8

I am the team lead of the IT security team where I currently work. We have recently completed our annual vulnerability penetration testing and now user stories to remediate vulnerabilities are been worked on by developers.

A lot of the issues discovered reside within the application code and are classical application vulnerabilities such as mentioned in OWASP documentation. Only by fixing the bug within code will the vulnerabilities be remediated. However, developers assigned to stories very frequently (double digits in a single day) IM me or a team member on my team requesting solution validation , questions on implementation etc such that it disrupts other work we have - incident response, vulnerability scanning, compliance reviews etc.

I don't want to slow down development of fixes, nor appear aloof and unwilling to help. To a certain I understand the developers actions as our team are the experts in security.

Perhaps a wiki or knowledge base solution is way to go so that questions can be compiled and answered asynchronously? Developers are of different experience levels with some needing more help than others.

How can I politely say the 1 off requests via IM is starting to be unworkable?

4
  • As a side comment, it's likely that with time the number of IMs will start to go down, as the stories start to get completed...
    – DarkCygnus
    Mar 31 '20 at 21:40
  • 1
    Could you give a sense of scale about volume here? Number of devs, members of the security team and bug volume could impact potential answers. Additionally, the typical reaction to this kind of experience is to push these ad hoc requests into more formal support channels which it sounds like you also have. Is there a reason you haven't tried that yet?
    – Lilienthal
    Mar 31 '20 at 22:11
  • Simple online todo list? Trello is good for that, and there are other solutions. People can still ask for help in the moment they know they need it, but the people responding can do so on their own schedule.
    – O. Jones
    Apr 1 '20 at 12:02
  • This sounds like a large project, that's done by many teams. Maybe it's possible to create a dedicated chat channel for this project, and get everyone doing fixes to join. Then when questions are answered, others can see the answers, and hopefully two things happen, they know the answer AND they know the principals that helped define the answer. Is such a chat channel possible? Apr 3 '20 at 7:14
3

A lot of the issues discovered reside within the application code and are classical application vulnerabilities such as mentioned in OWASP documentation. Only by fixing the bug within code will the vulnerabilities be remediated. However, developers assigned to stories very frequently (double digits in a single day) IM me or a team member on my team requesting solution validation , questions on implementation etc such that it disrupts other work we have - incident response, vulnerability scanning, compliance reviews etc.

I speak with more than a decade of experience in software development. If you are attempting to resolve every known vulnerability in a single release, trying to validate each fix makes sense, but it is extremely difficult to write software that doesn't have bugs in it. Which means is the development team will always be fixing vulnerabilities, so your company must do something else, otherwise your team will only be validating bug fixes.

Your company should identify how these vulnerabilities will be fixed. Your security team should be evaluating a potential release build, ahead of a potential release date, that allows the build to be released on time and with the appropriate number of security vulnerabilities fixed for that build. The developers should be allowed to identify what security vulnerabilities have or have not been fixed in that build.

I don't want to slow down development of fixes, nor appear aloof and unwilling to help. To a certain I understand the developers actions as our team are the experts in security.

Developers don't need to be experts in security to understand how to fix a vulnerability. If a vulnerability has been identified, and the improper and proper behavior both have been identified, then a developer should be able to validate a software fix results in the proper behavior. This allows your team to validate fixes, ahead of a potential release date, with enough time for the development team to identify which bugs will be left for the next release cycle.

Perhaps a wiki or knowledge base solution is way to go so that questions can be compiled and answered asynchronously? Developers are of different experience levels with some needing more help than others.

Sadly, there is no single answer to this question, this is something your company can decide.

How can I politely say the 1 off requests via IM is starting to be unworkable?

You have the ability to implement change yourself, you should determine what system will be used, to verify if a potential fix does or does not address a vulnerability. As the team lead, you should talk to the other team leads, and determine the best way to move forward. You should allow those team leads, to handle the other end of the rope, it sounds like you have enough to deal with.

3
  • Thanks for your experience! Prior to the stories being assigned to developers, criticality level of each vulnerability was ranked by our team in consultation with business owners of each application.
    – Anthony
    Apr 1 '20 at 17:20
  • We also have robust QA team doing both auto an manual testing. I am thinking of having them validate some of the non functional release requirements going forward such as security controls would be. Any thoughts?
    – Anthony
    Apr 1 '20 at 17:23
  • @Anthony - You should do whatever works for your team.
    – Donald
    Apr 1 '20 at 18:03
11

Why not a dedicated email or a single support chat?

Dedicate one of your people (it seems to be the equivalent of a full time position) to working with the developers to answer those questions and require that all questions come though there.

You could go even further and use a ticketing system, which would let previously answered questions be referred to if asked again.

And you can probably just tell the developers that a certain level of organization is required. Every dev I know complains about being interrupted, so I’m sure they would be understanding once they understand the volume of questions being asked.

8

Office hours. Designate regular times you can be reached for questions. Or do the reverse, designate regular times when your team turns off communication to the outside world.

For sign-offs and other asynchronous communications, use https://asana.com/ or use a wiki.

But note that no technology is perfect. Many will still use IM because of its convenience and because they think they will get a quicker answer that way.

1
  • +1. Combine that with the IM group suggested by other answerers, which you should actively engage in during "office hours", and stop responding to this type of questions sent directly (politely point initiators to the IM group).
    – mustaccio
    Mar 31 '20 at 22:42
5

First, I will not answer your question (hehe) and suggest that perhaps you could make a group chat on the IM software you use, where these questions can be posted to.

That way, either you or any other member can validate or answer any question asked there, and past things that have been answered can be referenced swiftly.

This will surely ease the burden on you solely answering all messages.

How can I politely say the 1 off requests via IM is starting to be unworkable?

I would write an email to the ones involved, and politely ask them to condense their questions or try to consult with other members first.

Also, if you go with the group chat suggestion, you can write the email and instead politely announce that such group chat is now the official channel to ask/answer questions regarding the user stories.

3

Sounds like your remote work system is what's wrong here. I would suggest having a channel or group that they can ask questions and assigning someone from you team on either a daily or weekly schedule to answer these questions. Given this is a yearly audit I would stick to daily and that persons only responsibility is to answer questions from the devs during that day. Will it reduce the overall amount of work your team can do I would hazard a guess that unless your team in 1-2 people then no you will still get plenty work done.

You can't raise a bunch of technical tickets and expect 0 questions from the individual who is assigned to do the work. So you have to be willing to help out and that means being interrupted.

In terms of the devs not knowing what the solutions are this is common especially in teams with less experienced devs. So pointing them to a wiki is really poor. It sounds like there are plenty of vulnerabilities for you to pick up on as well which to me should be brought up at one of your management meetings that the work isn't being done to best practice and checked for vulnerabilities. That really is the dev managers / senior management's responsibility to either hire the correct staff and or train up the current staff with whatever training you see fit. I say you see fit as you should be advised on what training the devs need if they are asking basic questions that can be answered by reading the OWASP list.

This isn't an uncommon situation dev teams around the world are oblivious to XSS, SQL injection ...etc. As the head of the "InfoSec" team it's your responsibility to teach the whole organisation how important information security is and if the devs don't have a clue they need to learn. This all relies on senior management backing as if they think you're making a mountain out of a molehill you might find yourself a sticky wicket.

2
  • Yes, many vulnerabilities were noted and my team validated that the security holes picked up by 3rd party are applicable to us with valid attack vectors. Yes, developer training in software security has not been historically the best and we are trying to left shift in dev cycle. Team size is 8.
    – Anthony
    Apr 1 '20 at 17:16
  • Well then you can spare some resource then to help the devs.
    – Dave3of5
    Apr 1 '20 at 21:31
1

This is an opportunity for both the security and development teams. Silos are all too common and you have a chance to bust some here. I imagine both teams would be very interested in cross-training and collaboration. But before you get that far ...

I think it's really important to remember the two very different cultures you have in this situation.

In your example the security team performed an analysis and handed off the results but with no intention of writing the code. You're done.

Software development teams tends to be more chaotic, collaborative and available. Even as work gets completed, they never really are "done". There is always more work to be done on the project and because of this developers are available but also expect others to be available. Something like "You asked me to do something, well I need to ask you questions about it so we get it right". Also keep in mind, developers typically only deal with business people or users who tend to be highly available and willing to talk. Even in this situation though, especially in the Agile world, this is organized.

In an ideal situation you wouldn't need all of the developers to talk to everyone all of the time. There would be a project manager organizing meetings with only the necessary people, team leads and product owners. That way issues and questions can bubble up to the right people within teams and the meetings will be more efficient.

The key here is that you need someone to take ownership. Team leads and project managers.

For any other random one off questions create a group chat channel for both teams to share, separate from their own channels, with the understanding that bigger questions go to the leads and the quickies can go to this informal channel.

Basically I'm recommending following a little Agile, which the dev team should jump at. Also you should be able to talk to their lead and work something out. Everyone dislikes context switching or being interrupted and both teams understand that.

Coming back to the more permanent collaboration. Regular Meetup style show and tells or hackathons would probably go a long way to some serious team bonding. Lending a security person for a sprint to the dev team would also probably be a huge win. And vice versa, having a dev join the security team for a sprint or two to help with scripting. I can't really stress enough how valuable cross-training is. It will make both teams better.

1

As a developer, I can assure you that you are experiencing something the dev team would find similarly annoying, so you can preface any requests you make with that fact. Essentially what you need to do is slow down the flow of incoming requests. We have a designated manager to compile the questions and forward them on periodically, ideally you choose an interval say twice a day for example, that reduces the impact on your team, whilst not unduly affecting the impact on the other team

1

Your team's job is not to find security problems. Your team's job is to do what they can to reduce the number of existing security problems. That's not quite the same thing - it means you don't have to just find security problems, you also have to provide developers with the means to fix these security problems, and with information they need to prioritize what gets fixed first, what gets fixed later, what may not get fixed at all.

That's why you get so many requests for additional information: Because your team didn't do a good job in the first place. At the very least, I'd expect for every problem found: How does a developer verify that the problem is there, how do they verify that the problem has been fixed, what are the implications of the problem (what can happen if it doesn't get fixed), and whatever other information you have about that problem.

Instead of asking "how do I handle lots of requests for information from developers", you should be asking "what do I need to provide to developers so that there are no questions in the first place".

PS. "We have already verified through tools that all vulnerabilities are applicable with valid attack vectors" doesn't help the developers one bit. Do they have the tools available? Do you have descriptions what to do to provoke the vulnerability, how to verify that it is gone? As I said, your problem is that you don't provide the information that the developers need.

"Security holes severity ranked" - that doesn't tell me what the business impact is, which is what decides in which order fixes need to be applied. You are speaking in a language that is foreign to both business and developers. You also seem dead set at not learning.

1
  • We have already verified through tools that all vulnerabilities are applicable with valid attack vectors. Impact analysis was already done and the security holes severity ranked
    – Anthony
    Apr 4 '20 at 15:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .