You wouldn’t make changes in a production environment without testing first, so why make changes to a production pipeline and risk breaking the CI/CD process? This talk will introduce the concept of Blue/Green *pipelines* to optimize flow and continuously experiment with security toolsets without interrupting critical DevSecOps infrastructure.

1. Blue is the New
Green
DJ Schleen
DevSecOps Evangelist and Security Architect
@djschleen

2. @dschleen
🌈🦄🐒🐈

3. Bright Shiny Toys
@dschleen
This isn’t how you start discussing DevSecO

4. @dschleen
This is…
Photo by rawpixel.com from Pexels

5. This is not a DevSecOps Pipeline
@dschleen

6. This is not a DevSecOps Pipeline
@dschleen
It’s just tool silos
S L O E DI

7. This is just plagiarism
@dschleen

8. … and a copy of a
*Lifecycle* example
@dschleen
Created by
Shannon Lietz to
discuss shifting
Security to the left
in 2016

9. This is *definitely* not a DevSecOps pipeline
@dschleen
Security Anyone?

10. This is a pipeline – it delivers people from Po
@dschleen

11. This is a pipeline
@dschleen

12. @dschleen
Production Pipelines

13. @dschleen

14. @dschleen
Blue is the new Green
Let your Production pipeline flow
Experiment (the Third Way) in a separate pipeline
Looking good? Switch them up.

15. @dschleen
Break all you want with no remorse…

16. @dschleen
Develop Technique
Infrastructure as Code (Do it)
Security as Code (Do it)
Anything as Code (Do it)
Identify drag with replicated pipelines
Don’t mess with production pipelines
Use the dual pipeline approach for ”bake offs”

18. ▓█████▄ ▓█████ ██▒ █▓ ██████ ▓█████ ▄████▄ ▒█████ ██▓███ ██████
▒██▀ ██▌▓█ ▀▓██░ █▒▒██ ▒ ▓█ ▀ ▒██▀ ▀█ ▒██▒ ██▒▓██░ ██▒▒██ ▒
░██ █▌▒███ ▓██ █▒░░ ▓██▄ ▒███ ▒▓█ ▄ ▒██░ ██▒▓██░ ██▓▒░ ▓██▄
░▓█▄ ▌▒▓█ ▄ ▒██ █░░ ▒ ██▒▒▓█ ▄ ▒▓▓▄ ▄██▒▒██ ██░▒██▄█▓▒ ▒ ▒ ██▒
░▒████▓ ░▒████▒ ▒▀█░ ▒██████▒▒░▒████▒▒ ▓███▀ ░░ ████▓▒░▒██▒ ░ ░▒██████▒▒
▒▒▓ ▒ ░░ ▒░ ░ ░ ▐░ ▒ ▒▓▒ ▒ ░░░ ▒░ ░░ ░▒ ▒ ░░ ▒░▒░▒░ ▒▓▒░ ░ ░▒ ▒▓▒ ▒ ░
░ ▒ ▒ ░ ░ ░ ░ ░░ ░ ░▒ ░ ░ ░ ░ ░ ░ ▒ ░ ▒ ▒░ ░▒ ░ ░ ░▒ ░ ░
░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ ░ ░ ▒ ░░ ░ ░ ░
░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ░
░ ░ ░
The
Experiments

19. Experiment #1 – False Positives Suck

20. This can’t be
right.
Or can it?

23. Questions:
* Is this a false positive?
* How would we know?
Share your ideas on Twitter @djschleen
Find out next week on The DevSecOps Experiments
https:/devsecopsdays.com

25. @dschleen
That is why we don’t talk about
tools until we figure out our
culture and technique.

26. @djschleen
Blue is the new
Green
Grab a copy of our new book “Epic Failures of
DevSecOps”
https://t.co/u8ErG1zshD