Past history, differing world views of their roles, shadow IT development, force-fitting security tools, and past frictions can all can make gelling as a cross-functional team difficult. Yet, it’s essential to achieve fast software creation and delivery, while also ensuring the applications created are secure and risk is always appropriately managed. Where do we start? Start with this webinar featuring Mitch Ashley, security technologist and CEO of Accelerated Strategies Group, who will explore strategies for successful DevSecOps. You will learn: How to successfully implement purpose-built, developer friendly secrets management tools security professionals and dev teams are thrilled to embrace.

1. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED.
March 11, 2020
Webinar Sponsored by

2. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
Speaker Introduction
Mitch Ashley
CEO and Managing Analyst
Security Product CTO, Product Dev
Enterprise and US Dept of Defense
CIO, IT Dev and Security
Cloud-Native, SaaS, Large systems and Mobile

3. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
Accelerated Strategies Group
Analysts
Digital Transformation, DevOps,
Cloud-Native and Cybersecurity
Open Source Business Model
Analyze • Inform • Advise • Realize
Industry Leaders: Analysts, Practitioners,
Speakers and Authors

4. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED

5. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
Dev
+
Security
= ?
DevSecOps

6. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
Code Vulnerability Scanning
Software Composition Analysis
PAM (Privileged Access Management)
Secrets Manager
Confidentiality, Integrity, Availability
Build Run
SecOps
ShiftLeft
Incident Response
Audits
Compliance and Controls
Software Is Eating The World
DevOps
Toolchain
Pipeline
Cloud-Native
PKI
Zero Trust Model
APIs
Attack Surface
Patterns
Containers
Risk Management
Open Source
ATP
Identity Management SRE
Threat Management
Automation
CI/CD

7. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
“What we've got here is…
failure to communicate
- Captain, Cool Hand Luke
Cool Hand Luke, Credit: Warner Bros. Entertainment [Public Domain]

8. Security across the organization
Governance
Zero Trust
Security through Obscurity
Security Controls and Audit
Threat Response
Privacy
Speed and Reliability
Creativity & Design
Deploy - Rapidly Deliver New Capabilities
Automation
Quality
Friction & Delays are the Enemy
Shorten the Dev Cycle
COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
Motivations : Compatibility / Conflict

9. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
DevSecOps & ShiftLeft:
Can Security and Dev Work Together?

10. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
Defining DevSecOps
Credit: Shannon Lietz, Director DevSecOps, Intuit
Creator of DevSecOps.com and DevSecOps Manafesto, 2012-2015

11. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED

12. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED

13. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
”Creating a well-designed cloud Identity Architecture
brings development and security together, creating a
foundation to work together and build upon.”
- CISO, A Fortune 500 Food Services Company

14. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED

15. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED

16. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
- Informal/Team security controls
- Account Sharing
- Across multiple oss/tools/vaults
- Compliance & Policy Violations
Dev Team

17. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
- Informal/Team security controls
- Account Sharing
- Across multiple oss/tools/vaults
- Compliance & Policy Violations
- Lifecycle Management
- Credential injection
- On Prem and Cloud
- Policy Engine, Audit, Compliance
Privileged Access ManagementDev Team

18. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
- Informal/Team security controls
- Account Sharing
- Across multiple oss/tools/vaults
- Compliance & Policy Violations
- Lifecycle Management
- Credential injection
- On Prem and Cloud
- Policy Engine, Audit, Compliance
Privileged Access Management
- Security Champion(s) in Dev
- Lifecycle Management
- Credential injection
- APIs : Dev/Automation Friendly
- High Performance
- Distributed Dev
- Community & DevRel support
Dev <-> DevSecOps
Dev Team

19. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
- Informal/Team security controls
- Account Sharing
- Across multiple oss/tools/vaults
- Compliance & Policy Violations
- Lifecycle Management
- Credential injection
- On Prem and Cloud
- Policy Engine, Audit, Compliance
Privileged Access Management
- Security Champion(s) in Dev
- Lifecycle Management
- Credential injection
- APIs : Dev/Automation Friendly
- High Performance
- Distributed Dev
- Community & DevRel support
Dev <-> DevSecOps
- Building Trust
- Shared Security Responsibilities
- Push button compliance
- On Prem / Hybrid / Multi-cloud
- Shared Security Architectures
- SecOps Friendly
- Cross Education / Learning
Security <-> DevSecOps
Dev Team

20. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED

21. COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED
Mitch Ashley
CEO and Managing Analyst
mitchell@accelst.com
303-881-9353
Accelerated Strategies Group, Inc.
https://accelst.com
https://twitter.com/mitchellashley
https://linkedin.com/in/mitchellashley
https://twitter.com/accelst1

22. KNOWLEDGE WANTS TO BE FREE
COPYRIGHT © 2020 ACCELERATED STRATEGIES GROUP, INC. ALL RIGHTS RESERVED

23. Jason Jones
Product Manager
jjones@beyondtrust.com

24. DISCOVERY • THREAT ANALYTICS • REPORTING • CONNECTORS • CENTRAL POLICY & MANAGEMENT
PRIVILEGED PASSWORD
MANAGEMENT
ENDPOINT PRIVILEGE
MANAGEMENT
SECURE REMOTE
ACCESS
Discover, manage, audit, and
monitor privileged accounts
and sessions of all types
Remove excessive end user
privileges on Windows, Mac,
Unix, Linux and network
devices
Secure, manage, and audit
remote privileged access
sessions for vendors, admins
and the service desk
BEYONDINSIGHT
PLATFORM
Maximize visibility, simplify deployment, automate tasks, improve security and
reduce privilege-related risks with the industry’s most innovative and
comprehensive privileged access management platform
ON-PREMISE CLOUD HYBRID
©BeyondTrust 2020 | 2

25. PAM Components
Privilege Access Management (PAM) Criteria
Privileged Access
Governance & Admin
Formally manage privilege assignment,
periodically review & certify privileged
access, ensure segregation of duties based
on a set of policies
Privileged Session
Management
Manages a privileged user session for
human interaction sessions from initial
authentication through checking a
privileged credential out and back in again
Privileged Task
Automation
Automating multistep, repetitive tasks
related to privileged operations that are
orchestrated and/or executed over a range
of systems
Privileged Account
Discovery & Onboarding
Identify and onboard all privileged accounts
and related credentials in all platforms and
environments
Privileged Access for
Apps & Services
Manages privileged access for nonhuman
use cases such as machines, applications,
services, scripts, processes and
DevSecOps pipelines
Privileged Access
Analytics & Response
Employs analytics (using machine learning)
on privileged account activities to detect
and flag anomalies, including baselining,
risk scoring and alerting
Privileged Credentials
Management
Manage and protect system- and
enterprise-defined shared account
credentials or secrets
Privileged Access
Logging, Reporting
Auditing
Records all single events, including
changes and operations, as part of the
PAM operation
Privileged Elevation &
Delegation Management
Enforcing policies to allow authorized
commands or applications to run under
elevated privileges
Integration with
Adjacent
Systems
Integrate and interact with
adjacent security and
service management
capabilities.
Ease of
Deployment &
Availability
Simplify the
deployment of the PAM
solution while ensuring
availability,
recoverability,
performance and
scalability.
3© BeyondTrust 2019

26. © BeyondTrust 2019
Culture
Shift
to DevOps
to Agile
to Cloud
LEFT
4

27. #
© BeyondTrust 2019
Goal
What are we trying to achieve?
• Greater Speed and Agility in
Continuous Deployment
5

28. #
© BeyondTrust 2019
Goal
What are we trying to achieve?
• Greater Speed and Agility in
(Secure) Continuous Deployment
6

29. © BeyondTrust 2019
Security and IAM teams are tasked with
• Including DEV and PROD
environments
Controlling privileges across the entire infrastructure
• Secure people as well as
automated tools
May require different solutions

30. © BeyondTrust 2019
Gain Consensus
• Be proactive – evaluate and find the right solution for your needs
• Get buy-in from security – would they care about the tech stack? Do they have
any recommendations?
• Beware of tool sprawl – be smart about selecting effective tools for all your use
cases

31. © BeyondTrust 2019
Find the right solution
• Minimize impact to your workflows
• Don’t ignore the needs of security teams
• Make sure it can satisfy audit and business objectives

32. © BeyondTrust 2019
What does success look like?
ü Centralized secrets management – no more islands of security,
increased visibility and control of secrets usage and management
ü Built for security – consolidate all secrets management approaches
into one, built with security as the driving factor
ü Built for agility – Enables the developer, does not inhibit the speed
and agility needed in DevOps workflows
ü Highly available - Does not become a single-point of failure and
slows down or halts work
ü Auditable – Identify security issues and helps to meet compliance
requirements
Strike a balance between, security and agility while achieving compliance

33. © BeyondTrust 2019
DevOps
Secrets Safe
SECURE SECRETS
MANAGEMENT FOR
ENTERPRISE DEVOPS
Secrets Management
Securely store and centrally manage any Secrets (passwords, API
keys, certificates, etc.) for DevOps workflows
Micro-Services
Scalable, fault tolerant, highly available. Built on Docker
containers targeting Kubernetes for deployment
Audit
Audit every action
API
API first / everything
CLI tool for easy API interaction

34. © BeyondTrust 2019
© BeyondTrust 2018
12
Thank You