Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

#ATAGTR2018 Presentation "Decoding Security in DevSecOps" by Meghashyam Varanasi and Venkat Moncompu

28 views

Published on

Meghashyam Varanasi and Venkat Moncompu conducted a session on "Decoding Security in DevSecOps" at #ATAGTR2018.

please refer our linkedin post for session details
https://www.linkedin.com/pulse/session-decoding-security-devsecops-atagtr2018-agile-testing-alliance/

Published in: Technology
  • Be the first to comment

  • Be the first to like this

#ATAGTR2018 Presentation "Decoding Security in DevSecOps" by Meghashyam Varanasi and Venkat Moncompu

  1. 1. #ATAGTR2018 Decoding Security in DevSecOps Meghashyam Varanasi & Venkat Moncompu 27th September 2018
  2. 2. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Agenda DevSecOps Introduction Construct Security Six Tenets of DevSecOps Evolution of Security with SDLC Progression Dimensions of DevSecOps Governance & Culture Sustain Security Technology & Security Implementing Security in DevSecOps Security Best Practices
  3. 3. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) DevSecOps Introduction DEV OPS SEC What is DevSecOps? DevSecOps is based on the principle that collaboration to exist among Security, Application development and IT operations teams. Why DevSecOps? DevSecOps enables in-built security, continuous security & monitoring with out compromising on speed /time to market.
  4. 4. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Six Tenets of DevSecOps Security Culture Built in Security Shift Left Security Testing Automation of Security Security First Approach Continuous Security
  5. 5. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Evolution of Security with SDLC Progression Traditional SDLC Agile Methodology CI/CD DevSecOps Security Culture Low Medium Medium-High High Continuous Security Low Medium-High Medium-High High Automation of Security Low Medium Medium-High High Built in Security Low Medium Medium High Security First approach Medium Medium Medium High Shift Left Security Low Medium-High Medium-High High Enhanced Security Focus
  6. 6. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Dimensions of DevSecOps Governance Culture Technology Security  Secure Processes  Security Policy  Secure Systems  Security Mindset  Security Discipline  Security Trained  Security Tools  Security Automation  Security Capability  Continuous Security  Security Monitoring  Security Remediation
  7. 7. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Dimensions of DevSecOps - Governance & CultureGovernance Secure Processes Establish processes that are secure by design ( Ex: Separation of duties) Secure Systems Establish a Governance model where security systems are built in (Ex: Hub & Spoke Security Excellence team) Secure Policy Ensures that the security policies are built to ensure maximum security (Ex: Role based Authentication) Culture Security Mindset Have a security first mind set and instil security as a core principle. ( Ex: Security as First class citizen) Security Trained Train associates on security methodologies & best practises ( Ex: Secure coding for developers) Security Discipline Encourage teams to adopt security in a disciplined manner and give the highest priority to security
  8. 8. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Dimensions of DevSecOps - Technology & SecurityTechnology Security Tools Establish a full set of base line tools for security validation (Ex: Third party tools, Internal tools, Open source tools) Security Capability Always strive to improve organization capability to better identify & prevent possible security lapses. Security Automation Automate every possible security control, so that the validation can be done very quickly and repeated as required Security Continuous Security Security is automatically validated continuously throughout the life cycle ( Ex: Automatic security test on the CI/CD pipeline Security Remediation Allows the ability to identify potential threats and automatically respond to the same (Ex: RASP ) Security Monitoring Continuous monitoring of production systems and analyse for any Security attacks (Ex: Log Monitoring, Infra Monitoring)
  9. 9. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Implementing Security In DevSecOps 01. Construct Security 02. Sustain Security  Configure  Monitor  Contain  Stabilize  Predict  Make  Build  Validate
  10. 10. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Implementing Security In DevSecOps - Construct Plan Make Build Validate • Test Common abuse cases • Penetration Testing • Compliance validation • Software vulnerability Assessment • Configuration Security Assessment • Generate file integrity baseline • Break breaker for possible security violations • Code analysis • Verify security of workload at build time • Threat modelling • Analyze/Predict Security incidents • Design security policies • Define policy groups • Static/Dynamic App Security Analysis • Abuse case tests • Build agent via continuous integration • Build scripts for security validation • Build gold master imagesAppln Security Infra Security
  11. 11. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) Implementing Security In DevSecOps - Sustain Deploy Monitor Contain Stabilize • Maintain service for non Attack usage • Incident root causes analysis • Updating threat modeling etc. • Security patches updates • Platform update for vulnerabilities • RASP auto respond • Rollback/toggle off. • Block attackers • Auto blocking for DDOS attacks • Auto showdown of Infrastructure • Configuration validation • Feature Toggles / Traffic • Apply runtime policies on (Software vulnerability , Configuration security etc. • Firewall, authentication • File integrity monitoring • Log Monitoring & Analysis • Intrusion detection • Security events monitoring • Security Audit data • Scope new vulnerabilities ,Threat modelling Appln Security Infra Security
  12. 12. #ATAGTR2018 As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial channels(Provided due credit is given to me/us) DevSecOps Best practises – Automation & Progressive Security Best Practise Few Examples Security Policy as Code  Infrastructure as a code approach to security  Eliminate manually intensive and error prone configuration process  Accelerate the pace of innovation and reduce risks Train Developers on Secure Coding  Training developer on secure coding practises  Educate developer on common mistakes and frequently occurring security issues Well-Orchestrated Security Tooling  Usage of best in class third party tools for security  Usage of the tools provide by Cloud Service Providers  Usage of Make use of tools & technologies available in market to Building Security @ Scale  Ensure that all the security coding practise are scalable  Ensure that all the infrastructure security practises are scalable and automatic  Ensure that all the security configurations are scaled easily with minimal human intervention Separation of duties  Enforce maker checker policy where no single person is authorize to own the entire flow. Access Management  Role Based Access Control (RBAC) is an approach to restricting access to authorized users  Fine Grained Access Control (FGAC) allows security control on finest possible data/asset.  Multi Factor Authentication (MFA) enforces more than one authentication for high privileged users.
  13. 13.  https://www.sans.org/reading-room/whitepapers/analyst/devsecops-approach-securing-code-cloud-37597  https://lp.cyberark.com/rs/316-CZP- 275/images/CyberArk%20ebook%206_Principles_for_DevOps_Secuirty_at_Scale%20v0-1.pdf  https://techbeacon.com/6-devsecops-best-practices-automate-early-often  https://en.wikipedia.org/wiki/Role-based_access_control  https://www.sans.org/reading-room/whitepapers/analyst/devsecops-playbook-36792  https://www.sonatype.com/devsecops-reference-architectures  https://twitter.com/LMaccherone/status/843644744538427392 Reference
  14. 14. About Author Primary Author : Meghashyam Varanasi Associate Director Cognizant Consulting Co-Author: Venkat Moncompu Director Cognizant Consulting
  15. 15. Thank you

×