In Crossing the DevOps and Infosec Divide, Gene Kim and experts from Sonatype and XebiaLabs gave an overview of the common people, process, and tool challenges enterprise teams are facing and discussed some of the practices high performing teams are finding success with in bridging the DevOps and Information Security divide. Register for Part Two of this DevSecOps on-demand webinar series and see real-world use cases of DevSecOps in practice. During this recording, Ilkka Turunen, Solutions Architect, Sonatype and Rob Vanstone, Principal Sales Engineer, XebiaLabs also outline how security fits into the DevOps process, discuss the essential requirements for integrating security in a DevOps-native world as well as the key metrics to look for to ensure DevSecOps success.

1. WEBINAR
A DevSecOps Demo
Early, everywhere, at scale

2. 2
Housekeeping
▪ This webinar is being recorded
▪ Links to the slides and the recording
will be made available a:er the
presenta<on
▪ You can post ques<ons via the
GoToWebinar Control Panel

3. 3
Meet Your Presenters
Ilkka Turunen
Solu<ons Architect EMEA
Sonatype
Rob Vanstone
Director of Solu<ons Architecture
XebiaLabs
Tim Buntel
VP of Products
XebiaLabs

4. 4
Sonatype - History of SoFware Dependencies
Apache Maven
Maven
Central Repository
Nexus Repository
125K
9M
52B
5B
Nexus Component
Intelligence
2005
2017

5. 5
DEPLOY
PROVISION
XebiaLabs – Enterprise DevOps
Deliver, release and deploy any applica1on with the visibility,
automa1on and control you need for DevOps at enterprise scale

6. 6
HACKERS!
HACKERS
EVERYWHERE!

7. 7
Transport
halted

8. 8
XXXXX
HAS ALREADY CONSUMED
8
~ Marc Marc Andreessen 2011

9. 9

10. 10

11. 11
Transi<ve Dependencies (Maven central Aug 2015)
Complex interedependencies

12. 12
Javascript
transi<vity
- 80 million JS files
- 6 million unique files

13. 13
Deliver Faster

14. 14
jar
app
container
system
Build & bundle
Deployment
Provision
The Earlier You Get it the BeWer it is
jar
jar
jar
jar
src
TTR: 250**
TTR: 50**
TTR: 25**
TTR: 10**
**Source: CrossTalk: The Journal of Defense So:ware Engineering – average <me measurement applied

15. 15

16. 16
Dev CD CI
Prod
QA
UAT
Block Bad Stuff
Early Feedback
Policy Enforcement
Trusted components
Monitored for new issues
Build
Public Component
Repositories
Source Control Deploy Repository
Developers
Policy Enforcement

17. 17
Build
Public Component
Repositories
Source Control Deploy Repository
Developers
Dev
Prod
QA
UAT

18. 18
Early

19. 19
DEPLOY
PROVISION
Everywhere

20. 20
Pipelines

21. 21
Visibility
Visibility

22. 22
Visibility
Visibility

23. 23
OrchestraZon
Packaging can already fail if
security vulnerabili4es are
found
There s4ll may be manual
ac4vi4es for your now
included Security roles
Time might have elapsed
since build and release
(ini4ally)
Check at every opportunity

24. 24
Control
Packaging can already fail if
security vulnerabili4es are
found
There s4ll may be manual
ac4vi4es for your now
included Security roles
Time might have elapsed
since build and release
(ini4ally)
Check at every opportunity

25. 25
At Scale

26. 26
Build
Public Component
Repositories
Source Control Deploy Repository
Developers
Dev
Prod
QA
UAT

27. 27
Register for Our Next Webinar!
http://bit.ly/2pCLpQr

28. 28
Ques<ons?

29. Thank You!