DevOps - The Automation op compliance

Many organizations are adopting DevOps patterns and practices, and are enjoying the benefits that come from that adoption: More speed. Higher quality. Better value. However, many teams often get stymied when dealing with information security, compliance, and audit requirements. There seems to be a misconception that DevOps practices won’t work in large organizations which are under regulations or have their own strict processes. DevOps actually helps teams meet compliance standards because automation is not only an integral part of DevOps, but a great way to make sure development and deploy practices are reliable, repeatable, and traceable. This talk will show how it's possible to be both fast and compliant. We will look at both the soft and technical practices. I will cover branch policies, checks you can do during your build and deployment, Azure Security Center, Testing in production and more.

Transcript

3. Software Engineer & ALM Consultant 4DotNet @erwin_staal Erwin Staal
4. DevOps is the union of people, process, and products to enable continuous delivery of value to our end users. Donovan Brown, Microsoft DevOps
5. Compliance Specification Standard Law Policy
6. KPN Security Policy
7. KPN Security Policy
8. Availability Integrity CIA Triad Confidentiality Information Security
9. “Fundamentally, if somebody wants to get in, they're getting in..accept that. Number one, you're in the fight, whether you thought you were or not. Number two, you almost certainly are penetrated." Michael Hayden, Former Director of NSA and CIA
10. The mindset shift Prevent Breach Assume Breach Threat model Code review Security testing Secure development lifecycle War game exercises Centralized security monitors Live site penetration testing
11. Speed is the new security
12. State of DevOps Report 2018
14. CAB Low / Low 4-eyes principle Register change Continuous Testing Every change is classified as a change with low impact and low risk. We need 0-downtime deployments. Every change has been reviewed by at least one colleague. This is traceable. Every change we make is tested using a comprehensive set of automated tests. Configuration Management Automate repetitive manual processes. In order to achieve this, we need to version control everything required to perform these processes. Deployment automation Every change is deployed automatically into environments that resemble production as much as possible. Every change is registered in a central system for everyone to see.
15. Implementing the controls Dev Ops
16. Leverage the cloud Dev Ops PaaS IaaS