[2020.06 Meetup] [Talk] Patrick Debois - Trust Me, We're Doing DevSecOps

Slide 1

Slide 1 text

Trust me we're doing DevSecOps Patrick Debois | Director of Dev❤Ops Relations | patrick.debois@snyk.io

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

https://www.slideshare.net/jedi4ever/future-ofdevopsv2 The future of Devops - Austin devopsdays 2013

Slide 4

Slide 4 text

10(+1) years of DevOps

Slide 5

Slide 5 text

Agile TDD Scrum ITIL Ticket Systems Devops CAB Infra as Code Continuous Delivery People Process Tools Idea Reductionism

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

No content

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

No content

Slide 13

Slide 13 text

https://www.slideshare.net/jedi4ever/from-serverless-to-service-full-how-the-role-of-devops-is-evolving

Slide 14

Slide 14 text

Technogical determism https://en.wikipedia.org/wiki/Technological_determinism

Slide 15

Slide 15 text

The law of Ampliﬁcation "Technology ampliﬁes underlying human forces." https://www.amazon.com/Geek-Heresy-Rescuing-Social-Technology/dp/161039528X

Slide 16

Slide 16 text

Kranzberg's Law(s) "Technology is neither good or bad ; nor is it neutral" https://www.jstor.org/stable/3105385?seq=1

Slide 17

Slide 17 text

No content

Slide 18

Slide 18 text

Say DevSecOps Tools 0ne more T1me

Slide 19

Slide 19 text

Traditional Security thinking

Slide 20

Slide 20 text

DevSecCops

Slide 21

Slide 21 text

TLS Chain of Trust

Slide 22

Slide 22 text

https://www.ssllabs.com/projects/ssl-threat-model/

Slide 23

Slide 23 text

https://www.ssllabs.com/projects/ssl-threat-model/

Slide 24

Slide 24 text

https://www.ssllabs.com/projects/ssl-threat-model/

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

https://developers.facebook.com/tools/ct/search/

Slide 29

Slide 29 text

CAA Record

Slide 30

Slide 30 text

https://github.com/docker/for-mac/issues/3800

Slide 31

Slide 31 text

https://t.co/eOU5cQrie5?amp=1

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

https://blog.npmjs.org/post/172999548390/new-pgp-machinery

Slide 35

Slide 35 text

DEEP ..... SIGH

Slide 36

Slide 36 text

https://darkport.co.uk/blog/ahh-shhgit!/

Slide 37

Slide 37 text

The cost of Distrust @johncutleﬁsh @johncuttleﬁsh

Slide 38

Slide 38 text

https://www.youtube.com/watch?v=4gJoVWyOXM4

Slide 39

Slide 39 text

• You are an Agent • You make promises to others in the system • Your promises should be verifiable • A promise does not guarantee an outcome • It needs to be mutually agreed upon (no obligation) • Other agents can make promises to you • Their promises should be verifiable • You can not make promises on behalf of other agents • Promises can be conflicting • To keep a promise you should have a choice

Slide 40

Slide 40 text

Are we building Conﬁdence or Trust with our pipelines ? https://medium.com/@ashutosh/solving-for-trust-vs-confidence-50a048c6db42

Slide 41

Slide 41 text

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReﬂectionsonTrustingTrust.pdf

Slide 42

Slide 42 text

No content

Slide 43

Slide 43 text

https://vimeo.com/341144396 Human is part of the system

Slide 44

Slide 44 text

How rigid is your process - Degrees of freedom https://www.youtube.com/watch?v=2LoirYkkhUc @botchagalupe State of DevSecOps The Seventh Deadly Disease

Slide 45

Slide 45 text

https://jessitron.com/2019/05/13/principles-of-collaborative-automation/

Slide 46

Slide 46 text

Humans & Tools Day to day activities https://livablesoftware.com/development-process-in-github-basic-infographic/

Slide 47

Slide 47 text

https://www.rsaconference.com/usa/agenda/how-to-grc-your-devops @sueallspaw

Slide 48

Slide 48 text

Patrick Lencioni's model of the Five Dysfunctions of a Team https://www.quality-assurance-solutions.com/Team-Building-Books.html

Slide 49

Slide 49 text

The Thin Book of Trust https://www.thinbook.com/thin-books-2/trust-at-work-cards

Slide 50

Slide 50 text

OSS Library "competence" Number of CVE's Static Analysis Follows Semantic Versioning Number of Issues (tech) Authority of Author(s) read source code number of tests technical documentation Issues after each release

Slide 51

Slide 51 text

OSS Library "reliability" No Minor API breaches (~docs , ~issues) Last commit , release Release cadence Number of github stars Number of people blog about it Other projects using this library Number of Active Contributors Search google for articles

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

OSS Library "sincere" Is there good documentation Changelog/ Readme Governance in place Is there a logo Code of Conduct Guidelines for PRs Openess over the build process

Slide 54

Slide 54 text

OSS Library "care" Number of open Pull Requests Time spent with community Patience with new people How long till vulnerability gets ﬁxed Abusive language

Slide 55

Slide 55 text

Security wants developers to Make security a shared Responsibility Get better at security practices Make security a part of the deﬁnition of done Be considering security during sprint planning

Slide 56

Slide 56 text

Developers wants security to Make delivery a shared Responsibilty Explain the technical security issue Be available when stories are reviewed Be considerate of other priorities on the backlog

Slide 57

Slide 57 text

https://www.youtube.com/watch?v=o1f5BU6z-Kg Become Non-blocking self-service

Slide 58

Slide 58 text

Not a binary secure YES|NO How long are pull requests open? Last commit date ? How many active contributors? How long till CVE's ﬁxed Does it have tests? Does it have documentation? Commiters reputation Is there a Changelog? Did it do a 3rd party audit? Is it understandable code? Are there issues after releases? How often do they release? Other libraries using this one? Do they follow their code of conduct? How do they reply to pull requests? Are they friendly to new people? Are they open for new ideas?

Slide 59

Slide 59 text

We generally judge others to be less trustworthy than ourselves

Slide 60

Slide 60 text

"We judge ourselves by our intention and others by their behaviour"

Slide 61

Slide 61 text

It's a slow process "Trust arrives walking and departs riding."

Slide 62

Slide 62 text

Evaluate your own behaviour Become Trust Worthy https://www.thinbook.com/thin-books-2/trust-at-work-cards

Slide 63

Slide 63 text

The Iron Law of Evaluation and other metallic rules https://www.gwern.net/docs/sociology/1987-rossi#:~:text=The%20Iron%20Law%20Of%20Evaluation%20And%20Other%20Metallic%20Rules,fail%20or%20have%20small%20effects.

Slide 64

Slide 64 text

"The first step of transformation is the individual" - Deming https://quotes.deming.org/authors/W._Edwards_Deming/quote/10214