In this session we will cover the ‘table stakes’ or the minimum foundational components in what it means to deliver high quality secure software in today’s software driven world. From gaining visibility into the software supply chain to building empathy with engineering teams through DevSecOps practices we will dive through what it takes to play the bare minimum hand and how that contributes to improving value-velocity and faster adoption of more advanced techniques such as Chaos Engineering.

1. DevOps
Table Stakes
“The minimum amount required to play the
game”

2. CONTINUOUS VERIFICATION

3. 3
About A.A.Ron
● CTO of Stealthy Startup
● Former Chief Security Architect
@UnitedHealth responsible for security
engineering strategy
● Led the DevOps and Open Source
Transformation at UnitedHealth Group
● Former (DOD, NASA, DHS, CollegeBoard )
● Frequent speaker and author on Chaos
Engineering & Security
● Pioneer behind Security Chaos Engineering
● Led ChaoSlingr team at UnitedHealth

4. In this Session we will cover

5. Our systems have evolved
beyond human ability to
mentally model their behavior.
5

6. Our systems have evolved
beyond human ability to
mentally model their behavior.
6
everyone

8. Circuit Breaker Patterns
8
Continuous
Delivery
Distribute
d Systems
Blue/Green
Deployments
Cloud
Computing
Service Mesh
Containers
Immutable
InfrastructureInfracode
Continuous
Integration
Microservice
Architectures
API Auto Canaries
CI/CD
DevOps
Automation Pipelines
Complex?

9. 9
Mostly
Monolithic
Requires
Domain
Knowledge
Prevention
focused Poorly
Aligned
Defense
in Depth
Stateful in
nature
DevSecOps
not widely
adopted
Security?
Expert
Systems
Adversary
Focused

10. Software
Security Supply
Chain
1

11. Secrets
Management
2

12. Security
Integrated in
CI/CD
3

13. @aaronrinehart | @wickett | #devopsgiant | DOES 2017
Gauntlt: “Be Mean
to Your Code”
13

14. @aaronrinehart | @wickett | #devopsgiant | DOES 2017
Automation is
Important but “Don’t
be Distracted by it”
14
Emphasize ….
Simplification &
Standardization
….over Automation

15. @aaronrinehart | @wickett | #devopsgiant | DOES 2017
Embrace Failure as
a Friend
15
Plan and expect failure as a
positive outcome. Encourage
teams to fail quickly and learn
from them.

16. System
Observability &
Software
Security
Logging
4

18. Continuous
Security
Verification
5

19. Continuous
SECURITY
Verification

20. Security
Engineering

21. “Chaos Engineering is the discipline of
experimenting on a distributed system
in order to build confidence in the
system’s ability to withstand turbulent
conditions”

22. Build Confidence
in
What
Actually Works

23. Stop looking for better answers and
start asking better questions.
- John Allspaw

24. What is the system actually doing?

25. What is the system actually doing?
Has it done this before?

26. What is the system actually doing?
Has it done this before?
Why is it behaving that way?

27. What is the system actually doing?
Has it done this before?
Why is it behaving that way?
What is it supposed to do next?

28. What is the system actually doing?
Has it done this before?
Why is it behaving that way?
What is it supposed to do next?
How did it get into this state?

29. How does My Security
Really Work?

30. What evidence do I
have to prove it?

31. Q&A
@aaronrinehart aaron@verica.io

32. Thank you!
@aaronrinehart aaron@verica.io