DevSecOps: Building a Culture of Speed DevSecOps represents a cultural shift to support a changed security model when operating in an agile environment. In this session we will discuss the culture and practices for developing security that is automated, continuous, and visible. Aaron McKeown, Head of Security Engineering at Xero, will share how Xero have developed a security culture of speed and how it enables developers to innovate. David Faulkner, Principal Technical Account Manager, Amazon Web Services and Aaron McKeown, Head of Security Engineering, Xero

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Aaron McKeown
Head of Security Engineering, Xero
David Faulkner
Principal Technical Account Manager, Amazon Web Services
DevSecOps: Building a Culture of Speed

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
My spouse doesn’t trust me. For good reason.

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Sisyphean Task
Securing a major
release.
Security in DevOps isn’t
only a major release.
Oh, we iterate fast now.
We need SPEED.

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
So Humans invented computersSecurity @ 299 792 458 m / s

6. Connecting people with the right numbers
anytime, anywhere, on any device
Global small
business platform

7. Agile growth: AWS accounts and services
1 5 9 13
Services in use
Number of accounts

8. 8
Product based teams

9. Security is a journey,
not a destination

10. Speed

11. Automated, continuous and visible
If you don't put a metric on it,
how do you know what normal is?

12. Applying security in the real world
If I “need” to encrypt at rest, it should be easy. Providing access to KMS makes it easy.
Self-service trumps having to request things from another team, which trumps having to raise a ticket.
If it’s too hard, I’ll do it “later”. PACMAN is a simple thing, but it’s actually changed my life.
Resetting MANAGE password was a PITA before.
If I “need” to patch my instances for vulnerabilities, Halo reporting makes that easy.
Luke Ryan, Principal Engineer, Xero

13. #RSAC

14. #RSAC

15. #RSAC

16. #RSAC

17. #RSAC

19. F A S T S E C U R E&

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Then And Now

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Deus Ex Machina

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Deus Ex Machina

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Deus Ex Machina
from security import *

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Starting Today

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Getting Things Done

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
A Roadmap To Success

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automate All The Things

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You!