Presented at Delivery of Things, USA http://deliveryofthingsworldusa.com/en/

1. Adopting a security attitude in DevOps via DevOpsSec

2. @TopoPal
Tapabrata “Topo” Pal
Engineering Fellow
Product Manager, Shared Continuous Delivery Tools Platform
Community Manager, Hygieia Open Source DevOps Dashboard
tapabrata.pal@capitalone.com
@TopoPal
Past:
• PhD in Semiconductor Physics
• 20 years of IT experience as Developer, Architect,
System Engineer
• Experience in Retail, Healthcare and Finance industries

3. @Topo Pal
! 70 million accounts
! One of the largest Digital Banks
! ~ 20 years old

4. @Topo Pal
Different DNA
! Build our own software
! Build on public cloud
! MicroServices
! Open Source
! DevOpsSec and Continuous Delivery

5. @Topo Pal
http://www.devopsdays.org

6. @TopoPal
Deliver High Quality Working Software Faster

7. @TopoPal
Deliver High Quality Working Software Faster
• No security flaws
• No legal flaws
• Minimum defects
• All levels of testing done
• Code reviewed and source controlled
• Testing of application, configuration, scripts etc.
• Across LOBs, Shared Services and 3rd Parties
• Tested end-to-end
• All dependencies are satisfied
• How fast? ASAP?

8. @TopoPal
http://www.netuba.org/

9. @TopoPal
https://en.wikipedia.org/wiki/Oil_refinery

10. @TopoPal
https://commons.wikimedia.org/wiki/File:US_Navy_060906-
N-8257O-026_Damage_Controlman_1st_Class_Petty_Officer_Derrick_Harney_assists_his_students_in_repairing_a_broken_pipeline_during_the_hands_on_patch_tr
aining_portion_of_the_Damage_Control_Wet_Trainer.jpg

11. @TopoPal
A delivery pipeline without security attitude is NOT a pipeline

12. @TopoPal

13. @Topo Pal

14. @Topo Pal
Business
• Requirements
• Feature Request
• Roadmap
Development
• Architecture
• Design
• Code
• Test
Operations
• Infrastructure
• Platforms
• Environment
• Deployment
• Incident Mgmt
• Change & Release Mgmt.
Information Security
Application Security Security Testing
Information Security Infrastructure Security
DevOpsSec

15. @TopoPal
Shift Left
Automate
Everything
Dashboard
Everything
Three Pillars of DevOpsSec

16. @TopoPal
Code Quality
Check
Unit/
Integration
Test
Binary
Repository
CI Tool
IDE
Source
Control
Agile PM
Tools
Defect
Management
Request,Plan
ReportResults
Automated Tests
Code Analysis
Automated
Build
Develop, Unit Test
Continuous
Integration
Automated/Continuous
Deployment
Plan
Monitor
Verify
Deploy
Continuous
Deployment
Test Mgmt
Test Data Mgmt
D
evelop
Promote
Verify
Execute
Service Test
UI Test
Device Test
Perf Test
Security Test Continuous
Testing
Service
Virtualization
Acceptance Test
Infrastructure and Environment
Dashboard/Feedback
End to End Traceability, Real time status of Code, Build, Deploy, Test, Application and Environment Health

17. @TopoPal
Code Quality
Check
Unit/
Integration
Test
Binary
Repository
CI Tool
IDE
Source
Control
Agile PM
Tools
Defect
Management
Request,Plan
ReportResults
Automated Tests
Code Analysis
Automated
Build
Develop, Unit Test
Continuous
Integration
Automated/Continuous
Deployment
Plan
Monitor
Verify
Deploy
Continuous
Deployment
Test Mgmt
Test Data Mgmt
D
evelop
Promote
Verify
Execute
Service Test
UI Test
Device Test
Perf Test
Security Test Continuous
Testing
Service
Virtualization
Acceptance Test
Infrastructure and Environment
Dashboard/Feedback
End to End Traceability, Real time status of Code, Build, Deploy, Test, Application and Environment Health

18. @TopoPal
Delivery Pipeline: Automated, Continuous, Compliant
Code Build
Release
Monitor
Deploy + Test Execution
App
Test
Infra
DEV INT QA PERF PROD
DEV INT
SEC
QA SEC PERF PROD
DEV INT QA SEC PERF PROD Infra
App
Flow Feedback
Automated Audit and Security Controls at every step

19. @TopoPal
Code
Application Code
Test Code
Infrastructure Code
! IDE Security Plugins
! Secure Coding Practices
! Security BDD
! Open Source Bill of Material
Security during Coding

20. @TopoPal
Build
! Bill of Materials
! Static Code Analysis
! Static Security Analysis
! Security BDD
Security during Building

21. @TopoPal
Deploy + Test Execution
Security Testing
! Application Security Testing
! Penetration Testing
! Data Security Testing
! Configuration Security Testing

22. @TopoPal
Security Shift-Left

23. @TopoPal
Security Rapid Feedback

24. @TopoPal
Any Question?