DevSecOps: Delivering secure software at speed and scale of DevOps

Transcript

1. DevSecOps
   Delivering secure
   software at speed and
   scale of DevOps.
   

   View Slide

2. Evandro Mohr
   2
   Developer
   Pilot
   Professor
   Photographer
   

   View Slide

3. “
   “DevOps is not a goal, but a
   never-ending process of continual
   improvement”
   – Jez Humble
   3
   

   View Slide

4. 4
   It’s all about
   bottlenecks
   

   View Slide

5. Chaotic
   Model
   5
   Fix
   Build
   First steps is SDLC
   

   View Slide

6. Waterfall
   Model
   6
   

   View Slide

7. Waterfall
   Model ▪ Long release cycles.
   ▪ Functional silos
   ▪ Rigid
   ▪ Lot of WIP
   7
   

   View Slide

8. The dawn of
   Agile
   8
   ▪ Shorter release cycles
   ▪ Cross functional teams
   ▪ Smaller batch sizes
   

   View Slide

9. DEV
   X
   OPS
   9
   

   View Slide

10. DEV
    X
    OPS
    10
    

    View Slide

11. DevOps
    11
    

    View Slide

12. 12
    DevOps Culture
    Principles and Practices
    Processes
    Automated deployment pipeline
    Technologies
    Supporting tool chain
    

    View Slide

13. DevOps
    Pipeline
    

    View Slide

14. How to keep
    up with
    security?
    14
    

    View Slide

15. DevSecOps
    Integrating security into Agile and DevOps
    15
    

    View Slide

16. “
    “DevSecOps enable organisations to
    deliver inherently secure software at
    DevOps scale and speed.”
    16
    

    View Slide

17. Security
    Practice
    Checklist
    ✓ Verify for security Early and Often
    ✓ Parameterize Queries
    ✓ Encode data
    ✓ Validate All Inputs
    ✓ Implement Identity and Authentication Controls
    ✓ Implement Appropriate Access Controls
    ✓ Protect Data
    ✓ Implement Logging and Intrusion Detection
    ✓ Use security frameworks and libraries
    ✓ Error and Exception Handling
    

    View Slide

18. OWASP
    Top 10
    

    View Slide

19. Security
    Practice
    Checklist
    

    View Slide

20. DevSecOps
    

    View Slide

21. “
    21
    DevOps security hooks
    

    View Slide

22. DevSecOps
    Trigger
    Points
    ✓ Static scanning during development
    ✓ Pull-requests: Static scans of data-flow,
    semantic and configurational
    ✓ Integration branch: Dynamic scanning
    ✓ QA Release Candidate Integration: Dynamic
    scanning
    ✓ Production Acceptance: Production-safe
    dynamic scanning
    ✓ Post-Production: RASP (Runtime Application
    Self-Protection), WAF (Web Application
    Firewalls) both need rules updated.
    

    View Slide

23. 23
    DevSecOps Culture
    Principles and Practices
    Processes
    Automated deployment pipeline
    Technologies
    Supporting tool chain
    

    View Slide

24. Culture
    ▪ Communication and transparency
    ▪ Blameless postmortem
    ▪ Continuous improvement
    ▪ Everyone is responsible for security
    ▪ Automate as much as possible
    ▪ Everything as code
    

    View Slide

25. Processes
    Secure SDLC
    ▪ Training
    ▪ Requirements
    ▪ Architecture & Design
    ▪ Coding
    ▪ Testing
    ▪ Deployment
    ▪ Post deployment
    

    View Slide

26. Processes
    Security Pipeline ▪ Assessment of critical resource
    ▪ Reduce friction
    ▪ Increase visibility
    ▪ Each step repeatable
    ▪ Drive up dependency
    

    View Slide

27. Processes
    Security Pipeline
    

    View Slide

28. Technologies
    ▪ Requirements
    ▪ Code: IDE plugins, SAST
    ▪ Test: Gauntlt, DAST
    ▪ Configure: Sec as code
    ▪ Maintenance: Patch management
    ▪ Monitor: Auditing, Attack visibility
    

    View Slide

29. Questions?
    29
    

    View Slide

30. Thank you very much
    for your time
    30
    You can find me at:
    ▪ br.linkedin.com/in/evandromohr
    ▪ t.me/phpcomrapadura
    

    View Slide