How can you squeeze Security into DevOps? Security is often an understaffed function, so how can you leverage what you have in DevOps to improve your security posture? We will reveal processes already in place that can be used to improve security. This fine tuning of tools and processes can give you DevSecOps on a shoestring.

1. @pati_gallardo
T
S

2. 6 Dev[Sec]Ops Hacks
Patricia Aas
femtech 2019
T
S
@pati_gallardo

3. Patricia Aas - Consultant
T
S
C++ Programmer, Application Security
Currently : T S
Previously : Vivaldi, Cisco Systems, Knowit, Opera Software
Master in Computer Science - main language Java
Pronouns: she/her
@pati_gallardo

4. @pati_gallardo
Dev[Sec]Ops
T
S

5. 5
Why Dev[Sec]Ops?
@pati_gallardo
T S

6. 6
“Our research shows that building security into software
development not only improves delivery performance but also
improves security quality. Organizations with high delivery
performance spend significantly less time remediating security
issues.”
Accelerate, Forsgren PhD, Humble and Kim
@pati_gallardo
T S

7. Coding Building Testing
Manual
Security
Gate
Keeping
Monitoring
7
Simplified Pre-DevOps Deployment Workflow
@pati_gallardo
But you have to get out of the Critical Path?
T S

8. 8
- We have no “Security Team”
1 security person per 10 ops people per 100 developers*
*Accelerate, Forsgren PhD, Humble and Kim
@pati_gallardo
T S

9. 9
Tooling
Incident
Response
Automation Auditability
Security
Reviews
Manpower
T S
@pati_gallardo

10. 6
Dev[Sec]Ops
Hacks
10
@pati_gallardo
T S

11. 1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
11
@pati_gallardo
T S
6 Dev[Sec]Ops Hacks

12. 12
Tooling
Incident
Response
Automation Auditability
Security
Reviews
Manpower
@pati_gallardo
T S

13. @pati_gallardo
Bootstrapping
Tooling
T S

14. Use their issue tracker
Use their slack
Use their monitoring
Use their dashboards
Integrate into their tools
14
Bootstrapping
Tooling
Live Off the Land
@pati_gallardo
T S

15. 1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
15
@pati_gallardo
T S
6 Dev[Sec]Ops Hacks

16. 16
Tooling
Incident
Response
Automation Auditability
Security
Reviews
Manpower
@pati_gallardo
T S

17. @pati_gallardo
Bootstrapping
Manpower
T S

18. Use the devs to build integrations
Find ways to justify it
Dual purpose:
Stability and Security
18
Bootstrapping
Manpower
Have Devs Build It
@pati_gallardo
T S

19. 1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
19
@pati_gallardo
T S
6 Dev[Sec]Ops Hacks

20. 20
Tooling
Incident
Response
Automation Auditability
Security
Reviews
Manpower
@pati_gallardo
T S

21. @pati_gallardo
Bootstrapping
Security Reviews
T S

22. Trunk-based development
Small commits
Add security to peer-review
Add threat modeling to peer-review
Feature toggles
Use feature toggles for
A/B testing 22
Bootstrapping
Security Reviews
Trunk-based Development
@pati_gallardo
T S

23. 1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
23
@pati_gallardo
T S
6 Dev[Sec]Ops Hacks

24. 24
Tooling
Incident
Response
Automation Auditability
Security
Reviews
Manpower
@pati_gallardo
T S

25. @pati_gallardo
Bootstrapping
Incident Response
T S

26. 26
Have a Hotline
security@example.com
https://example.com/.well-known/security.txt
@pati_gallardo
T S

27. 27
External Vulnerability Report Flow
@pati_gallardo
Bug Report
Vulnerability
Report
Social Media
QA
Security
Marketing
Triage
No bug
Bug
Vulnerability
T S

28. 28
Use Existing Crisis Process for
Incident Response
@pati_gallardo
T S

29. @pati_gallardo
They Know
How To
Handle A
Crisis
T S

30. ● Separate priority in bug-tracker
● Separate channel in Slack
● Explicit side-duty in every team:
Security Engineer
● Simple procedure based on
information sharing and empowering
● Have a procedure on how people will
get paid in off-hours
30
Bootstrapping
Incident Response
Security Improvements to
Existing Crisis Process
@pati_gallardo
T S

31. 1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
31
@pati_gallardo
T S
6 Dev[Sec]Ops Hacks

32. 32
Tooling
Incident
Response
Automation Auditability
Security
Reviews
Manpower
@pati_gallardo
T S

33. @pati_gallardo
Bootstrapping
Automation
T S

34. Add IDE plugins
Add dependency scanner in CI/CD
Add scanners in CI/CD
Dynamic scan in a non-blocking
pipeline
All results in dev visualization
34
Bootstrapping
Automation
Automate as Much as
Possible
@pati_gallardo
T S

35. Coding
IDE Plugins
Static Analysis
Building Testing Scanning Monitoring
35
Alerts
Dashboards
Dynamic Analysis
Dependency Checks
Warnings
Commit hooks
Simulations
Fuzzing
@pati_gallardo
T S

36. 1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
36
@pati_gallardo
T S
6 Dev[Sec]Ops Hacks

37. 37
Tooling
Incident
Response
Automation Auditability
Security
Reviews
Manpower
@pati_gallardo
T S

38. @pati_gallardo
Bootstrapping
Auditability
T S

39. Fully Automated Pipeline
Configuration Management
Know what you’re running
Auditable
39
Bootstrapping
Auditability
Infrastructure as Code
@pati_gallardo
T S

40. 1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
40
@pati_gallardo
T S
6 Dev[Sec]Ops Hacks

41. @pati_gallardo
Dev[Sec]Ops
T
S

42. T
S
P f .
Patricia Aas, T S
@pati_gallardo

43. @pati_gallardo
T
S
Q ?