Upgrade to Pro — share decks privately, control downloads, hide ads and more …

DevSecOps - Vom Unikum zur gut geölten Maschine

Nicolas Byl
December 08, 2021

DevSecOps - Vom Unikum zur gut geölten Maschine

Nicolas Byl

December 08, 2021
Tweet

More Decks by Nicolas Byl

Other Decks in Technology

Transcript

  1. 1
    NICOLAS BYL
    DEVSECOPS
    VOM UNIKUM ZUR GUT GEÖLTEN
    MASCHINE

    View full-size slide

  2. 2
    INTRODUCTION

    View full-size slide

  3. 3
    THE DEVSECOPS CYCLE

    View full-size slide

  4. 4
    THE CASTLE ILLUSION

    View full-size slide

  5. 5
    THE DEVSECOPS CYCLE

    View full-size slide

  6. 6
    THE DEVSECOPS CYCLE

    View full-size slide

  7. 7
    SECURE ARCHITECTURE

    View full-size slide

  8. 8
    THREAT MODELLING

    View full-size slide

  9. 11
    THE DEVSECOPS CYCLE

    View full-size slide

  10. 12
    DESIGN PATTERNS

    View full-size slide

  11. 13
    PRE-COMMIT HOOKS

    View full-size slide

  12. 14
    CODE REVIEWS

    View full-size slide

  13. 15
    COMMIT SIGNING

    View full-size slide

  14. 16
    THE DEVSECOPS CYCLE

    View full-size slide

  15. 17
    THE DEPENDENCY ICEBERG

    View full-size slide

  16. 18
    AUTOMATION IS KING
    SOURCE CODE ANALYSIS
    • FindBugs
    • SonarQube
    • SAST
    • DAST
    SOURCE CODE ANALYSIS
    DEPENDENCY ANALYSIS
    • Maven, npm, ...
    • Container Images
    • Operating System
    Packages
    UPDATE AUTOMATION
    • npm audit
    • Dependabot
    • Renovate

    View full-size slide

  17. 19
    THE DEVSECOPS CYCLE

    View full-size slide

  18. 20
    POLICY OVER CHECKLISTS

    View full-size slide

  19. 21
    THE KEY TO THE KINGDOM

    View full-size slide

  20. 22
    ZERO-TRUST DEPLOYMENT

    View full-size slide

  21. 23
    ROLLER COASTER
    PASSWORDS

    View full-size slide

  22. 24
    INVENTORY SCANS

    View full-size slide

  23. 25
    FIRE DRILLS & CHAOS
    ENGINEERING

    View full-size slide

  24. 26
    HOW TO GET IN TOUCH
    [email protected]
    @ClusterBauer
    https://www.nexineer.io/career/
    WE ARE ALWAYS LOOKING FOR GREAT COLLEAGUES…

    View full-size slide

  25. 27
    PATCHING
    Sicheres Artefakt
    Artefakt
    mit bekannter
    Schwachstelle
    Scanning
    Patching

    View full-size slide