DevOps teams are often cautious when adding security to their automated pipelines because security tools have a bad reputation of being slow and blocking delivery. There are four must have controls that need to be integrated when moving towards DevSecOps. This talk digs into these four controls.

1. October 17, 2018
Opinions expressed are solely my own and do not express the views or opinions of my employer.
DISCLAIMER

2. In the beginning...

3. sunrise
Photo by Patrick Hendry on Unsplash

4. Photo by Annie Spratt on Unsplash
DevOps - Just fine the way it was

5. Security?
Photo by Praveesh Palakeel on Unsplash

6. Photo by CloudVisual on UnsplashPhoto by Annie Spratt on Unsplash

7. This is a story about how not to
piss off a DevOps team

8. DJ Schleen, CNDA, CEH, CPT, CDSOE, CDOF. CTPRP, vBSIMM, ITIL
DevSecOps Evangelist and Security Architect
Don’t Fear the
of the DevSecOpalypse
@djschleen

9. What DevOps teams see...

10. War Death Conquest Famine

11. What Security sees...

12. CVA SAST SCA DAST

13. When Security gets involved...

14. Photo by Kyle Glenn on Unsplash

15. Dynamic Analysis and
Security Testing
Famine @djschleen

16. With DAST you may as well be starving. Slow, not much
value, and like watching paint drying. @djschleen
DASTBuild
Develop
WaitStage Wait...

17. Static Analysis and
Security Testing
Death @djschleen

18. Θάνατος/Thanatos
Thanos
Seriously… Thanos means Death
@djschleen
Photo by DJ Schleen

19. My entire chapter in “Epic Failures of DevSecOps” is about
SAST. It will kill your pipeline if not implemented properly.
SAST Build
Develop
@djschleen
Wait
Icons courtesy of Freepik, OCSA, Yannick

20. Container Vulnerability
Analysis
War @djschleen

21. It’s like opening the hood of an old car and seeing which
parts are rusted and which parts aren’t. @djschleen
CVABuild
Develop
Package
Icons courtesy of Freepik, OCSA, Yannick

22. Declare war on your vendors. What’s that pile of junk
you just gave us? A trojan? @djschleen
CVA
or
Icons courtesy of Smashicons
Vendor Image

23. Software Composition
Analysis
(aka Open Source Software Management)
Conquest @djschleen

24. Legen-dary...
@djschleen

25. Quick win of ass-kickery. Fast, low false positives,
and a massive risk reducer. @djschleen
Icons courtesy of Freepik, OCSA, Yannick
SCA Build
Develop
Win

26. Stop
@djschleen

27. Collaborate
@djschleen

28. Listen
- Vanilla Ice
@djschleen

29. Wait… There’s another horseman
(Only Hackers need to fear this one…)
@djschleen

30. Dawn of the Planet of the Apes
Chaos

31. Thank you!
Grab a pre-release copy of our new book
“Epic Failures of DevSecOps”
https://t.co/u8ErG1zshD
https://devxops.ninja
@djschleen
@djschleen

32. October 17, 2018

33. October 17, 2018

34. October 17, 2018
Thank You Supporters

35. October 17, 2018
Meet me in the Slack channel for Q&A
bit.ly/addo-slack