Gtr masthead v5

DTA's ethical hackers at work


By Dylan Bushell-Embling
Monday, 20 March, 2017


29402709463 4d693aee71 z

The Digital Transformation Agency (DTA) is taking a customised approach to security testing, operating a team of ethical hackers working within an agile environment.

In a blog post, DTA ethical hacker Stephen Bradshaw has detailed how the agency modified the standard practices used in security testing to better fit within an agile rather than waterfall environment.

Many traditional approaches to security testing are better suited to the latter environment, involving larger, more infrequent releases. This typically involves conducting testing with every new release, Bradshaw said.

To adapt to the DTA’s agile environment of smaller frequent releases, the ethical hacking team considers a variety of factors before initiating a test, including a particular project milestone being hit, time passing between tests, significant changes being made to the project code or at the request of a project team member.

While normally security testers are only available after development is complete, at the DTA developers and security testers also work together to try to catch security issues early in the development process.

This collaboration also makes the reporting of vulnerabilities more efficient, while granting testers easy access to source code repositories provides opportunities for automated checks.

“Ethical Hackers in the DTA are generally not formally assigned to the projects they work on. This is in contrast to the way most other technical staff in the DTA work. They instead sit within their own ‘secops’ team and work with projects on an as-needed basis,” Bradshaw added.

“This requires balancing the schedules of the team, and of each project they support. The culture at the DTA facilitates this approach.”

Image courtesy of Blogtrepreneur under CC

Follow us on Twitter and Facebook

Related News

Qld payroll project on track for end-2018 completion

The Queensland government has rejected reports claiming that a project to overhaul the payroll...

DTA working on secure cloud strategy

The Digital Transformation Agency wants to encourage adoption of secure and reliable cloud...

Qld police receive QLite capability

A new QLite capability has been rolled out for Queensland police officers, meaning they will not...


  • All content Copyright © 2017 Westwick-Farrow Pty Ltd