BSidesLV 2015

Scrum agile development is one of the many methodologies in which software can be developed. The resulting metrics produced from a scrum agile team can help to provide accurate timelines associated with project completion. In many organizations security teams are separated from scrum agile development teams which until a security issue occurs, and then both teams come together. This separation can cause multiple issues that negatively impact both parties rippling across the organization thus affecting the business. If security issues arise and are not fixed in a proper manner, this can leave an organization vulnerable. Furthermore, taking development time to fix issues violates the rules of scrum agile and will further impact the project timeline. The problem exists because each team has its own priorities and agenda. The security team should be more closely integrated and have representation that actively participates as a functional member of an agile team, and not as the enemy. The result of their full integration could help to change a developer’s mentality towards security, begin to address security needs as they are happen with a legacy or active application, and help satisfy both teams’ timelines and agendas.