1.
DevSecOps
“Everyone is responsible for security”

2.
Quick look at DevOps
DevOps is a set of practices that automates the processes
between software development and IT teams, in order
that they can build, test, and release software faster and
more reliably.
It's a firm handshake between development and
operations that emphasizes a shift in mindset, better
collaboration, and tighter integration. It unites agile,
continuous delivery, automation, and much more, to help
development and operations teams be more efficient,
innovate faster, and deliver higher value to businesses and
customers.
Source: https://en.wikipedia.org/wiki/DevOps

3.
Better, faster, cheaper software with DevOps
but is it secure?
COMPANY DEPLOY
FREQUENCY
DEPLOY
LEAD TIME
RELIABILITY CUSTOMER
RESPONSIVENESS
AMAZON 23000 / day Minutes High High
GOOGLE 5500 / day Minutes High High
NETFLIX 500 /day Minutes High High
FACEBOOK 1 / day Minutes High High
TWITTER 3 / week Minutes High High
TYPICAL
ENTERPRISE
Once in every 9
Months
Months or quarters Low / Medium Low / Medium

4.
Meet DevSecOps
DevSecOps seeks to achieve greater efficiency
and productivity by incorporating security
principles within DevOps process.
DevSecOps enables organisations to
deliver the secure software at DevOps
speed.
Source:
https://www.checkmarx.com/wp-content/uploads/2016/07/Dev-Software-releases-.png

5.
DevSecOps in 3 key categories
ProcessesCulture Technologies

6.
Culture
● Communication and transparency
● High trust environment
● Continuous improvement
● Everyone is responsible for security
● Automate as much as possible
● Everything as code
○ Infrastructure as code
○ Security as code
○ Compliance as code

7.
Processes
Secure SDLC

8.
How do we integrate AppSec pipeline in DevOps?

9.
How do we integrate AppSec pipeline in DevOps?
AppSec Pipeline
Unit Tests
Integration Tests
Code Analysis
Create Docker Image
Start Docker Image
Load Tests
Deploy
Load Test Server
Test Production
git
DevOps Pipeline

10.
Technologies - Incorporate the security principles in DevOps
SDLC Technologies
Requirements -
Code SAST, IDE Plugins
Test Gauntlt, DAST (Dradis, Scout2, OpenVas,
ZAP)
Configure Everything as code
Maintenance Patch Management (Phoenix)
Monitor Auditing, Attack, RASP, ELK

11.
Trainings
Secure Coding Practices
It will help organisations to develop the secure code in order to eliminate the risks and threats at
development stage.
● Secure code trainings
● Code review
● Best coding practices

12.
Code
DevSecOps enables developers to write the secure code by integrating the security plugins in
IDE.
SAST - Secure code analysis tool, also referred to as Static Application Security Testing tools,
designed to analyze the source code to help find the security flaws.
● Sonarqube
● Checkmarx
● IBM App Scan

13.
Test - Automate as much as possible.
DAST - A dynamic analysis security testing tool, or a DAST test, is an application security solution
that can help to find certain vulnerabilities in web applications while they are running in
production
Gauntlt - Gauntlt provides hooks to a variety of security tools and puts them within reach of
security, dev and ops teams to collaborate to build rugged software. It is built to facilitate testing
and communication between groups and create actionable tests that can be hooked into your
deploy and testing processes.
● Curl
● nmap
● sqlmap
● Garmr
● sslyze

14.
Configure
Everything as code
● Infrastructure as code
● Security as code
Platform requirements, server hardening etc. should not be a problem in today’s world. We
should learn to codify as much as possible. It enables Dev, Sec and Ops team to perform actions
on a single click.
● Docker - Containerized applications
● Kubernetes - Automated deployment, scaling and management of containerized
applications

15.
Maintenance
Patch Management
Phoenix deployment strategies can help organisation to quickly deploy the completely new
instance of the application that is patched to the production environment and parallely destroy
the existing instance.
It would help organisation to eliminate all the configuration drift or even technical issues at
DevOps speed.

16.
Monitor
Ability to monitor the secure SDLC.
● Auditing
● Attack Visibility

17.
RASP
Runtime application self-protection security (RASP)
It is a security technology that is built into an application and can detect and then prevent
real-time application attacks. RASP prevents attacks by “self-protecting” or reconfiguring
automatically without human intervention in response to certain conditions (threats, faults, etc.)

18.
ChatSecOps
ChatSecOps enables organisations to make the safe service portals which are being used for
chatting. For eg: Slack, HipChat etc.
Ex: Imagine a simple chat command to push the code to QA and it’s done.

19.
Thank You