Security Champion

1: The Security Champion Role
2: Help build a better security community

Security Champion is an established role in many development organisations: someone on the team who keeps an extra eye on security, and who connects the formal security functions with the people actually building the solutions. The role does not require you to be a security expert — it requires someone who cares enough to ask the questions.

Security is handled by the team as a whole, not delegated to one person. A Security Champion does not take on that responsibility, but makes sure it is not forgotten in a busy delivery. How the role is organised varies a great deal between companies — the articles below describe how we do it at Bouvet.

1 - The Security Champion Role

Security Champion is an established term, but what the role contains varies from company to company. Here is Bouvet’s variant, and four steps you can take in your own team.

Why “Security Champion”

The term “Security Champion” has become an established concept to encompass people who do not necessarily work directly with security, but who can act as a bridge between the formal security roles and the development teams. At Bouvet we have chosen an approach inspired by NAV and Equinor, and we try to keep the whole thing as informal as possible.

What the role looks like at Bouvet

This will vary between regions, units and teams, but a typical Security Champion will raise issues and questions related to security, and help the team focus on and prioritise between security matters and everything else. The Slack channel #security-champions is used to announce events, share useful information and anything else that concerns Security Champions at Bouvet. Every month we also run what we call AppSec Caffeine, where we gather Security Champions at Bouvet for a summary of relevant news, a talk and a quiz with a symbolic prize. Registration goes through Bouvet’s own event system (requires a Bouvet login).

Bouvet is becoming a large company with a wide range of projects, and security is a vast field where everyone has something new to learn every day. We love sharing knowledge, so it is great if YOU want to get involved and share what you know with others - no matter how low or high the threshold for understanding it might be.

How do I become a Security Champion?

If you want to, you may. We have no sign-up to become one; join the Slack channel, get involved, take part in the gatherings, speak at Bouvet One and talk about security. It does not matter if you do not have years of experience - what matters is that you get involved, learn and share. Talk to your nearest manager if you want to take on the role within your team, or if you want to contribute across teams or customers.

Building competence matters for a Security Champion too. Several of us at Bouvet have attended the NDC Security conference in recent years, where we try to gather to get to know each other better, do something social and support each other when we have “our own” on stage. Talk to your nearest manager and join if you have the opportunity - you will quickly get to know other engaged Security Champions.

How do I practise the role?

1. Create awareness in the delivery team

A good place to start is to ask yourself a few questions:

What does this project I am working on actually do?
What is critical for the system to work, and how can the system be misused or manipulated?
Is there an up-to-date threat model with measures to prevent weaknesses from being exploited?

Start by establishing a mental model of the project, then build on it from there.

A good start is often to run a threat modelling exercise. You do not need to know much about threat modelling, but you can get some support in the article on threat modelling and from the Threatmodeling manifesto.
Talk to other Security Champions at Bouvet. Ask them what they have done that works, and what does not.
Remember that you can always ask the Security Champions network for support, tips and guidance.

Be a bit creative and try to get the team involved; a Security Champion who does not bring the team along often does not get as much done as they would like.

2. Do we have control over our entire project?

If the answer is yes, let us correct that to no. There is always more that can be done. We have made a checklist that should be reviewed for every single project we are involved in; all our delivery teams should have a relationship with the points in it and the risk they pose if useful measures are not introduced. You can find the list here.

This portal also describes a lifecycle intended to safeguard security in development projects. Much of the content is relevant for other types of projects as well, and remember that you do not have to take it all at once. Bring the team along and work through it part by part until you have even better control over the project.

3. Protecting the customer and Bouvet

The purpose of all security work is to avoid unwanted incidents. When working on a project, it is important to ask yourself a few checking questions:

Are we allowed to do what we are doing?
Is it wise to do it, or can someone exploit what we build or the way we work?
What is the consequence for the customer and the users if this fails or ends up in the wrong hands?
Are we collecting or storing more data than we actually need?
Would we notice if someone exploited a weakness today?

4. Technical review of solutions

Depending on your level of ambition, you should use a checklist as a support tool when reviewing the solution. We have made a checklist that covers an absolute minimum, but if you really have ambitions there are other tools such as OWASP’s Application Security Verification Standard - ASVS. It covers security reviews at different levels of detail, depending on how deep you want to go.

More information

2 - Help build a better security community

If you are interested in raising the security culture beyond the team, get involved!

At Bouvet, we hold regular gatherings - Bouvet One - where we host talks on everything under the sun, often with dedicated security tracks. We have also held specific Bouvet One events dedicated to security. Here, everyone is free to contribute - all talks are appreciated, no matter how simple you might think your topic is.

Get Involved with Regional Security Champions

Several regions in Bouvet have their own Security Champions gatherings on a regular basis, where knowledge, tips, tricks, and much more are shared. Get involved here and help build a security culture in the developer teams! We also hold regular monthly gatherings under the name AppSec Caffeine for all Security Champions at Bouvet, where we go through relevant news, talks and short quizzes.

All developers should be familiar with the basic principles of security and secure development, but to achieve this, we need to go out among people and share knowledge. OWASP Top 10 is always relevant, so if you feel like it - set up a session with colleagues in the surrounding units. You can make it super fancy and run demos of every single point, but you can just as easily make it low-threshold and simply talk through the points.

The most important thing is that you engage and help spread knowledge!

Get Involved Nationally

There is a national Security Champions community where you can get involved to meet like-minded individuals. Several conferences and user groups in Norway related to security offer opportunities to contribute, such as: