Traditional Security is Dead! - NYC-Sep2018

This is the 15min version of the DevSecOps introduction presentation.

These slides were presented at the NY Information Security Meetup in Manhattan New York on 9th September,2018 by Ashish Rajan to a cybersecurity professional crowd of about 200 attendees.

Linkedin: https://www.linkedin.com/in/ashishrajan

Transcript

1. Traditional Security is dead! Ashish Rajan NYC Information Security - September,2018
2. Who am I? •Masters in Information Security •Offensive turned Defensive Security guy •Helping bridge Security and DevOps for large enterprises through Versent. •OWASP Melbourne Chapter Lead •DevSecOps Evangelist •Largest DevSecOps community in Australia & New Zealand •Public Speaker for security in the modern world •Global DevSecOps workshops
3. WaterFall Security Traditional Security
4. Waterfall Landscape Contractors Data Centers Company issued Assets
5. Evolution of Hackers 80s - 90s Present Day
6. Evolution of White Hat 80s - 90s Present Day
7. Problem Effectiveness Agility Scalability
8. Agile + DevOps
9. Current Landscape Infrastructure as code Shared Risk SaaS Cloud
10. Traditional Security is being disrupted • Infrastructure • Identity & Access Management • Software Development Lifecycle • Security Assessment • Governance
11. Traditional Security is being disrupted • Infrastructure • Identity & Access Management • Software Development Lifecycle • Security Assessment • Governance • Feedback
12. Infrastructure (Waterfall) • Strong Public Facing Perimeter • Project delays – Security Hardware • Every server is a “pet” • OS and Security updates – slower
13. Infrastructure (Current) • Corporate assets hosted in Cloud, SaaS • Infrastructure as Code - CI/CD Pipeline • Every server “will be” a “cattle” • Automated Infrastructure Vulnerability Mgmt • Vulnerability Patching, SSL Certs • Guardrails - Detective & Preventive controls “Security has high visibility and velocity to respond to threat.”
14. Feedback (WaterFall) • Security Audit • ”Periodic” PenTesting • Logs • Reports • Production Incidents - SOC Team
15. Feedback (Current) • Testing • Chaos Engineering • DOS Testing done more frequently - Blue/Green Deployments • Smarter PenTesting - Bug Bounty • Incidents - DevOps + SOC • Continuous Feedback on above “Business gets more value for testing, when low hanging fruits have been tackled earlier in SDLC”
16. “If your solution to a problem threat cannot scale then it’s a patch not a solution” - Ashish Rajan
17. Automated, Measurable, Collaborative and Repeatable!
18. Things that helped in achieving this • Security as a service • Trust and but Verify • Learning coding – security tools and libraries for others • Attending Standups • Security Training
19. Take Away • Traditional Security is mutating in the world of DevOps • Automating security makes your enterprise more secure – no Human error • Security Metrics makes the value add of the security more visible • Security as a Service for the whole organization • Terms to lookout for - deception_ops, ML, no_ops
20. Question