This is the fourth part of my 'Being an Agile Security Officer series'. In this blog post I will go deeper into the details of how user stories are created and what role security stakeholders should play in that.
The EpicWithin Agile, work is usually defined in user stories. These are minimal and defined amounts of work that can typically be finished in 1 sprint. However, user stories don't magically appear from thin air. It all begins with so called epics. An epic is generally a high level wish that mostly describes the desired outcome. An example would be:
'I want my customers to be able to order products online and have them delivered'.This epic already gives an idea about what you want to achieve, but leaves a lot of options open on the features and solution. A common technique used to get from an epic to user stories is story mapping. Story mapping is all about identifying the wishes and requirements linked to the epic. Story mapping is most effective when done in small groups (3-5 people is often used as a guideline) and as a security officer it is important to be part of this phase as it is the first spot to identify possible risks and specify requirements. The only way to 'earn' that place is by being a 'promoter stakeholder' (see my previous blog). During the mapping phase the group identifies the major functionalities of the epic and define the specific user stories.
Mapping the StoryTo use the previous example more detailed specifications have to be created on webshop functionality (e.g. how do you want users to be able to search), the payment options, what information you need to complete the ordering, and how you want to handle the delivery. The end result should be a complete map of everything that could be done with unlimited time and resources. A first mapping would therefor look something like this:
Agile Risk ManagementFrom a security perspective this might introduce a lot of uncertainties and risks, but if the user stories have been applied with the right security requirements this should not be a problem. Some examples;
- One of the requirements could be that all communication should be protected by TLS. The security stakeholder should have added that requirement to the whole group of webshop user stories. Regardless of what stories are actually selected for the webshop in the walking skeleton, TLS should be part of it.
- Another requirement could be that if credit cards are accepted as payment method, the system should be compliant with the PCI-DSS standard. As long as this user story is not part of a sprint, the security requirement is not relevant. By specifying this already early in the process a product owner can even decide that accepting credit card payments is not worth the effort and opt for another payment method or use a third party solution.
- There could also be a requirement that certain data is not allowed to be collected in the online analytics. As long as the team doesn't implement and enable the tracking, this requirement is also not relevant for earlier sprints.