Gtr masthead v5

DTA's ethical hackers at work


By Dylan Bushell-Embling
Monday, 20 March, 2017


29402709463 4d693aee71 z

The Digital Transformation Agency (DTA) is taking a customised approach to security testing, operating a team of ethical hackers working within an agile environment.

In a blog post, DTA ethical hacker Stephen Bradshaw has detailed how the agency modified the standard practices used in security testing to better fit within an agile rather than waterfall environment.

Many traditional approaches to security testing are better suited to the latter environment, involving larger, more infrequent releases. This typically involves conducting testing with every new release, Bradshaw said.

To adapt to the DTA’s agile environment of smaller frequent releases, the ethical hacking team considers a variety of factors before initiating a test, including a particular project milestone being hit, time passing between tests, significant changes being made to the project code or at the request of a project team member.

While normally security testers are only available after development is complete, at the DTA developers and security testers also work together to try to catch security issues early in the development process.

This collaboration also makes the reporting of vulnerabilities more efficient, while granting testers easy access to source code repositories provides opportunities for automated checks.

“Ethical Hackers in the DTA are generally not formally assigned to the projects they work on. This is in contrast to the way most other technical staff in the DTA work. They instead sit within their own ‘secops’ team and work with projects on an as-needed basis,” Bradshaw added.

“This requires balancing the schedules of the team, and of each project they support. The culture at the DTA facilitates this approach.”

Image courtesy of Blogtrepreneur under CC

Follow us on Twitter and Facebook

Related News

NSW launches digital transformation strategy

The new Designing our Digital Future strategy aims to transform the way technology is used within...

Melbourne poised to become first cyber-ready city

The Cyber Victoria program has been launched, as part of an effort to help the state become the...

OAIC to develop APS-wide privacy code

The Office of the Australian Information Commissioner will develop a privacy code that covers the...


  • All content Copyright © 2017 Westwick-Farrow Pty Ltd