DevOps & Security: Here & Now

3,257 views
3,194 views

Published on

How do you integrate security within a Continuous Deployment (CD) environment - where every 5 minutes a feature, an enhancement, or a bug fix needs to be released?

Traditional application security tools which require lengthy periods of configuration, tuning and
application learning have become irrelevant in these fast-pace environments. Yet, falling back only on
the secure coding practices of the developer cannot be tolerated.

Secure coding requires a new approach where security tools become part of the development environment – and eliminate any unnecessary overhead. By collaborating with development teams, understanding their needs and requirements, you can pave the way to a secure deployment in minutes.

Published in: Technology
0 Comments
7 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
3,257
On SlideShare
0
From Embeds
0
Number of Embeds
7
Actions
Shares
0
Downloads
60
Comments
0
Likes
7
Embeds 0
No embeds

No notes for slide

DevOps & Security: Here & Now

  1. 1. DevOps and Security: It’s Happening. Right Now. Helen Bravo Director of Product Management at Checkmarx Helen.bravo@checkmarx.com
  2. 2. Agenda • Intro to DevOps • Integrating security within DevOps – Problems with traditional controls – Steps to DevOps security
  3. 3. What is DevOps About? An unstoppable deployment process … in small chunks of time
  4. 4. DevOps is Happening Companies that have adopted DevOps
  5. 5. Can TRADITIONAL web application security controls fit in… … a DevOps environment?!
  6. 6. Traditional Web Application Security Controls • Penetration Testing • WAF (Web Application Firewall) • Code Analysis
  7. 7. Penetration Testing- Takes Time!
  8. 8. Penetration Testing – 300 pages report – 3 weeks assessment time – 2 weeks to get it into development
  9. 9. Web Application Firewall (WAF) Thinking Continuous Deployment? Think Continuous Configuration!
  10. 10. Code Analysis • Setup time • Running time • Analysis time … just too slow!
  11. 11. … Do Nothing?
  12. 12. Required: A New Secure SDLC Approach
  13. 13. Step by Step
  14. 14. Step 1: Plan for Security
  15. 15. Step 1: Plan for Security • Identify unsecured APIs and frameworks • Map security sensitive code portions. E.g. password changes mechanism, user authentication mechanism. • Anticipate regulatory problems, plan for it.
  16. 16. Step 2: Engage the Developers. And Be Engaged
  17. 17. Step 2: Engage the Developers. And Be Engaged • Connect developers to security – Going to OWASP? Bring a developer with you! • Is your house on fire? Share the details with your developers. • Have an open door approach • Set up an online collaboration platform E.g. Jive, Confluence etc.
  18. 18. Step 3: Arm the Developers
  19. 19. Step 3: Arm the Developer • Secure frameworks: – Use a secure framework such as Spring Security, JAAS, Apache Shiro, Symfony2 – ESAPI is a very useful OWASP security framework • SCA tools that can provide security feedback on pre-commit stage. – Rapid response – Small chunks
  20. 20. Step 3: Automate the Process
  21. 21. Step 3: Automate the Process • Integrate within your build (Jenkins, Bamboo, TeamCity, etc.) – SAST – DAST • Fail the build if security does not pass the bar.
  22. 22. Continuous Deployment Unit Tests Develop Code Commit Source Control Build Trigger Deploy to Test Env Report & Notify Publish to release repository Deploy to Production
  23. 23. Security within Continuous Deployment Tests Develop Code Commit Source Control Build Trigger Deploy to Test Env SCA Test Publish to Automatic Report release security repository & test Notify Deploy to Production
  24. 24. Step 5: Use Old Tools Wisely
  25. 25. Step 5: Use Old Tools Wisely • Periodic pen testing • WAF on main functions • Code review for security sensitive code portions.
  26. 26. Summary
  27. 27. Summary • DevOps is happening. Right Now. – During the time of this talk, Amazon has released 75 features and bug fixes. • Security should not be compromised • Don’t be overwhelmed. Start small
  28. 28. The 3 Takeaways 1. Plan from the ground 2. Engage with your developers 3. Integrate security into automatic build process.
  29. 29. Questions?
  30. 30. Thank you Helen.bravo@checkmarx.com

×