Securing DevOps lifecycle by Mudito Adi Pranowo & Jevon Hura

1. PAGE
1
DEVOPS INDONESIA
PAGE
1
DEVOPS INDONESIA
Mudito Adi Pranowo & Jevon Hura
Dymar
THALES
Jakarta, 19 Januari 2022
DevOps Indonesia Meetup (ONLINE)
Securing DevOps Lifecycle

2. www.dymarjaya.co.id
Securing DevOps LifeCycle
DevOps Indonesia 51 - 19/1/2022
Mudito Adi Pranowo
Product Manager
PT Dymar Jaya Indonesia
mudito@dymarjaya.co.id

3. Pembicara
• Pengalaman 13+ tahun di kriptografi praktis untuk
bisnis dan solusi keamanan data digital.
• Spesialis pada desain dan implementasi keamanan
data digital di Perbankan, Institusi Finansial, Fintech,
e-Commerce, Pemerintahan, dan banyak lagi.
• Product Manager & Marketing di Dymar.
• Kontak: mudito@dymarjaya.co.id
Mudito Adi Pranowo

4. Profil Perusahaan
PT Dymar Jaya Indonesia
● Visi: Trusted Partner in Data Security.
● Misi: SolutionProviding world-class data security
solution with trusted local support.
● Berdiri sejak 1988, fokus di bidang Keamanan Data.
● Menyediakan dan implementasi solusi data security di
Institusi finansial, perbankan, pemerintahan,
manufaktur dan lainnya.
● Implementasi di lebih dari 80 bank di Indonesia.
Alamat Kantor:
Soho Capital @PodomoroCity, 31st floor,
Suite SC 3102-3103. Jl. Let. Jend. S. Parman
Kav. 28. Jakarta Barat 11470, Indonesia
www.dymarjaya.co.id

5. Pelanggan Dymar

6. Technology Partner Dymar
● Thales merupakan Worldwide leader untuk solusi data
protection.
● Mencakup solusi: encryption, advance key
management, authentication dan key management.
“Securing the world's most sensitive data
for over 40 years”
● PT Dymar Jaya Indonesia >25 tahun partnership
dengan Thales.
● PT Dymar Jaya Indonesia merupakan Platinum Partner
dari Thales.

7. Securing DevOps LifeCycle with Continuous Trust
https://cpl.thalesgroup.com/resources/encryption/
securing-devops-lifecycle-with-continuous-trust-
white-paper

8. What is DevOps?
DevOps is a set of practices and tools that enables teams to
develop and deliver software applications faster and more
reliably.
DevOps, which blends the words “development” and
“operations,” is a cultural movement that breaks down
organizational barriers by bringing software engineers and
operations managers together to deliver the best
possible application user experience.
“DevOps is a cultural and
professional movement, focused
on how we build and operate high
velocity organizations, born from
the experiences of its
practitioners.”
- Nathen Harvey
, Developer
Advocate, Google

9. DevOps and Security
While there are many business advantages to DevOps, security remains a significant challenge that
impacts the integrity and trustworthiness of code, software builds, firmware, and data.
As a result, security and quality assurance teams must be tightly integrated with DevOps to make the
software development lifecycle both efficient and secure. Secure DevOps ensures the trustworthiness
of code, finished software, and data throughout the DevOps lifecycle.

10. Safety First

11. Benefits of a DevOps Approach
Speed
Moving at a high velocity to innovate and adjust to changing markets is
critical to business competitiveness. The DevOps model allows developers
and operations teams to increase the frequency and pace of software
updates, enabling a constant flow of new features.
In fact, according to a study, top-performing DevOps teams deploy code
to production 208 times more frequently than low-performing adopters.
DevOps requires trusting that the code has not been tampered with and
malware has not been introduced during the build process.
Securing a fast DevOps pipeline relies on code signing, secrets
management, container security, authentication, and IaaS/PaaS cloud
security.

12. Benefits of a DevOps Approach
Reliability
DevOps deployments are more reliable and resilient, experiencing less
downtime. In fact, skilled DevOps teams experience one-third of the failure
rates of low-performing DevOps teams.
Security, such as code testing and software composition analysis, are
implemented early in the DevOps lifecycle to reduce the cost and time to
address security bugs and breakdowns later in the delivery process.
Manual and automated testing and software scanning tools require strong
authentication, authorization, and access controls.

13. Benefits of a DevOps Approach
Scalability
DevOps models leverage automation and orchestration that allow
teams to rapidly scale compute resources, load balancing, and
application services.
For example, infrastructure as code allows companies to manage
development, testing, and production environments more efficiently and
programmatically using APIs.
Scaling DevOps deployments securely requires strong key management,
PKI and certificate management, encryption of data-at-rest and data-in
motion, authentication, and access controls.

14. Benefits of a DevOps Approach
Collaboration
DevOps promotes a culture of collaboration and sharing between the
software development and operations teams.
The use of common tools and shared goals allows teams to work
together efficiently to develop and deploy.
Trusted collaboration requires end-user and machine-to-machine
authentication, roles-based access controls, and secure
communications.

15. Securing DevOps and CI/CD Pipeline
Securing the DevOps environment is critical to the success of business-driven digital
transformation.
Secure DevOps requires strong key management, certificate management,
authentication, PKI, access controls, code signing, and signature verification to ensure
the trustworthiness and integrity of software, VMs, and containers.

16. Securing DevOps and CI/CD Pipeline
While DevOps teams can use dynamic and static application security testing to check the code and
binaries for misconfigurations or the presence of known vulnerabilities, if the system does not have a
consistent and centralized approach to key and certificate management, the DevOps configuration
management and orchestration tools will be very difficult to trust.
For example, if the signatures used to sign code were created
based on a self-signed digital certificate using keys that were
generated insecurely, then a sophisticated and persistent
attacker could impersonate the author of the code and
potentially introduce malware.
Similarly, if the configuration management tools used to
manage the CI/CD pipeline, IaaS infrastructure, Kubernetes
clusters, and network encryption are using secrets, machine
identities, certificates, and tokens that are based on insecurely
generated private keys, then the deployed software and
containers should not be trusted.

17. Potential Vulnerabilities & Risk in DevOps
The rapid adoption of DevOps and DevSecOps has created a
complex software development environment that is fraught
with vulnerabilities and risks.
Gaps in DevOps security can lead to application vulnerabilities
that result in:
• Code injections
• Broken authentication
• Using components with known vulnerabilities
• Stolen machine identities, keys and certificates
• Sensitive data exposure
• Weak authentication
• Insecure key generation and storage
• Lack of a chain of trust
• Man-in-the-middle attacks.

18. Establishing a Chain of Trust Across DevSecOps
Establishing a chain of trust across the
DevSecOps tool chain requires a
consistent and centralized approach to
key and certificate management.
Development, testing, and production
environments rely heavily on machine
identities, secrets, tokens, keys, and
digital certificates that must be trusted.
Hardware Security Modules (HSM) and
Key Management Systems (KMS) are
able to support advanced security
features supported by DevOps tools that
manage the CI/CD pipeline, cluster
orchestration, TLS, and code signing.

19. www.dymarjaya.co.id
Thank you
DevOps Indonesia 51 - 19/1/2022
Mudito Adi Pranowo
Product Manager
PT Dymar Jaya Indonesia
mudito@dymarjaya.co.id

20. DevSecOps
A Primer for Our Journey Together
with Thales Data Protection
Part of the Thales Data Security
By : Jevon (SE Thales Cloud Protection and Licensing)

21. • DevOps IS NOT
• a single person
“Shaun and Mary are NOT, themselves, DevOps”
• a specific role
“Melissa was hired on as the DevOps person”
• a separate team
Now that we have developed the app, we give it to the “DevOps group” to do
their part
• a toolset
Our manager just approved that “DevOps application”. We are now DevOps!
What is DevOps?

22. • DevOps IS
• a Culture of Collaboration
• Developers + Operations working together
• Automate processes between them
• From Build to Test to Deployment to Monitoring and Alerting
• High Consistency
• High Quality
• a process of Continual Improvement
• through Automation
• through Monitoring
• Compatible with Enterprise deployments as well as Cloud deployments
What is DevOps?

23. DevOps -> DevSecOps

24. 5

25. Thales © 2019 All rights reserved
USE-CASES
DevSecOps

26. 7
7
Modern Solution Architecture
Vault Credentials
No Solution
Hardcode Credentials
Secretless Broker Architecture
Isolate Applications
Secure – manage credentials in vault with
comprehensive audit
Simpler – Developers can focus on writing code
More Secure – Applications cannot leak what they
don't have
UserName = “app”
Password = “y7qeF$1”
Host = “10.10.3.56”
ConnectDatabase(Host,
UserName, Password)
At Risk – Widely exposes credentials
Potential for
App to Leak
Secrets
Solution evolution

27. 8
CipherTrust
Manager
Encryption, using
RESTful APIs
Container
Access using the
key stored in
Conjur
Conjur Server
Encryption
Secretless Broker

28. 9
What’s Possible
CipherTrust Manager
OpenSSL Engine
PKCS #11
REST, KMIP, Java,
C, .NET, PKCS
#11
OpenSSL Engine/PKCS
#11
REST, KMIP, Java,
C, .NET, PKCS
#11
PKCS #11
OpenSSL Engine
PKCS #11
Discovery
and
Classification
Transparent
Encryption
Database
Protection
Application
Data
Protection
Tokenisation
Enterprise
Key
Management
Cloud
Key
Manager
REST, KMIP, Java,
C, .NET, PKCS
#11
Luna 7 HSM

29. 10
Working Together
Proven security solutions that protect data to the highest levels
FIPS 140-2 Level 3, Common Criteria EAL 4+
Proven integrations and patterns with RedHat and CyberArk to
reduce “Technical Debt”
Trusted Kubernetes for the enterprise, Kubernetes-native
runtimes
Automation capabilities for organisation-wide adoption
Identity Security and secrets management for the enterprise
Secretless brokering for containerised applications

30. 11
Establishing a Chain of Trust Across DevSecOps

31. 12
Thales DevSecOps Ecosystem Partners

32. 1
3
Thank You!

33. Stay Connected With Us!
t.me/iddevops
DevOps Indonesia
DevOps Indonesia
DevOps Indonesia
@iddevops
@iddevops
DevOps Indonesia
Scan here

34. PAGE
34
DEVOPS INDONESIA
Alone We are smart, together We are brilliant
THANK YOU !
Quote by Steve Anderson