Agile Practices for Security Teams

When:Tue AM-1
Organizers(one of participants)
ParticipantsBen Schofield Ben Schofield , Daniel Kefer Daniel Kefer , Deepak Subramanian Deepak Subramanian , Florian Buetow Florian Buetow , Francisco Novo Francisco Novo , Gabor Pek Gabor Pek , Jay Mbolda Yamdjeu Jay Mbolda Yamdjeu , Jean-Jacques MOIROUX Jean-Jacques MOIROUX , Jim Newman Jim Newman , John Ellingsworth John Ellingsworth , Paulino Calderon Paulino Calderon , Phil Winstanley Phil Winstanley , Rafael Jimenez Rafael Jimenez , Sebastien Deleersnyder Sebastien Deleersnyder , Simon Pavillon Simon Pavillon , Sven Schleier Sven Schleier , Tony Richards Tony Richards , Wouter de Meijer Wouter de Meijer , Zuhal Vargun Zuhal Vargun
Remote ParticipantsKonstantinos Damianakis Konstantinos Damianakis , Lars Lars , Manuel Almeida Manuel Almeida , Michael Hidalgo Michael Hidalgo , Vinod Anandan Vinod Anandan

Until recently, cyber security was often considered as “nice to have” in the software development lifecycle. However, due to several data breaches that hit the headlines, more and more dev teams are now starting to incorporate security practices in their processes. Considering how agile methodologies benefit the development lifecycle, security should be approached in the same, or a similar, way.


Agile practices have been around for quite some time now and a lot of organisations incorporate Agile practices into their daily operations. This working session will discuss how security teams can utilise these Agile practices to improve their position and make their operational side more productive. Early delivery, a synonym of Agile, is one of the biggest challenges for info-sec, but using some Agile practices could enable security teams to integrate more effectively within their organisations.


  • Agile and its practices
  • Security adoption of Agile
  • Architecting security for early delivery
  • Situational awareness in Agile environments
  • Optimising Agile SDLC security


A Draft List of Agile Security Practices

Synopsis and Takeaways

The following categories highlight some of the key activities of an agile security team:


  • Define and deliver security training programmes


  • Security team to be visible, present at standups, available
  • Connect dev to production
  • Empower security champions

Standardisation and Compliance

  • Own strong guidelines, e.g. data classification, regulatory, compliance
  • Two tier security standards? mandatory, depend on risk/sensitivity etc
  • Library of standard stories


  • Technical support
  • Help create security user stories, personas, anti-personas, patterns
  • Culture of “security is not to say no, but to help”
  • Testing
  • Automation is needed for CI/CD e.g. tool to track 3rd party licenses
  • “Development enablement tribe”


  • Project initiation touch point to define “gates”
  • Prioritisation of involvement based on risk assessment, lifecycle stage
  • Define “done”
  • 3rd party maturity assessment
  • Internal compliance checks
  • Centralised tracking in primary colours
  • Security team KPIs
  • Security organisation has to be separate from development
  • Monetary value on risks helps prioritisation
  • Risk acceptance/escalation process


  • Bring in shared security solutions such as WAF- engineering effort


  • Perhaps agile not applicable, more lean/kanban
  • View security as functions, not people - resourcing can change but functions don’t
  • Don’t be a blocker to agile, e.g. in operational approvals
  • “Security team as a service”
  • Struggle to manage BAU and hence forecasting: separate functions
  • Need visibility of project portfolio
  • Separation of duty can be a constraint


The target audience for this Working Session is:

  • Developers
  • Security professionals
  • DevSecOps
  • Security champions

Working materials

Here are the current ‘work in progress’ materials for this session (please add as much information as possible before the sessions):

OWASP Proactive Controls

Previous Summit Working Session

Register as participant

To register as participant add Agile Practices for Security Teams to either:

  1. the sessions metadata field from your participant's page (find your participant page and look for the edit link).
  2. or the participants metadata field from this git session page

Back to list of all Working Sessions