DevOps Security and Continuous Failure: Lessons From Heartbleed, Shellshock, and Countless Other Security Flaws

We pursue increasingly rapid delivery cycles while achieving previously unimaginable degrees of scalability, reliability, and raw performance. But there is obviously a growing and serious mismatch between our development and operations performance in securing our applications compared to our performance in other areas. I work at a company extensively involved in Drupal and other open source projects that concentrate on both DevOps and security, but continue to be plagued by serious security vulnerabilities. Organizations and individuals negatively affected by Heartbleed and other security flaws probably would have readily traded some delay in accessing new features or temporary access problems for better security. So, how can we better focus DevOps culture and practices on the concept of Continuous Security to deliver this? Perhaps we need to look at ongoing advances in automated security testing, more rigorous and frequent manual code review, and paired/team programming practices, and work better on more fully integrating these all into DevOps.

Transcript

1. DevOps Security and Continuous Failure: Lessons From Heartbleed, Shellshock, and Countless Other Security Flaws
2. Mike Nescot • Web Ops Mgr. JBS International • Web dev, ops person since ~ ’94 • Web sec: FISMA, FedRAMP/GovCloud
3. DevOps Security Potential • Software defined sec • Isolation • Collab, control • Situational awareness, rapid response
4. DevOps/Open Source Security Challenges • Big name bugs • FUD, hype, lies • Open source security? • Regulatory burden
5. Security Island • Security community • Fear and liability • Unique goals • Black box, reactive tools
6. Spiritual Rebirth • Integrate security in devops • Shared mindset • Goals and metrics, tools and tests in pipeline
7. Static Analysis (SAST) • Syntax checking • Structure/complexity • Bugs, duplication • Standards • Security configuration
8. Example: PHP/Drupal • PHP Code sniffer • Coder/Secure Coding Modules • PHPUnit/SimpleTest, Jenkins (STDD/SDD)
9. Problems/Limitations • Failed in Heartbleed • Old/complex languages • Bad/complex code • Dynamic languages
10. Dynamic App Analysis (DAST) • Pen tests/vuln scans • Web app scanner: ZAP • False positives
11. DevOps Pipeline vs. Lifecycle •  Continuous feedback •  Event aggregation, normalization, correlation • Trickle testing, deployment
12. Code Review/Collaboration • Code review app • Review board • CI: Jenkins • Paired programming
13. Architectural Risk Analysis • Design flaws vs. bugs • Scope of impact, risk potential • Safeguards
14. Code Security: Human Factors • Technology, programmer, community • Secure coding guidelines • Dedicated security team • Gateways
15. Vendor Management • Check third-party code • Creds, dependencies • Limitations/unknowns
16. Security Frameworks/Process • CMMI: Security Extension • OWASP ESAPI • FISMA • NIST Cybersecurity • ITIL • ISO 2700 • COBIT
17. Risk Management •  Leanest stack, minimal privileges •  Simplicity: Occam •  Open standards •  API Security
18. Community Support • Developers and ops in security • Contribute time and $ Show value and cost
19. Technology to the Rescue: People are People • Developers are developers • Better languages • Safeguards (e.g., MFA)
20. Security Metrics & Marketing • App security • Config management • Financial • Incident management • Patch management • Vulnerability management • Balanced Sec Scorecard