The document presents an overview of DevSecOps, emphasizing the importance of incorporating security into the development and operations processes through collaboration among teams. Key tenets include built-in security, continuous monitoring, and automation of security practices to ensure timely and efficient project delivery. It also outlines best practices for implementation, governance, culture, and technological aspects of security in a DevSecOps framework.

1. #ATAGTR2018
Decoding Security in DevSecOps
Meghashyam Varanasi & Venkat Moncompu
27th September 2018

2. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Agenda
DevSecOps Introduction
Construct Security
Six Tenets of DevSecOps
Evolution of Security with SDLC Progression
Dimensions of DevSecOps
Governance & Culture
Sustain Security
Technology & Security
Implementing Security in DevSecOps
Security Best Practices

3. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
DevSecOps Introduction
DEV OPS
SEC
What is DevSecOps?
DevSecOps is based on the
principle that collaboration
to exist among Security,
Application development
and IT operations teams.
Why DevSecOps?
DevSecOps enables in-built
security, continuous security
& monitoring with out
compromising on speed
/time to market.

4. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Six Tenets of DevSecOps
Security Culture Built in Security Shift Left Security
Testing
Automation of
Security
Security First
Approach
Continuous Security

5. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Evolution of Security with SDLC Progression
Traditional SDLC Agile Methodology CI/CD DevSecOps
Security Culture Low Medium Medium-High High
Continuous Security Low Medium-High Medium-High High
Automation of Security Low Medium Medium-High High
Built in Security Low Medium Medium High
Security First approach Medium Medium Medium High
Shift Left Security Low Medium-High Medium-High High
Enhanced Security Focus

6. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Dimensions of DevSecOps
Governance Culture Technology Security
 Secure Processes
 Security Policy
 Secure Systems
 Security Mindset
 Security Discipline
 Security Trained
 Security Tools
 Security Automation
 Security Capability
 Continuous Security
 Security Monitoring
 Security Remediation

7. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Dimensions of DevSecOps - Governance & CultureGovernance
Secure Processes
Establish processes that are secure by design (
Ex: Separation of duties)
Secure Systems
Establish a Governance model where security
systems are built in (Ex: Hub & Spoke Security
Excellence team)
Secure Policy
Ensures that the security policies are built to
ensure maximum security (Ex: Role based
Authentication)
Culture
Security Mindset
Have a security first mind set and instil security
as a core principle. ( Ex: Security as First class
citizen)
Security Trained
Train associates on security methodologies &
best practises ( Ex: Secure coding for
developers)
Security Discipline
Encourage teams to adopt security in a
disciplined manner and give the highest
priority to security

8. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Dimensions of DevSecOps - Technology & SecurityTechnology
Security Tools
Establish a full set of base line tools for security
validation (Ex: Third party tools, Internal tools,
Open source tools)
Security Capability
Always strive to improve organization
capability to better identify & prevent possible
security lapses.
Security Automation
Automate every possible security control, so
that the validation can be done very quickly
and repeated as required
Security
Continuous Security
Security is automatically validated
continuously throughout the life cycle ( Ex:
Automatic security test on the CI/CD pipeline
Security Remediation
Allows the ability to identify potential threats
and automatically respond to the same (Ex:
RASP )
Security Monitoring
Continuous monitoring of production systems
and analyse for any Security attacks (Ex: Log
Monitoring, Infra Monitoring)

9. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Implementing Security In DevSecOps
01. Construct Security 02. Sustain Security
 Configure
 Monitor
 Contain
 Stabilize
 Predict
 Make
 Build
 Validate

10. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Implementing Security In DevSecOps - Construct
Plan
Make
Build
Validate
• Test Common abuse cases
• Penetration Testing
• Compliance validation
• Software vulnerability Assessment
• Configuration Security Assessment
• Generate file integrity baseline
• Break breaker for possible security
violations
• Code analysis
• Verify security of workload at build time
• Threat modelling
• Analyze/Predict Security incidents
• Design security policies
• Define policy groups
• Static/Dynamic App Security Analysis
• Abuse case tests
• Build agent via continuous integration
• Build scripts for security validation
• Build gold master imagesAppln Security Infra Security

11. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
Implementing Security In DevSecOps - Sustain
Deploy
Monitor
Contain
Stabilize
• Maintain service for non Attack usage
• Incident root causes analysis
• Updating threat modeling etc.
• Security patches updates
• Platform update for vulnerabilities
• RASP auto respond
• Rollback/toggle off.
• Block attackers
• Auto blocking for DDOS attacks
• Auto showdown of Infrastructure
• Configuration validation
• Feature Toggles / Traffic
• Apply runtime policies on (Software
vulnerability , Configuration security etc.
• Firewall, authentication
• File integrity monitoring
• Log Monitoring & Analysis
• Intrusion detection
• Security events monitoring
• Security Audit data
• Scope new vulnerabilities ,Threat
modelling
Appln Security Infra Security

12. #ATAGTR2018
As a author of this presentation I/we own the copyright and confirm the originality of the content. I/we allow Agile testing alliance to use the content for social media marketing, publishing it on ATA Blog or ATA social medial
channels(Provided due credit is given to me/us)
DevSecOps Best practises – Automation & Progressive Security
Best Practise Few Examples
Security Policy as Code
 Infrastructure as a code approach to security
 Eliminate manually intensive and error prone configuration process
 Accelerate the pace of innovation and reduce risks
Train Developers on Secure Coding
 Training developer on secure coding practises
 Educate developer on common mistakes and frequently occurring security issues
Well-Orchestrated Security Tooling
 Usage of best in class third party tools for security
 Usage of the tools provide by Cloud Service Providers
 Usage of Make use of tools & technologies available in market to
Building Security @ Scale
 Ensure that all the security coding practise are scalable
 Ensure that all the infrastructure security practises are scalable and automatic
 Ensure that all the security configurations are scaled easily with minimal human intervention
Separation of duties  Enforce maker checker policy where no single person is authorize to own the entire flow.
Access Management
 Role Based Access Control (RBAC) is an approach to restricting access to authorized users
 Fine Grained Access Control (FGAC) allows security control on finest possible data/asset.
 Multi Factor Authentication (MFA) enforces more than one authentication for high privileged users.

13.  https://www.sans.org/reading-room/whitepapers/analyst/devsecops-approach-securing-code-cloud-37597
 https://lp.cyberark.com/rs/316-CZP-
275/images/CyberArk%20ebook%206_Principles_for_DevOps_Secuirty_at_Scale%20v0-1.pdf
 https://techbeacon.com/6-devsecops-best-practices-automate-early-often
 https://en.wikipedia.org/wiki/Role-based_access_control
 https://www.sans.org/reading-room/whitepapers/analyst/devsecops-playbook-36792
 https://www.sonatype.com/devsecops-reference-architectures
 https://twitter.com/LMaccherone/status/843644744538427392
Reference

14. About Author
Primary Author :
Meghashyam Varanasi
Associate Director
Cognizant Consulting
Co-Author:
Venkat Moncompu
Director
Cognizant Consulting

15. Thank you