DevSecOps em Aplicações, Cloud, Artefatos

@krol_valencia DevSecOps em Apps,Cloud, Artifatos

@krol_valencia Carol Valencia Solution Architect in in/carolgv krol3 @krol_valencia 2

@krol_valencia Devops

@krol_valencia Agile Transformati on 4 http://www.agilebuddha.com/agile/enterprise-agile-transformation-are-you-able-to-see-big-elephant/

@krol_valencia 5

@krol_valencia 6 https://infosecwriteups.com/why-am-i-rooting-for-a-new-category-in-owasp-top-10-2021-insecure-build-deployment-environment-e255242530e9

@krol_valencia 7

@krol_valencia 8

@krol_valencia Aplicações

@krol_valencia 10 https://holisticsecurity.io/2020/02/10/security-along-the-container-based-sdlc Secure SDLC

@krol_valencia 11 Source: Alessandra Martins

@krol_valencia 12 https://medium.com/ouspg/security-design-with-principles-a8c045765b93

@krol_valencia 13 https://www.redhat.com/pt-br/topics/devops/what-is-ci-cd

@krol_valencia 14 https://medium.com/hackernoon/delivery-pipelines-as-enabler-for-a-devops-culture-ebc45963f703

@krol_valencia 15 Alessandra Martins

@krol_valencia Testing

@krol_valencia 17 https://circleci.com/blog/how-to-test-software-part-ii-tdd-and-bdd/

@krol_valencia 18

“ @krol_valencia 19 Static program analysis is the analysis of
computer software that is performed without actually executing programs, in contrast with dynamic analysis, which is analysis performed on programs while they are executing Wikipedia

@krol_valencia https://www.softwaresecured.com/what-do-sast-dast-iast-and-rasp-mean-to-developers/ 20

SCA: Source Code Analysis Source: https://www.linuxfoundation.org/open- source-management/2017/06/building-a- business-on-open-source/ https://resources.whitesourcesoftware.co m/blog-whitesource/sast-vs-sca
21

@krol_valencia 22 OWASP Top 10

@krol_valencia 23

@krol_valencia Vulnerability https://www.first.org/cvss/calculator/3.0 24

@krol_valencia 25 DevSecOps State of the Union - RSAC

@krol_valencia Cloud

@krol_valencia 27 Cloud Service Models

@krol_valencia 28 https://blog.ine.com/13-effective-security-controls-in-microsoft-azure-for-iso-27001-compliance

@krol_valencia Security Responsability in the Cloud 29

@krol_valencia 1. Data Breaches 2. Misconfiguration 3. DDoS Attacks 4.
Insufficient identity, credential, access and key management 5. Account hijacking 6. Man in the middle (MITM) 7 Insecure interfaces and APIs 8. Weak control plane 9. Limited cloud usage visibility 10. Abuse and nefarious use of cloud services Cloud Security Top threats 30

@krol_valencia Misconfigured Cloud Resources 31

@krol_valencia 32 Static Code Analysis for Infrastructure as Code

@krol_valencia 33 Salesforce/policy_sentry cloudsplaining Least Privilege Using Infrastructure as Code

@krol_valencia CIS Benchmar k OS - Configuration - Updates -
Filesystem integrity - Boot settings Docker docker/docker- bench-security Kubernetes aquasecurity/kube -bench aquasecurity/kube -hunter 34

@krol_valencia There is synergy in combining CWPP and CSPM capabilities…
that scans workloads and configurations in development and protect workloads and configurations at runtime CSPM DevSecOps CWPP 35 2020 Market Guide for CWPP, Apr. 2020, by Neil MacDonald and Tom Croll

@krol_valencia 36 • Gitlab: ◦ https://docs.gitlab.com/ee/user/application_security/sast/ ◦ https://docs.gitlab.com/ee/user/application_security/dast/ ◦ https://about.gitlab.com/blog/2019/08/12/developer-intro-
sast-dast/ • Github: ◦ https://github.com/features/security ◦ https://help.github.com/en/github/managing-security- vulnerabilities • Node: https://owasp.org/www-project-node.js-goat/ • Go: https://github.com/OWASP/Go-SCP • Free for Open Source Application Security Tools: https://owasp.org/www- community/Free_for_Open_Source_Application_Security_Tools • DevSecOps list: https://github.com/krol3/devsecops-resources Resources

@krol_valencia Obrigada! Preguntas? 37 in/carolgv krol3 @krol_valencia

DevSecOps em Aplicações, Cloud, Artefatos

DevSecOps em Aplicações, Cloud, Artefatos

Transcript

More Decks by Carol

Featured