Shifting Left: Implementing Security Into the CI/CD Pipeline

Transcript

1. Shifting Left - Implementing Security Into the CI/CD Pipeline
2. echo $USER Krunal Savaliya (eWPTXv2, CEH) Application Security Engineer @Micron 3+ years of experience in the application security domain Current Focus: DevSecOps, Application & API security, Threat Modeling. Blog: https://sklnhunt.github.io/
3. Agenda Introduction to DevOps and CI/CD Challenges with Traditional Security Approaches Intro to DevSecOps and Shift left Approach Implementing Security in the CI/CD Pipeline Best Practices for Implementing DevSecOps Demo References and Resources Q&A
4. A project management approach that involves breaking the project into phases and emphasizes continuous collaboration and improvement. Teams follow a cycle of planning, executing, and evaluating. Introduction to DevOps & CI/CD Agile Development Methodology
5. What is DevOps? Development + Operations DevOps is a set of practices, tools, and a cultural philosophy that automate and integrate the processes between software development and IT teams.
6. Why do we need DevOps? Faster software delivery and deployment cycles Enhanced quality with continuous integration and testing Rapid detection and resolution of issues in production Improved collaboration between development and operations teams Scalability and flexibility to adapt to business needs.
7. What is a CI/CD? CI - Continuous Integration (Building, testing & merging code changes into the shared code repository) CD - Continuous Delivery / Continuous Deployment (Automatic release to repository then deploy it to the production)
8. Challenges with Traditional Security Approach Late Integration of Security in the software development lifecycle. Security managed by the separate team. Time-consuming testing. Reactive approach to vulnerabilities. Inefficient for Agile and DevOps Environments. High cost of fixing vulnerabilities post-production. Lack of automation in security processes.
9. Shift Left Approach Practice in software development and testing where processes, particularly testing and security, are moved earlier in the development lifecycle.
10. Intro to DevSecOps DevSecOps is the practice of integrating security into every stage of the software development lifecycle, from planning to deployment, with a focus on collaboration between development, security, and operations teams. Building a mindset that provide purpose "everyone is responsible for security".
11. DevOps DevSecOps Security is handled as a separate phase, typically at the end. Security is integrated into every stage of development. Focus on speed, efficiency, and operational collaboration. Balance speed with security to ensure secure delivery. Developers and operations focus on coding, deployment, and infrastructure. Developers, operations, and security teams share responsibility for implementing and managing security throughout the lifecycle. Focuses on functionality, performance, and scalability testing. Includes vulnerability scanning, compliance checks, and secure code analysis. Difference b/w DevOps & DevSecOps
12. What do you need for DevSecOps? SCM Platform with your project repository on it (GitHub, Bitbucket, Azure DevOps, GitLab, etc.) CI/CD Pipeline Configuration (Jenkins, GitHub Actions, GitLab CI/CD, CircleCI, Azure Pipelines) Security Tools for, Secret Detection Dependency Scanning (SCA) Software Bill of Materials (SBOM) Scanning Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) Infrastructure as Code (IaC) Scanning Monitoring & Feedback (Splunk, Slack, etc.)
13. Implementing Security in the CI/CD Pipeline GitHub SCM Jenkins Automation Server Integration via webhook Project repository CI/CD Pipeline Git Checkout Secret Detection Build SAST SCA SBOM Scanning DAST Monitoring & Feedback
14. Best Practices for Implementing DevSecOps Developer first security 1. Accuracy - Give team members the most relevant, important information 2. Actionability - Providing security context 3. Accountability - Who is responsible for security? 4. Work on a DevSecOps maturity model 5. Establish a culture of continuous improvement 6. Measure success 7. Open communication 8.
15. Demo!!!
16. References & Resources https://roadmap.sh/devops https://github.com/Lets-DevOps/awesome-learning https://www.devsecops.org/ https://owasp.org/www-project-devsecops-guideline/latest/index https://snyk.io/articles/devsecops/ https://github.com/sottlmarek/DevSecOps
17. Q&A
18. Thank You