The document discusses DevSecOps, which combines DevOps and network security. It outlines the stages of a DevSecOps pipeline including continuous integration, delivery, and deployment. It presents a DevSecOps manifesto advocating for open collaboration, security as a service, exploit testing, and compliance as operations. The document also provides examples of integrating security practices at different stages of the software development lifecycle and approaches for legacy versus new applications.

1. DevOps
+
Network Security
=
DevSecOps
By Jeremiah Tillman

2. A Well Rounded DevOps Team
QA
Testing
Operatio
Develop

3. Continuous Integration (CI)
Merging the development branches
together (master branch)
Must successfully pass a series of tests

4. Continuous Delivery (CD)
Deploying small changes more often
Automated delivery of updates

5. Deployment Pipeline
Stages Build & Automate CI Test Automation Deploy Automation
Components Visibility Feedback Continuously Deploy

6. DevSecOps Manifesto
 Leaning in over Always Saying “No”
 Data & Security Science over Fear,
Uncertainty and Doubt
 Open Contribution & Collaboration over
Security-Only Requirements
 Consumable Security Services with APIs over
Mandated Security Controls & Paperwork
 Business Driven Security Scores over Rubber
Stamp Security
 Red & Blue Team Exploit Testing over Relying
on Scans & Theoretical Vulnerabilities
 24x7 Proactive Security Monitoring over
Reacting after being Informed of an Incident
 Shared Threat Intelligence over Keeping Info
to Ourselves
 Compliance Operations over Clipboards &
Checklists

7. DevSecOps Integration
 1. Prior to code being committed
 SAST that be run locally or integrated into an IDE
 2. During CI
 Security checks can be issued via the jobs server
 Unit testing, abuse cases, SAST, and software component analysis (supply chain hygiene)
 3. After a successful build
 Automatically and securely configure and provision servers
 Configuration management, DAST, security smoke tests
 4. Post deployment
 Automated runtime asserts and compliance checks
 Automated correction
 Production monitoring/feedback

8. Greenfield vs. Legacy
 Greenfield Environment /Applications
 Do it right from the start!
 Legacy Applications
 Start with vulnerability & risk assessment
 Apply patches to remediate all vulnerabilities that don’t require major design changes
 Integrate automated security testing in future releases when possible
 Rebuilding / Sunsetting
 Consider breaking out individual components one at a time, where possible, instead of a hard cutover
 New system should be following secure architecture principles and integrate security throughout the
SDLC