Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (14)
Similar to Steering a Bullet Train: Owasp Latam Tour BA 2015
Similar to Steering a Bullet Train: Owasp Latam Tour BA 2015 (20)
Recently uploaded
Recently uploaded (20)
Steering a Bullet Train: Owasp Latam Tour BA 2015
- 1. Steering a Bullet Train Santiago Kantorowicz Security Technical Leader at MercadoLibre bnbsec.blogspot.com
- 2. About Me? Information Security Technical Leader at MercadoLibre Software Security + Infrastructure Assessment Pen Testing & Development Background
- 3. Agenda Traditional SDLC MercadoLibre’s Context MercadoLibre goes Devops Security at Mercadolibre 5 years ago Our SDL approach
- 4. Agenda Traditional SDLC MercadoLibre’s Context MercadoLibre goes Devops Security at Mercadolibre 5 years ago Our SDL approach
- 5. Traditional SDLC Design Code Test Security Deploy 1 big release at a time
- 6. Traditional SDLC Not always Design Code Test Security Deploy
- 7. Traditional SDLC Matured Design Code Test Deploy QA Security Still: 1 big release at a time
- 8. Traditional Development Cycle Developers ≠ Ops Developers access to production
- 10. Agenda Traditional SDLC MercadoLibre’s Context MercadoLibre goes Devops Security at Mercadolibre 5 years ago Our SDL approach
- 11. #1 e-commerce platform in Latin America #8 in the World > 2600 employees Who we are
- 12. Who we are
- 16. Agenda Traditional SDLC MercadoLibre’s Context MercadoLibre goes DevOps Security at Mercadolibre 5 years ago Our SDL approach
- 19. Today’s Picture >100 deploys a day Developers ~ Operations (24/7) Developers Access to production Technology Diversity Developers >> AppSec
- 20. Today’s Picture “Desarrollamos a velocidad casi de Hackaton”
- 21. Today’s Picture
- 22. Agenda Traditional SDLC MercadoLibre’s Context MercadoLibre goes Devops Security at Mercadolibre 5 years ago Our SDL approach
- 23. How InfoSec was 5 years ago at Mercadolibre Operational tasks Security Feature? Not involved in product development
- 24. How does DevOps affects InfoSec No formal security stage Security unaware of deploys No formal kick-off of every initiative
- 25. Agenda Traditional SDLC MercadoLibre’s Context MercadoLibre goes Devops Security at Mercadolibre 5 years ago Our SDL approach
- 26. Analysis Design Coding Testing How we envision AppSec in DevOps
- 27. Analysis Design Coding Testing How we envision AppSec in DevOps
- 28. Premises Security follows the business Explain impact in their words Be open and friendly! Choose your battles: Tradeoffs! Get feedback & iterate more effective
- 29. Security Training Threat Modeling Security Code Review Secure Coding Culture Development Security Features Static Code Analysis Security Testing Internal Security Testing External Vulnerability Fixing Vulnerability Tracking WAF How we envision AppSec
- 30. How we envision AppSec Security Training Culture Development
- 31. Train every developer! (Mandatory) 8 hour Theory/Practical Training Developer oriented Examples in dev language they use Security Training Culture Development
- 32. Workshops Threat Modeling Hacking Infrastructure Browser Exploitation Dynamic Security Testing Whatever devs need to know! or may awake interest! e-learnings: Short! Security Training Culture Development
- 34. Security Training Culture Development Communicate Security News Vulnerabilities Breaches Invite Key Developers to security Events & conferences.
- 35. How we envision AppSec Security Training Threat Modeling Secure Coding Culture Development Security Features
- 36. http://www.microsoft.com/en-us/download/details.aspx?id=12379 http://www.microsoft.com/sdl/ Design stage Prevent vulnerabilities Adapt Threat Modeling to your organization Teach how to do it and ask for invites Threat Modeling
- 38. Security Security Focal Points … Threat Modeling
- 39. Security Focal Points Threat Modeling Volunteers Ask managers Start with Devs you know Next: critical Projects
- 40. Threat Modeling AppSec can’t be everywhere Define criteria for critical projects Set SFP in each of those Appsec participates in threat models of Critical Projects
- 41. Secure Coding Security Features Training! Security Checklists (Pre/Post) OWASP TOP 10 Security Advisor position
- 42. How we envision AppSec Security Training Threat Modeling Security Code Review Secure Coding Culture Development Security Features Static Code Analysis Security Testing Internal
- 43. Manual tests! Abuse Cases (informal Brainstorm) CI security integration Security Testing Internal
- 44. Security Code Review Agile Guidelines: Adapt to your organization Give alternatives Checklists of what to look for
- 45. Listener Static Code Review Static Code Analysis
- 46. Centralized + InfoSec view + All Source code - Another tool developers need to add to their routine. Decentralized + Integrated with CI + Developers don’t have to look at another tool, it’s in their every day. - Different CI solutions, sometimes not available. - Non centralized view of InfoSec Static Code Analysis
- 47. Security Training Threat Modeling Security Code Review Secure Coding Culture Development Security Features Static Code Analysis Security Testing Internal Security Testing External Vulnerability Fixing Vulnerability Tracking How we envision AppSec
- 48. Security Testing External Pen Test all you can!! White box (even if outsourced) Educate developers to ask for them Prioritize!
- 50. Use existing tools Classify! Type Manager/Director/etc. Team Communicate Approach for help Vulnerability Fixing Vulnerability Tracking
- 51. Security Training Threat Modeling Security Code Review Secure Coding Culture Development Security Features Static Code Analysis Security Testing Internal Security Testing External Vulnerability Fixing Vulnerability Tracking How we envision AppSec WAF
- 52. WAF First Last Line of Defense Gain Visibility Quick reaction
- 53. Metrics, Metrics, Metrics Open vs Closed in Q Average fix time Aging Distribution (type, manager, project)
- 54. Conclusions Adapt to organization Evangelize Games Start with less disruptive (time consuming) practices Measure