Developing a delivery pipeline means more than just adding automated deploys to the development cycle. To be successful, quality testing of all types must be incorporated throughout the process in order to be sure that problems aren’t slipping through. Those checks must include security, or else you risk quickly and efficiently developing insecure software. Fortunately, the delivery pipeline opens up opportunities to add more security testing to the delivery process. Continuous integration builds can add static analysis tools to test for simple security errors and to check if components with known vulnerabilities are being used. Automated deploys can offer opportunities for automated application scans and scans of the entire system as it will be configured in production. I will introduce several types of open-source and free security testing tools, that can be quickly (and, if needed, quietly) added to a delivery pipeline, without waiting for or spending money on expensive security tools. That reduces the cost of the initial investment in terms of both time and money, and may eliminate some barriers to adding security testing to the process. This session is aimed at people that are trying to build more security into their continuous delivery pipeline. I’ll walk through lessons learned building Continuous Delivery pipelines in different environments and experiences using specific open-source tools to supplement our security testing even when security wasn’t technically our responsibility.

1. Add Security Testing Tools to
Your Delivery Pipeline
Gene Gotimer

2. 2@CoverosGene #STPCon
Coveros helps companies accelerate the delivery of secure, reliable software
using agile methods
Services
• Agile Transformations & Coaching
• Agile Software Development
• Agile Testing & Automation
• DevOps and DevSecOps Implementations
• Software Security Assurance & Testing
Agile, DevOps, Test Automation, Security Training
Open Source Products
• SecureCI –Secure DevOps toolchain
• Selenified – Agile test framework
About Coveros
Areas of Expertise

3. 3@CoverosGene #STPCon
Selected Clients

4. 4@CoverosGene #STPCon
Security Testing

5. 5@CoverosGene #STPCon
Information security means protecting information and
information systems from unauthorized access, use,
disclosure, disruption, modification, perusal, inspection,
recording or destruction.
The key concepts of information security include:
• Confidentiality
• Integrity
• Availability
• + Authenticity
• + Non-Repudiation
Information Security

6. 6@CoverosGene #STPCon
Often put off until late or ignored completely
Security Testing
Fix security
issues and
delay release?
Release on time
and accept
security risks?

7. 7@CoverosGene #STPCon
“Security is not an investment that provides a return,
like a new factory or a financial instrument. It's an
expense that, hopefully, pays for itself in cost
savings. Security is about loss prevention, not
about earnings. The term just doesn't make
sense in this context.”
-- Bruce Schneier, Schneier on Security
Return on Investment
https://www.schneier.com/blog/archives/2008/09/security_roi_1.html

8. 8@CoverosGene #STPCon
Security in the
Delivery Pipeline

9. 9@CoverosGene #STPCon
1. Use tools to help detect the obvious security problems
2. Remediate
3. Search for less obvious security problems
4. Repeat
Security Testing Process
Better
security
process
Fewer
obvious
security
issues
Better
security
Time to find
less obvious
security
issues

10. 10@CoverosGene #STPCon
“If you think technology can solve
your security problems,
then you don't understand the
problems and you don't understand
the technology.”
-- Bruce Schneier, Secrets & Lies
Security Tools

11. 11@CoverosGene #STPCon
Do just enough
of each type of testing
early in the pipeline
to determine if
further testing is justified.
Incorporate Security Testing

12. 12@CoverosGene #STPCon
Tools to Consider
Adding to the Process

13. 13@CoverosGene #STPCon
It is easier to protect less
mvn dependency:tree
mvn dependency:analyze
mvn com.ning.maven.plugins:
maven-dependency-versions-check-plugin

14. 14@CoverosGene #STPCon
… and harder to secure
Poor quality code is harder to maintain

15. 15@CoverosGene #STPCon
Make sure your code is actually tested
Mutation testing
public int foo(int i) {
i--;
return i;
}

16. 16@CoverosGene #STPCon
Keep libraries up-to-date

17. 17@CoverosGene #STPCon
User role testing
Negative testing
… what should users not be able to do?

18. 18@CoverosGene #STPCon
OWASP ZAP
Use a proxy
… and piggy-back on functional tests
passive proxy
active scanner
fuzzer

19. 19@CoverosGene #STPCon
… and test that through practice
Repeatable, reliable deployments

20. 20@CoverosGene #STPCon
… before and after installing software
Scan the system

21. 21@CoverosGene #STPCon
Scan the web server configuration

22. 22@CoverosGene #STPCon
Scan the web application

23. 23@CoverosGene #STPCon
… don’t forget the infrastructure
Scan all the systems

24. 24@CoverosGene #STPCon
… even on development and test systems
Protect against hackers

25. 25@CoverosGene #STPCon
Audit yourself

26. 26@CoverosGene #STPCon
Keep packages up-to-date

27. 27@CoverosGene #STPCon
… even if you just watch the trends
Test performance

28. 28@CoverosGene #STPCon
… for security and performance
Test the database

29. 29@CoverosGene #STPCon
Find more tools

30. 30@CoverosGene #STPCon
Do just enough of each type of testing early in the
pipeline to determine if further testing is justified.
Find easy-to-fix problems as early as possible.
Less, cleaner code is safer.
Reduce your footprint and increase your quality.
Audit yourself to avoid any late surprises.
It won’t replace an official audit (at first), but it will
help build confidence.
Some testing is better no testing.
Even just watching trends of some token tests can be
valuable.
#Coveros5

31. 31@CoverosGene #STPCon
A little better is
still better.
Keep improving.
Don’t expect perfectly secure

32. © COPYRIGHT 2018 COVEROS, INC. ALL RIGHTS RESERVED. 32@CoverosGene @rkenney525
Washington, DC Training
DevOps Week DC
December 10-14
• Leadership Track
• Technical Track
• Hands-on Workshops
• Hands-on Docker and Kubernetes
• Hands-on Chef
• Implementing Pipeline as Code Using Jenkins
• ICAgile Certification
Use code COVGENE to save 20%
© COPYRIGHT 2018 COVEROS, INC. ALL RIGHTS RESERVED.@CoverosGene #STPCon
https://goo.gl/QD2z2g

33. 33@CoverosGene #STPCon
Questions?
Gene Gotimer
gene.gotimer@coveros.com
@CoverosGene