Increasing DevSecOps Maturity Level in 2021

1. Increasing DevSecOps
Maturity Level in 2021
Alex Rebert
@ayper

2. Part 1. DevSecOps => High-Performance
Part 2. High-Leverage InfoSec
Part 3. Deep Dive: Fuzzing

3. Ugh, another trendy
buzz word.

4. DevSecOps
=>
High-Performance

5. InfoSec is outnumbered.

6. Source: James Wickett 2014
1
InfoSec
10
Ops
100
Developers

7. 82%
of respondents report
a shortage of cybersecurity talent
Source: Hacking the Skills Shortage, Intel, 2017
71%
of respondents report the shortage does
direct and measurable damage

8. “Many security teams
work with a worldview
where their goal is to
inhibit change as
much as possible.”

9. Source: @swagitda_

10. The business requires change

11. 10 deploys per day
Dev & Ops cooperation at Flickr
John Allspaw & Paul Hammond
Velocity 2009
https://www.slideshare.net/jallspaw/10-deploys-per-day-dev-and-ops-cooperation-at-flickr

12. s/Ops/Sec/g

13. Change => Software Delivery

14. KPIs of software delivery
performance:
1. Lead time
2. Deployment frequency
3. Mean time to restore
4. Change fail percentage

15. How to allow change to
happen as often as it needs
to, securely?

16. DevSecOps

17. Culture + Tools

18. 1. Conduct security reviews.
2. Build pre-approved code.
3. Integrate security review into every
phase.
4. Test for security.
5. Invite InfoSec to demos.
https://cloud.google.com/solutions/devops/devops-tech-shifting-left-on-security
DevSecOps 101

19. Part 1. DevSecOps => High-Performance
Part 2. High-Leverage InfoSec
Part 3. Deep Dive: Fuzzing

20. Leverage through safety-by-default

22. Let’s eliminate entire classes of
vulnerabilities with better tools.
🦶 🔫

23. 70%
of Microsoft CVE Patches address
memory safety issues. [1]
[1]: Trends, Challenges, and Strategic Shifts in the Software Vulnerability Mitigation Landscape, Matt Miller, BlueHat IL 2019

24. Safer Languages

25. Safer APIs
db.execute("SELECT user WHERE user = '" + user + "' AND password = ‘" + password + "'");
db.execute("SELECT user WHERE user = ? AND PASSWORD = ?", user, password);

26. Leverage through automation

29. Automated security tools encode expert
knowledge and make it available to everyone,
quickly.

30. Software Component Analysis
dependabot, snyk
Static analysis
LGTM.com, modern compiler warnings, GuardRails
Fuzzing
ForAllSecure, Gitlab, OneFuzz, Fuzzbuzz

31. Part 1. DevSecOps => High-Performance
Part 2. High-Leverage InfoSec
Part 3. Deep Dive: Fuzzing

32. Fuzzing throws random inputs
at the program, really quickly.
This can’t possibly work?
32

33. Pulling JPEGs out of thin air, lcamtuf, 2014

34. 34

35. Code coverage feedback enables
incremental improvements.
Many increments lead to complexity.

36. Fuzzing learns.
Sample Inputs Testcase Mutation Software Under Test
Buggy Inputs
Inputs covering new
code

37. @Test
public void testCommonPrefix() {
assertEquals("", Strings.commonPrefix("", ""));
assertEquals("", Strings.commonPrefix("abc", ""));
assertEquals("", Strings.commonPrefix("", "abc"));
assertEquals("", Strings.commonPrefix("abcde", "xyz"));
assertEquals("a", Strings.commonPrefix("abc", "aaaaa"));
assertEquals("aa", Strings.commonPrefix("aa", "aaaaa"));
...
}

38. @Fuzz
public void fuzzCommonPrefix(String s1, String s2) {
String p = Strings.commonPrefix(s1, s2);
// Property 1: strings should start with the prefix
assert(s1.startsWith(p) && s2.startsWith(p));
// Property 2: the prefix cannot be extended
assert(p.equals(s1) || p.equals(s2) || s1[p.length()] != s2[p.length()]);
}

39. Write Once. Fuzz Forever.

40. Commit Build Unit
Tests
Integration
Tests
Trunk
Branch

41. Commit Build Unit
Tests
Integration
Tests
Trunk
Branch
Automatically
Generated Testsuite
Regression
Fuzz Tests

42. Commit Build Unit
Tests
Integration
Tests
Trunk
Deploy
Branch
Automatically
Generated Testsuite
Regression
Fuzz Tests

43. Commit Build Unit
Tests
Integration
Tests
Trunk
Deploy Fuzz
Branch
Asynchronous
Continuous Fuzzing
Automatically
Generated Testsuite
Regression
Fuzz Tests

44. Commit Build Unit
Tests
Integration
Tests
Trunk
Deploy Fuzz
Branch
Asynchronous
Continuous Fuzzing
Automatically
Generated Testsuite
Regression
Fuzz Tests

45. Thanks!
Alex Rebert
Co-founder of ForAllSecure
https://forallsecure.com
45