Tweet
Tweet

Slide 1

Slide 1 text

© 2019 Synopsys, Inc. 1 Justin Collins @presidentbeef ISSA LA Summit 2019 Continuous Security for DevOps Velocity

Slide 2

Slide 2 text

© 2019 Synopsys, Inc. 2 Justin Collins @presidentbeef ISSA LA Summit 2019 Continuous Application Security for DevOps Velocity

Slide 3

Slide 3 text

© 2019 Synopsys, Inc. 3 Justin Collins - Background AT&T Interactive (YP.com) Twitter SurveyMonkey Brakeman Brakeman Pro Synopsys Web Application Security Static Analysis (Security)

Slide 4

Slide 4 text

© 2019 Synopsys, Inc. 4 DevOps?

Slide 5

Slide 5 text

© 2019 Synopsys, Inc. 5 DevOps Principles Flow Ease development to deployment Feedback Fast, meaningful tests Visibility and monitoring Continual Experimentation and Learning Resilient infrastructure Gene Kim

Slide 6

Slide 6 text

© 2019 Synopsys, Inc. 6 DevOps Practices Automated Testing Continuous Integration Continuous Deployment Infrastructure as Code Proactive Monitoring

Slide 7

Slide 7 text

© 2019 Synopsys, Inc. 7 DevOps? Sec ^

Slide 8

Slide 8 text

© 2019 Synopsys, Inc. 8 Rugged DevOps?

Slide 9

Slide 9 text

© 2019 Synopsys, Inc. 9 Speed is Good for Security “High performers, because they are integrating information security objectives into everyone’s daily work, are spending half as much time remediating security issues.” - Gene Kim at LocoMocoSec 2018 “…organizations that successfully embed security into DevOps experience a 50% drop in their production vulnerabilities and their time to fix improves by 25%.” - WhiteHat Security 2018 Application Security Statistics Report

Slide 10

Slide 10 text

© 2019 Synopsys, Inc. 10 Speed is Good for Security – Why? How quickly can a system be patched/upgraded, safely?

Slide 11

Slide 11 text

© 2019 Synopsys, Inc. 11 Speed is Good for Security – Why? How quickly can an application vulnerability be fixed, safely?

Slide 12

Slide 12 text

© 2019 Synopsys, Inc. 12 Is the security team responsible for shipping secure code?

Slide 13

Slide 13 text

© 2019 Synopsys, Inc. 13

Slide 14

Slide 14 text

© 2019 Synopsys, Inc. 14 Common Team Size Ratio 100 : 10 : 1 Developers Operations Security Credit: Shannon Lietz

Slide 15

Slide 15 text

© 2019 Synopsys, Inc. 15 Common Team Size Ratio 100 developers – experts on their slice of the code 1 security person – responsible for ALL code + systems

Slide 16

Slide 16 text

© 2019 Synopsys, Inc. 16 DevOps Developers are as responsible for stable code as the ops team is

Slide 17

Slide 17 text

© 2019 Synopsys, Inc. 17 DevOps Developers are as responsible for stable code as the ops team is DevSecOps Developers are as responsible for secure code as the security team is

Slide 18

Slide 18 text

© 2019 Synopsys, Inc. 18 Security Team’s Role Expertise Guidance Training Tools

Slide 19

Slide 19 text

© 2019 Synopsys, Inc. 19 Continuous Security Principles

Slide 20

Slide 20 text

© 2019 Synopsys, Inc. 20 The Secure Path is the Easy Path

Slide 21

Slide 21 text

© 2019 Synopsys, Inc. 21 Secure Path is Easy Path Secure-by-default APIs Never require “secure” flag or extra arguments Security should be simple (e.g. bcrypt) Remove insecure APIs if possible Out-of-the-Box Functionality Self-service server deployment CDN Secrets management User sessions Logs / monitoring Also, security!

Slide 22

Slide 22 text

© 2019 Synopsys, Inc. 22 Fast, Empathetic Feedback Loops Photo credit: wocintechchat.com Automated Tools Code Actionable Feedback

Slide 23

Slide 23 text

© 2019 Synopsys, Inc. 23 Fast, Empathetic Feedback Loops Photo credit: wocintechchat.com Automated Tools Code

Slide 24

Slide 24 text

© 2019 Synopsys, Inc. 24 Fast, Empathetic Feedback Loops Photo credit: wocintechchat.com Automated Tools Code

Slide 25

Slide 25 text

© 2019 Synopsys, Inc. 25 Security as an Ally

Slide 26

Slide 26 text

© 2019 Synopsys, Inc. 26 Implementation Strategy

Slide 27

Slide 27 text

© 2019 Synopsys, Inc. 27 Guidance Friendly, accessible security team Encourage discussion Default to “yes” Document preferred solutions Relevant training

Slide 28

Slide 28 text

© 2019 Synopsys, Inc. 28 Guardrails Single path to production Hardened default configurations/environment Secure-by-default libraries/frameworks Standardized secret management Centralized, self-service deployment

Slide 29

Slide 29 text

© 2019 Synopsys, Inc. 29 Tools (Security Automation) 1. Identify a real security issue 2. Determine solution 3. Automate detection 4. Automate enforcement https://flic.kr/p/dGYq6v

Slide 30

Slide 30 text

© 2019 Synopsys, Inc. 30 Lessons Learned

Slide 31

Slide 31 text

© 2019 Synopsys, Inc. 31 Listen First

Slide 32

Slide 32 text

© 2019 Synopsys, Inc. 32 Tailor Your Strategy https://flic.kr/p/f2JEum

Slide 33

Slide 33 text

© 2019 Synopsys, Inc. 33 Detect and Prevent https://flic.kr/p/21WAMJ4

Slide 34

Slide 34 text

© 2019 Synopsys, Inc. 34 Small Steps

Slide 35

Slide 35 text

© 2019 Synopsys, Inc. 35 Principles Summary Continuous Security Principles Ø The Secure Path is the Easy Path Ø Fast, Empathetic Feedback Loops Ø Security as an Ally Security Approach Ø Listen First Ø Tailor Your Strategy Ø Detect and Prevent Ø Small Steps

Slide 36

Slide 36 text

© 2019 Synopsys, Inc. 36 Now for the Bad News

Slide 37

Slide 37 text

© 2019 Synopsys, Inc. 37 AppSecUSA 2012

Slide 38

Slide 38 text

© 2019 Synopsys, Inc. 38 Security Team Evolution Zero Maybe one “security- minded” developer First security hire! Hire specialists Split into teams Responsible for everything Network Application Cloud Corporate … Network Application Cloud Corporate …

Slide 39

Slide 39 text

© 2019 Synopsys, Inc. 39

Slide 40

Slide 40 text

© 2019 Synopsys, Inc. 40 The End of the AppSec Team

Slide 41

Slide 41 text

© 2019 Synopsys, Inc. 41 End of the AppSec Team Secure coding? Code review? Threat modeling? Bug bounty reports? Training? Developer tooling? Secure libraries? Incident management? …?

Slide 42

Slide 42 text

© 2019 Synopsys, Inc. 42 Summary DevOps’ fast pace can be beneficial to security Security’s role must shift away from gates, towards guardrails The future is diffusion of security responsibility across the organization

Slide 43

Slide 43 text

© 2019 Synopsys, Inc. 43 Further Resources Top Infosec Lessons Learned Researching And Co-Authoring The DevOps Handbook We Come Bearing Gifts: Enabling Product Security with Culture and Cloud Rise of the Machines: Security Automation at Twitter

Slide 44

Slide 44 text

Thank You

Slide 45

Slide 45 text

No content