The document discusses how to integrate security practices into DevOps workflows at speed. It recommends a three step approach: 1) Make security part of agile planning and processes like Scrum, including security training, requirements, testing and demos. 2) Implement a "DevSecOps" pipeline that automates security checks and testing at each stage of development. 3) Continuously measure and reduce security debt and improve app robustness and security skills over time. The goal is to shift security left and make it part of fast-paced DevOps cycles.

1. Security at DevOps Speed
Stefan Streichsbier
CTO Vantage Point
Founder DevSecOps Singapore
stefan@vantagepoint.sg
@s_streichsbier

2. What is
AppSec?

3. Why does
AppSec ==
Pain?

4. Pentesters after
turning a report
in...

5. Security

6. Meanwhile
outside the
security camp
...

7. 0
20
40
60
80
100
120
140
2005 2010 2015 2020
The frequency of releases over time
Releases per app per year
Towards CD
From Waterfall
The frequency increased

8. 8
So many releases?!

9. Security
DevOps

10. 10
Agile + DevOps + Security = DevSecOps

11. Step 1:
Security as
part of Agile

12. 1-4
Weeks
24 hours
Develop
Test
Design
Plan
Output
Shippable Increment
Product Backlog Sprint Backlog
Let’s look at SCRUM
Start with understanding the process

13. 1-4
Weeks
24 hours
Develop
Test
Design
Plan
Output
Shippable Increment
Product Backlog Sprint Backlog
Secure SCRUM
Security Training
Security Requirements
Security Activities
Threat Modelling
Design Review
Pairing
Manual Security Tests
Automatic Security Tests
Security Feature Demo Security Retrospective
Security Acceptance Criteria

14. (Security)
User Stories

15. (Security)
Unit Tests

16. 0
20
40
60
80
100
120
Sprint 1 Sprint 2 Sprint 3 Sprint 4 Sprint 5 Sprint 6
% Remaining Security work % App Robustness, Security Skills
Security Debt Burndown

17. Step 2:
DevSecOps

18. Vulnerability
Repository
• Security Unit
Tests
• SAST
• SCA
• DAST
• IAST
• VA
• Security as Code
• RASP
• NG WAF
• Red Team
• GOPT
• Actual Attackers
• Sec Requirements
• Design Review
• Threat Modelling
AppSec Pipeline

19. Instead of this ...

20. ...Let’s do this...