Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
DevSecOps for the modern cloud era
Search
Gurucharan Subramani
February 01, 2020
Programming
0
22
DevSecOps for the modern cloud era
Gurucharan Subramani
February 01, 2020
Tweet
Share
More Decks by Gurucharan Subramani
See All by Gurucharan Subramani
Serverless and AI Fun with Azure
gurucharan94
0
100
Other Decks in Programming
See All in Programming
Rails Frontend Evolution: It Was a Setup All Along
skryukov
0
230
Porting a visionOS App to Android XR
akkeylab
0
640
Advanced Micro Frontends: Multi Version/ Framework Scenarios @WAD 2025, Berlin
manfredsteyer
PRO
0
340
新メンバーも今日から大活躍!SREが支えるスケールし続ける組織のオンボーディング
honmarkhunt
5
8k
Quand Symfony, ApiPlatform, OpenAI et LangChain s'allient pour exploiter vos PDF : de la théorie à la production…
ahmedbhs123
0
210
PipeCDのプラグイン化で目指すところ
warashi
1
290
AI Agent 時代のソフトウェア開発を支える AWS Cloud Development Kit (CDK)
konokenj
4
530
ソフトウェア品質を数字で捉える技術。事業成長を支えるシステム品質の マネジメント
takuya542
2
14k
なんとなくわかった気になるブロックテーマ入門/contents.nagoya 2025 6.28
chiilog
1
280
ふつうの技術スタックでアート作品を作ってみる
akira888
1
1.1k
GitHub Copilot and GitHub Codespaces Hands-on
ymd65536
2
150
なぜ「共通化」を考え、失敗を繰り返すのか
rinchoku
1
660
Featured
See All Featured
The Invisible Side of Design
smashingmag
301
51k
Practical Tips for Bootstrapping Information Extraction Pipelines
honnibal
PRO
20
1.3k
The Straight Up "How To Draw Better" Workshop
denniskardys
235
140k
How To Stay Up To Date on Web Technology
chriscoyier
790
250k
GitHub's CSS Performance
jonrohan
1031
460k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
138
34k
Raft: Consensus for Rubyists
vanstee
140
7k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
48
2.9k
It's Worth the Effort
3n
185
28k
StorybookのUI Testing Handbookを読んだ
zakiyama
30
5.9k
Being A Developer After 40
akosma
90
590k
How GitHub (no longer) Works
holman
314
140k
Transcript
Security Mindset : Actionable DevSecOps Guide for the brave new
cloud era Gurucharan Subramani www.gurucharan.in
ME !! MEEEEE !!! @gurucharan94 • I work at ABB.
• IoT - Electric Transportation Charging Infra • Reduce C02 Emissions and fight climate change.
@gurucharan94 Audience Survey • Did you make a new friend
?? • Developers ?? Operations ?? Security ?? • How many know Diffie-Hellman Key Exchange??
DevSecOps @gurucharan94 Once upon a time…. • Silo teams –
Dev / Test / Ops / Sec • Release every 3 months or longer. • Code freezes, hand offs and lot of emails. • On premises servers
DevSecOps @gurucharan94 …. and that meant we ended up here.
DevSecOps @gurucharan94 We partly solved the problem with the Cloud,
DevOps and Continuous Delivery Principles.
DevSecOps @gurucharan94 … but faster release cycles and the cloud
adoption meant traditional security gates were becoming irrelevant.
@gurucharan94 DevSecOps Code Build Unit Tests Test Env Integration Tests
Security Tests Prod Let us find out how to go from here….. Code Build Unit Tests Integration Tests Prod Security Tests ….. to here
@gurucharan94 DevSecOps and more importantly from here… to here…
@gurucharan94 Secure Coding Practices Code Build Unit Tests Integration Tests
Prod Security Tests
@gurucharan94 DevSecOps What is vulnerable code ? • Allows SQL
Injection, XSS etc. • OWASP and other vulnerabilities. • Hard coded credentials in code
@gurucharan94 DevSecOps Where is the vulnerable piece of code ??
• Code that my colleague writes • Open source software
@gurucharan94 DevSecOps Static Code Analysis Visual Studio Extensions • Security
Code Scan • SonarQube and SonarLint https://security-code-scan.github.io/ https://www.sonarlint.org/
@gurucharan94 DevSecOps Managed Identity helps you avoid hardcode credentials in
code https://devblogs.microsoft.com/visualstudio/managing-secrets-securely-in-the-cloud/
@gurucharan94 DevSecOps State of the Software Supply Chain - Sonatype
@gurucharan94 DevSecOps Scan for libraries with vulnerabilities • WhiteSource •
OWASP Dependency Check • Nexus etc.
@gurucharan94 Secure Infrastructure Practices Code Build Unit Tests Integration Tests
Prod Security Tests
@gurucharan94 DevSecOps Securing your Infrastructure • Pipeline Infra • Application
Infra
@gurucharan94 DevSecOps •HTTPS Everywhere •Protecting your pipelines •Principle of least
privilege •Secure Communication – IoT Devices
@gurucharan94 DevSecOps Shared Security Responsibility in the cloud https://docs.microsoft.com/en- us/azure/security/fundamentals/shared-responsibility
@gurucharan94 DevSecOps AzSK – Secure DevOps Kit for Azure The
Secure DevOps Kit for Azure is a PowerShell Module that tests the configuration of Azure resources for security and operational best practices. https://github.com/azsk/DevOpsKit
@gurucharan94 DevSecOps AzSK – Secure DevOps Kit for Azure
@gurucharan94 DevSecOps Assuming Breach • Red Teams and Pen Testing
• Monitoring and Metrics • Incident Response Plan
@gurucharan94 DevSecOps Recap – Secure Code • Static Code Analysis
– SonarQube and VS extensions • Azure Key Vault and Managed Identity • OSS Vulnerability Scans - WhiteSource
@gurucharan94 DevSecOps Recap – Secure Infra • Right access levels
and permissions. • Secure Communication using HTTPS. • Shared Responsibility Model in the Cloud. • AzSK – Azure Security Kit
@gurucharan94 How cyber aware are you?? • The first /
last char in your office password is a number • Password Manager? • HIBP ?
@gurucharan94 DON’T YOLO. BE CYBER AWARE. DON’T BE THE NEXT
DATA BREACH.
@gurucharan94 Let’s Connect www.gurucharan.in
@gurucharan94 Thank You !!!