DevOps Indonesia Meetup in collaboration with ITommey talked about securing a great developer experience

1. PAGE
1
DEVOPS INDONESIA
DevSecOps
Securing a great Developer Experience
DEVOPS INDONESIA
DevOps Community in Indonesia
Jakarta, 6 November 2018

2. About me
Stefan Streichsbier
@s_streichsbier
GuardRails.io
Move fast, be safe.

3. http://bit.ly/epic-failures-v01

4. What are we going to cover?
And also, how security and developer experience are related.
How security is
keeping up with it
How the tech
landscape changed
What mindset security
has to adopt

5. Some Statistics
As of June 2017,
51% of the world's population
has internet access.
That’s close to
4,000,000,000 people
As of October 2018,
there are 31,000,000
developers on Github alone.

6. Source: https://www.bigfootcap.com/a-review-of-why-software-is-eating-the-world-how-have-the-companies-fared/

7. With change comes complexity

8. It used to be so simple
Figure 1: Use an FTP Client
to Copy the Necessary Files
from Your Desktop to the
Web Server at the
Web Host Provider.
Source: https://docs.microsoft.com/en-us/aspnet/web-forms/overview/older-versions-getting-started/deploying-web-site-projects/deploying-your-site-using-an-ftp-client-cs
Pro Tip:
• Add Google Analytics
(post November 2005)

9. Web masters don’t
need to collaborate
Build?
I’m using PHP, ASP,
PERL, etc
Test locally,
As long as there is
no parsing error,
we’re all good.
Drag and drop files
to Filezilla.
GoDaddy

10. It’s better now, but is it simpler?
https://gist.github.com/rasheedamir/7da0145ae1b5d9889e4085ded21d1acb

11. https://devopedia.org/devops

12. Complexity Is Increasing

14. How does security fit into this?

15. AWS Security Primer
https://news.ycombinator.com/item?id=14628108
https://cloudonaut.io/aws-security-primer/
I have worked extensively with AWS over the last 4 year
and I can barely wrap my head around the scope of
managing security in AWS.
We have an entire department dedicated to security in
our company, and none of them are remotely close to
being experts in AWS security either.
I’m starting to get curious if there even is an expert who
could set up and maintain a bulletproof AWS account.

16. The Evolution of Security
Secure SDLCPenetration Testing DevSecOps

17. https://devopedia.org/devops
Application
Vulnerability
Correlation &
Security Workflows
Security tools
integrating with
Chat Bots
Security sections
on all major social
media platforms
Security tools
integrating with
SCMs
Security tools
integrating with
pipelines
Custom security
linters, and
compiler flags
All the security
tools, we need a
bigger box!
Security/Complian
ce/Infrastructure
as Code, Secret
Management
Secure
Repositories,
golden images,
artefact security
scanning
Cloud Platform
security tools
RASP, NG WAF,
Micro-
segmentation

18. Automated Security Testing
SAST SCA DAST/IASTCCA
CommercialOpenSource
60+

19. Where do these tools live?
Source: https://twitter.com/djschleen

20. The vicious cycle
Tools compound
the issue.
There is too much
security debt
Developers “comply”

21. “The first rule of any technology used in a business is that automation
applied to an efficient operation will magnify the efficiency.
Bill Gates
The second is that automation applied to an inefficient operation
will magnify the inefficiency. ”

22. Security
Developers

24. What has to change then?

25. Psst, this has happened before …
Quality used to face the same
challenges

26. https://blog.sonarsource.com/kill-the-noise-to-change-gear-in-our-code-analyzers

27. Developer Experience, Finally!
User ExperienceUsability Developer Experience

28. Excellent, let’s do this for security!

29. Signals vs Noise
Focus on high-
impact
issues
Don’t add to the noise Ensure the issues have
high accuracy
Security Trivia #213: What is the largest security tool report that has been record
13,000 pages

30. Lost in Translation
Speak the same language
as developers
Issues are useless
until they are fixed
Leverage the right
communication channel
Security Trivia #937: What is the official CWE title for a SQL Injection?
Improper Neutralization of Special Elements used in an SQL Command

31. Make it easy
Tightly integratedAllow developers to
get started in minutes
Provide all the needed
functionality
Security Trivia #23: How many of the 12 leading AST companies - according to
the Gartner Magic Quadrant – have clear pricing information on their website?
1

32. Automated Security Testing - What is better?
Option A Option B

33. Ok, cool – Show me!

34. How can we get ahead for once?
Respect complexity,
but provide focus
Acknowledge that
developers are key
Security has to become
a commodity

35. PAGE35
DEVOPS INDONESIA
Alone We are smart, together We are brilliant
THANK YOU !
Quote by Steve Anderson