In this session, you will learn how BNY Mellon is tackling the challenges of DevSecOps at scale by unifying static/dynamic source code scanning, audit and risk analysis tools into a unified workflow by using Jira Software. BNY Mellon’s ability to generate reports from multiple sources had become a time consuming manual process. Jira Software demonstrated the ability to deliver efficiency at reporting and became the solution for tracking security aspects of the SDLC process.

1. Enable DevSecOps using Jira
Software
Saurabh Gupta
March 02, 2019
DevOps Solution Engineer Head of Developer Efficiency
Group
Mostofa Rahman

2. 2 Information Classification: Public
Everyone is
responsible for
security

3. 3 Information Classification: Public
Developer OperationSecurity

4. 4 Information Classification: Public
Application Security

5. 5 Information Classification: Public
Security Scannig
Scanning
SQL Injection Insufficient Input Validation
Information Leakage Code Quality
Cryptographic Issues
CRLF Injection
Cross Site Scripting
Access Control Missing Authentication
Privilege Escalation
HTTP Verb Tampering
Open Source Component
Scanning

6. 6 Information Classification: Public
Plan
Develop
Build
Test
Release
Deploy
Operate
Continuous
Delivery
Continuous
Integration

7. Effect of scan frequency
on flaw persistence
analysis.
STATE OF SOFTWARE
SECURITY VOL 9

8. 8 Information Classification: Public
2017 EMA report
A 2017 EMA report found the
top two benefits
- better ROI improved
- operational efficiencies

9. 9 Information Classification: Public
Security Considerations

10. 10 Information Classification: Public
Takes Time
c

11. 11 Information Classification: Public
Takes Time Adds Cost
c
c
Application Security

12. 12 Information Classification: Public
Takes Time Adds Cost
Reduces
Innovation
c
c
c

13. 13 Information Classification: Public
Automation Opportunity

14. 14 Information Classification: Public
Semi-Automated Process

15. 15 Information Classification: Public
Why Jira

16. 16 Information Classification: Public
Solution Implementation
What we did?

17. 17 Information Classification: Public
Integrated
multiple
scanning
tools with
Jira

18. 18 Information Classification: Public
Scanning Tools Auto Issue Creation
Using any of the methods
- Jira Plugin - Back end Script- Jira Rest API

19. 19 Information Classification: Public
To achieve all the functionalities we integrated our Jira with multiple data
sources
Application Information Source
Scan Request System Due Date Calculation System

20. 20 Information Classification: Public
Standardize received data
ü All fields are populated
ü Right fields are populated
ü Data in the scanning tool and data in
Jira matches
ü Run different models for data
standardization and calculation
according to user needs

21. 21 Information Classification: Public
Standardize received data
ü Recalculating severity based on
CVSS, CWE ID, CVE ID
ü Adding remediation data based on
CWE ID & CVE ID
ü Calculating remediation start date
ü Calculating due date

22. 22 Information Classification: Public
BNY Jira structure
AS = App Sec Jira
AD = App Dev Jira
Jira 1 AS Jira 2 AD Jira 3 AD Jira 4 AD Jira 5 AD

23. 23 Information Classification: Public
Workflow

24. 24 Information Classification: Public
Jira & Beyond

25. 25 Information Classification: Public
Full Architecture
Scanning Tools
Applications
List of
Vulnerabilities
Pushed/Pulled
into Jira
Standardization
task
App Sec Jira
Connect to
external system
for different
parameters
Information
System
Scan
Request
System
Due Date
Calculation
System
Data Validation
and
Required fields
check
Push to other
systems for
analystics
App Dev Jira

26. 26 Information Classification: Public
Challenges Faced

27. 27 Information Classification: Public
Challenges
API Limitations

28. 28 Information Classification: Public
Challenges
API Limitations
Clean Ups

29. 29 Information Classification: Public
Challenges
API Limitations
Clean Ups
Collaboration

30. 30 Information Classification: Public
Challenges
API Limitations
Clean Ups
Collaboration
Infrastructure

31. 31 Information Classification: Public
Challenges
API Limitations
Clean Ups
Collaboration
Scope Changes
Infrastructure

32. 32 Information Classification: Public
Benefits

33. 33 Information Classification: Public
Before
• Scan Applications
• Suggest remediation
• Generate reports
• Communicate reports
After
• Scan Applications
• Suggest remediation
Security Analyst Responsibilities

34. 34 Information Classification: Public
Regulatory

35. 35 Information Classification: Public
One Stop
Shop For ALL
App Dev Team
They do not need to go to different tools to get
vulnerability information. Also, saving the effort to
learn new tool.
Workflow
Both teams can collaborate on the same Jira
issue. Saving time otherwise spent on back and
fro.
App Sec Team
New workflow enables App Sec team to
accept/reject false positive findings.

36. 36 Information Classification: Public
Time saved on generating & communicating report
( 50 X 2 ) = 100 hours per day
Number of
hours spent
Number of
Security Analyst
* via Bloomberg/Payscale/IMG

37. 37 Information Classification: Public
Time saved on generating & communicating report
( 50 X 2 ) X 22 = 2200 hours per month
Number of
hours spent
Number of
Security Analyst
* via Bloomberg/Payscale/IMG

38. 38 Information Classification: Public
Time saved on generating & communicating report
( 50 X 2 ) X 262 = 26,200 hours per year
Number of
hours spent
Number of
Security Analyst
* via Bloomberg/Payscale/IMG

39. 39 Information Classification: Public
25%Of Effort Saved

40. 40 Information Classification: Public
Summary & Takeaways

41. 41 Information Classification: Public
• DevSecOps is the new unicorn, who everyone wants to ride on
• Enables shift left
• Jira software integration with DevSecOps
• Build workflow to simplify the remediation process
• Reduces administrative work
• Satisfy regulator/auditor needs
• Full traceability
• Facilitates ease of access
• Security becomes cheaper and efficient when using DevSecOps
Summary

42. 42 Information Classification: Public
BNY Mellon is the corporate brand of The Bank of New York Mellon Corporation and may be used as a generic term to reference the corporation
as a whole and/or its various subsidiaries generally. Products and services may be provided under various brand names in various countries by
duly authorized and regulated subsidiaries, affiliates, and joint ventures of The Bank of New York Mellon Corporation. Not all products and
services are offered in all countries.
BNY Mellon will not be responsible for updating any information contained within this material and opinions and information contained herein are
subject to change without notice.
BNY Mellon assumes no direct or consequential liability for any errors in or reliance upon this material. This material may not be reproduced or
disseminated in any form without the express prior written permission of BNY Mellon.
©2019 The Bank of New York Mellon Corporation. All rights reserved.
Disclosure