul5uID"> Azure DevOps</a> <a href="https://www.clear-measure.com/">Clear Measure</a> (Sponsor) <a href="https://www.amazon.com/NET-DevOps-Azure-Developers-Architecture/dp/1484253426"> .NET DevOps for Azure: A Developer’s Guide to DevOps Architecture the Right Way, by Jeffrey Palermo</a> — Available on Amazon! <a href="http://www.lulu.com/shop/jeffrey-palermo/net-devops-for-azure-ebook-edition/ebook/product-24094762.html"> bit.ly/dotnetdevopsebook</a> — Click here to download the .NET DevOps for Azure ebook! <a href="https://www.youtube.com/channel/UC-ROXy08zc-qTA0-3GAQDLw"> Jeffrey Palermo’s YouTube</a> <a href="https://twitter.com/jeffreypalermo?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor"> Jeffrey Palermo’s Twitter</a> — Follow to stay informed about future events! <a href="https://devintersection.com/#!/?track=dev">DEVintersection Conference</a> — Dec. 7th‒9th in Las Vegas, Nevada <a href="https://www.cisa.gov/cybersecurity-awareness-month">Cybersecurity Awareness Month | CISA</a> <a href="https://staysafeonline.org/cybersecurity-awareness-month/"> Cybersecurity Awareness Month | National Cybersecurity Alliance (NCSA)</a> <a href="https://nordvpn.com/country/canada/?vpn=brand&gclid=Cj0KCQjwwNWKBhDAARIsAJ8HkhcFJxtbDGhRzh8JM52y2LeXZ4BkJkvtRN2ymQukGMGy2oCmPSktOnoaAuSYEALw_wcB"> NordVPN</a> <a href="https://www.expressvpn.com/?gclid=Cj0KCQjwwNWKBhDAARIsAJ8HkhfVxsnXGxF-sNq4vZV1JvKqLlaHG8kYGd3glFy2zqhEKj1_8m8-qOQaAilcEALw_wcB"> ExpressVPN</a> <a href="https://securityintelligence.com/articles/what-is-stride-threat-modeling-anticipate-cyberattacks/"> STRIDE Model</a> <a href="https://github.com/">GitHub</a> <a href="https://www.devsecops.org/blog/2015/2/15/what-is-devsecops"> DevSecOps</a> <a href="https://www.microsoft.com/en-ca/microsoft-365/sharepoint/collaboration?ms.officeurl=sharepoint&rtc=1"> SharePoint</a> <a href="https://office.live.com/start/OneDrive.aspx?ui=en%2DUS&rs=US"> One Drive</a> <a href="https://azure.microsoft.com/en-us/services/frontdoor/"> Azure Front Door</a> <a href="https://docs.microsoft.com/en-us/azure/application-gateway/overview#:~:text=Azure%20Application%20Gateway%20is%20a,traffic%20to%20your%20web%20applications.&text=This%20type%20of%20routing%20is,URL%2Dbased%20routing%20and%20more."> Azure Application Gateway</a> <a href="https://docs.microsoft.com/en-us/visualstudio/code-quality/net-analyzers-faq?view=vs-2019"> FxCop</a> <a href="https://en.wikipedia.org/wiki/Roslyn_(compiler)">Roslyn</a> <a href="https://www.sonarqube.org/?gads_campaign=North-America-DSA-SonarQube&gads_ad_group=DSA&gads_keyword=&gclid=Cj0KCQjwwNWKBhDAARIsAJ8HkhfDpleVAa31F8nzk8rysFc03hGPvhYyegualKFpqqrJfXPHNNPppdQaApvNEALw_wcB"> Sonarqube</a> <a href="https://owasp.org/www-project-top-ten/">OWASP Top Ten</a> <a href="https://www.sans.org/top25-software-errors/">Top 25 Most Dangerous Software Errors CWE/SANS</a> <a href="https://cwe.mitre.org/top25/archive/2021/2021_cwe_top25.html"> 2021 CWE Top 25 Most Dangerous Software Weaknesses</a> Want to Learn More? Visit <a href="http://azuredevopspodcast.clear-measure.com/">AzureDevOps.Show</a> for show notes and additional episodes.