During the past two decades we have started shifting from the waterfall project planning to more agile organization of our software development practices. Utilizing Scrum, Kanban and Lean practices we are now better prepared for the unknown and can faster react to the changing requirements, product plans and team rotation. But it seems that the security requirements for the software we are producing are still living in the "Waterfall World". They are usually being verified as the last step of the development, introducing further delays or simply leaving the deployed software with more and more vulnerabilities. Learning the lessons from how the Development and Operations teams joined their forces together mobilizing themselves under a common DevOps umbrella, security teams don't want to stay behind. They see it as a chance to get more involved at each step of the software development in the Agile fashion. Hence DevSecOps approach, closing the gap between the security teams and the rest of the engineering organization.

1. DevSecOps: The Final Frontier?
Building Secure Software in an Agile Organization
j-labs software specialists | Cracow | Warsaw | Munich j-labs.pl blog.j-labs.pl talk4devs.j-labs.pl
Kuba Sendor
Delivery Manager @ j-labs

2. 2Webinar Agenda
1.A brief history of where DevSecOps came from
2.So what DevSecOps really is?
3.To boldly go: transition into DevSecOps
Image source: omado.ca

3. 3Brief intro
since 2019: Delivery Manager, j-labs in Kraków
2010-2014: Security & Trust Research,
SAP Labs France in Sophia-Antipolis
2014-2018: Corporate Security, Yelp in London
and San Francisco
Jakub „Kuba” Sendor

4. przejście
Brief history of
DevSecOps

5. 5Waterfall approach
Requirements
Design
Implementation
Verification
Maintenance
Security :(
perhaps someone thought about security here
but usually it was here

6. 6Secure Software Development Lifecycle
Source: microsoft.com

7. 7Agile
PLAN
DESIGN
DEVELOPTEST
RELEASE
FEEDBACK

8. 8DevOps
Source: craftware.pl

9. 9DevSecOps
Source: omado.ca

10. 10DevSecOps – The Final Frontier?
Source: brisazdevops.org

11. przejście
Why do we need
DevSecOps?

12. 12DevSecOps Manifesto
Leaning in over Always Saying “No”
Data & Security Science over Fear, Uncertainty and Doubt
Open Contribution & Collaboration over Security-Only Requirements
Consumable Security Services with APIs over Mandated Security Controls & Paperwork
Business Driven Security Scores over Rubber Stamp Security
Red & Blue Team Exploit Testing over Relying on Scans & Theoretical Vulnerabilities
24x7 Proactive Security Monitoring over Reacting after being Informed of an Incident
Shared Threat Intelligence over Keeping Info to Ourselves
Compliance Operations over Clipboards & Checklists
Source: devsecops.org

13. 13DevSecOps Manifesto
Leaning in over Always Saying “No”
Data & Security Science over Fear, Uncertainty and Doubt
Open Contribution & Collaboration over Security-Only Requirements
Consumable Security Services with APIs over Mandated Security Controls & Paperwork
Business Driven Security Scores over Rubber Stamp Security
Red & Blue Team Exploit Testing over Relying on Scans & Theoretical Vulnerabilities
24x7 Proactive Security Monitoring over Reacting after being Informed of an Incident
Shared Threat Intelligence over Keeping Info to Ourselves
Compliance Operations over Clipboards & Checklists
Source: devsecops.org

14. Source: cnbc.com

15. przejście
So what DevSecOps
really is?

16. 16The Six Pillars of DevSecOps – Cloud Security Alliance
Pillar 1: Collective Responsibility
Pillar 2: Collaboration and Integration
Pillar 3: Pragmatic Implementation
Pillar 4: Bridging Compliance and Development
Pillar 5: Automation
Pillar 6: Measure, Monitor, Report and Action
Source: cloudsecurityalliance.org

17. 17Collective Responsibility
Security as a first-class citizen
• Board-level interest in your organization
• CISO – Chief Information Security Officer
Source: linkedin.com

18. 18Collective Responsibility
Awareness and education
• Awareness training for everyone
• Specific training for specific roles
Source: owasp.org

19. 19Collective Responsibility
Everyone is responsible
• Executives
• Non-technical roles

20. 20Collaboration and Integration
Security as an enabler rather than a blocker
Source: cnet.com

21. 21Collaboration and Integration
Threat modeling
• Identify the threats early and often
• Don’t overthink it!
Source: owasp.org

22. 22Pragmatic Implementation
• Not all of the tools and approaches maybe
suitable
• Start small and build on top of that

23. 23Bridging Compliance and Development
• Security by design
• Architecture reviews
• Code audits

24. 24Automation
• Right tools
• Integration with your existing tools
• Process automation

25. 25Measure, Monitor, Report and Action
• Deployment frequency
• Vulnerability patch time
• Test coverage

26. przejście
Journey to DevSecOps

27. 27
Start small –
iterate fast
Journey to DevSecOps
Get the right tools
Be inclusive and
involve everybody
Measure and don’t be
afraid of course
correction

28. 28Start small – iterate fast
Education
• Awareness training
• Security conferences
Threat modeling
• You already know how to do it!

29. 29Elevation of Privilege Card Game
Source: agilestationery.co.uk

30. Source: owasp.org

31. Source: amazon.com

32. 32Be inclusive and involve everybody
• „Security Heroes”
• Dedicated people in each
team/department
• Fun activities
• Hacktober

33. Source: facebook.com

34. Source: cybersecuritymonth.eu

35. 35Get the right tools
• Incident response
• Security Incident and Event
Management
• Static code analysis
the list goes on and on...

36. Source: elastic.co

37. 37Measure and don’t be afraid of course correction
• Measure
• Vulnerabilities detected
• Number of incidents
• Mean time to respond
• Retrospect
• Take action!

38. 38
Start small
In summary
Plan and act
Educate everyone
Actually
nothing new...

39. 39Thank you!
Jakub „Kuba” Sendor
Delivery Manager
jakub.sendor@j-labs.pl
+48 794 363 660
Luise-Ullrich-Straße 20
80636 München
ul. Zabłocie 43a
30-701 Kraków
al. Armii Ludowej 26
00-609 Warszawa
j-labs.pl
blog.j-labs.pl
talk4devs.j-labs.pl